Taxpayer guide to identity theft

If you use an online application to do your taxes, you can now log in with your username, password and a third personal item like a phone number. Using all 3 will keep your identity and data safer.

Tax-related identity theft occurs when someone uses your stolen personal information, including your Social Security number, to file a tax return claiming a fraudulent refund.

If you suspect you are a victim of identity theft, continue to pay your taxes and file your tax return, even if you must file a paper return.

Know the signs of identity theft

You may not know you’re a victim of identity theft until you’re notified by the IRS of a possible issue with your return.

Be alert to possible tax-related identity theft if:

• You get a letter from the IRS inquiring about a suspicious tax return that you did not file.
• You can’t e-file your tax return because of a duplicate Social Security number.
• You get a tax transcript in the mail that you did not request.
• You get an IRS notice that an online account has been created in your name.
• You get an IRS notice that your existing online account has been accessed or disabled when you took no action.
• You get an IRS notice that you owe additional tax or refund offset, or that you have had collection actions taken against you for a year you did not file a tax return.
• IRS records indicate you received wages or other income from an employer you didn’t work for.
• You’ve been assigned an Employer Identification Number, but you did not request an EIN.

Take action if you are a victim

There are steps you can take if your Social Security number or other personal information is compromised.

Tax-related identity theft

If your Social Security number is compromised and you know or suspect you are a victim of tax-related identity theft, the IRS recommends these actions:

• Respond immediately to any IRS notice: Call the number provided.
• If your e-filed return is rejected because of a duplicate filing under your Social Security number, or if the IRS instructs you to do so, complete Form 14039, Identity Theft Affidavit PDF , attach it to the back of your completed paper tax return and mail to the IRS location based upon the state you reside. If you prefer, you have the option to submit the Form 14039 online and mail your paper return separately.
• Visit IdentityTheft.gov for steps you should take right away to protect yourself and your financial accounts.

See Identity Theft Victim Assistance: How It Works for more information about how the IRS can help you.

If you previously contacted the IRS and did not have a resolution, contact us for specialized assistance at 800-908-4490. We have teams standing by to help you.

Fraudulent returns

If you believe someone has filed a fraudulent return in your name, you can get a copy of the return. See Instructions for Requesting a Copy of Fraudulent Returns.

Dependents

If you e-file your tax return and get a message telling you that a dependent on your return has been claimed on another tax return or their own, or if you receive an IRS Notice CP87A, you’ll need to find out why someone else claimed your dependent. Learn more at What to Do When Someone Fraudulently Claims Your Dependent.

Data breach

Not all data breaches or computer hacks result in tax-related identity theft. It’s important to know what type of personal information was stolen.

If you’ve been a victim of a data breach, keep in touch with the company to learn what it is doing to protect you and follow the “Steps for victims of identity theft.” Data breach victims have the option to submit a Form 14039, Identity Theft Affidavit online, or by completing the fillable Form 14039 PDF , printing and then mailing or faxing the form to the IRS. Choose one option and submit the form if your Social Security number has been compromised and your e-filed return was rejected as a duplicate or the IRS instructs you to file the form.

Employment-related identity theft

If you believe someone has been using your Social Security number for employment purposes (as opposed to filing fraudulent tax returns for refunds in your name) see our Guide to employment-related identity theft.

Assigned an EIN not requested

If you've been assigned an Employer Identification Number (EIN) that you didn't request, you should first determine if someone acted legitimately on your behalf.

It's important for you to determine why the EIN was assigned to you before assuming you're a victim of identity theft. A third party may have requested an EIN on your behalf for a legitimate business purpose. What to do if you’re assigned an Employer Identification Number (EIN) you did not request.

Protect your data and identity

Your computer and mobile phone

The IRS, state tax agencies and the tax industry need your help to fight back against identity thieves. See Taxes. Security. Together.

• Use security software and make sure it updates automatically; essential tools include virus/malware protection and a firewall.
• Use encryption programs to protect sensitive digital data.
• Treat your personal information like cash; don’t leave it lying around.
• Use strong, unique passwords; consider a password manager.
• Use multi-factor authentication when it's offered.
• Give personal and financial information only over encrypted websites; look for “https” addresses.
• Back up your files.

Phishing emails and scams

Identity thieves use phishing emails to trick users into giving up passwords and other information. Don’t take the bait. There are several tips the Federal Trade Commission provides that you can follow to avoid phishing scams, such as not responding to e-mails that ask for personal or financial information. Share this information with family and friends.

Please report IRS, Treasury and/or tax-related suspicious online or emailed phishing scams to phishing@irs.gov. For more information, please see Report Phishing.

Please report IRS impersonation scams - especially if you are a victim - to the Treasury Inspector General for Tax Administration’s IRS Impersonation Scams Reporting.

You can report other suspicious online or emailing phishing scams to phishing-report@us-cert.gov.

Passwords

Create strong passwords that follow these simple guidelines:

• Use long phrases that you can remember, combined with characters and numbers.
  • Example: SomethingYouCanRemember@30.

  Multi-factor authentication

  If you do your own taxes using an online provider, you have the option of using multi-factor authentication as another layer of protection. The IRS strongly encourages the use of this option. It helps prevent identity thieves from accessing your online account with your tax provider.

  Generally, a multi-factor authentication option allows the user to receive a security code, for example, as a text to a mobile phone. When you return to use the product, you must enter your username, password and the security code to complete the login process.

  Most financial institutions, social media and email providers also offer multi-factor authentication options. People should opt for multi-factor authentication wherever it is offered.

  IRS Identity Protection PINs

  All taxpayers who can verify their identities are eligible for an Identity Protection PIN. The IP PIN is a 6-digit PIN that offers additional protections for your Social Security number on your tax return.

  To obtain an IP PIN, use the Get an IP PIN tool to opt into the program. If you already have an IRS account, enter your username and password. If not, you must pass an identity verification process to create an account and request an IP PIN.

  For details on the IP PIN and alternatives for those who cannot authenticate online, see Get an IP PIN.

  How we help

  The IRS, state tax agencies and the tax industry work in coordination as the Security Summit to protect taxpayer data. Our program includes safeguards that identify suspicious returns.

  We never:

  • Initiate contact with taxpayers by email, text or social media to request personal or financial information
  • Call taxpayers with threats of lawsuits or arrests
  • Call, email, or text to request taxpayers’ Identity Protection PINs

  Publications

  • Publication 4524, Security Awareness for Taxpayers PDF
  • Publication 5027, Identity Theft Information for Taxpayers PDF