Tax identity theft: How it happens and how to fix it

December 07, 2017 : H&R Block

Tax identity theft is the largest growing area of identity theft crimes. Each year, thieves attempt to use taxpayer information to file millions of fraudulent tax returns and receive a refund. The U.S. Treasury loses billions of dollars annually to tax identity theft – and millions of victims are left wondering how it happened to them and how they can fix it.

Why does tax identity theft happen?

Tax identity theft is relatively easy in today’s current tax system. Thieves need only your name, Social Security Number (SSN) and date of birth to file a fraudulent return online. And most of the time, the thieves are untraceable.

Because of the many recent data breaches involving companies and governments, thieves can find your personal information pretty easily. Then, thieves can make up a W-2 in your name and file a return claiming a big refund, which is then deposited in a bank account of their choice – all electronically.

The IRS is defenseless because it does not have your W-2 information early enough to match it to your return. The IRS is also under pressure to electronically issue refunds within 21 days. If fraudulent returns get past IRS detection systems, thieves can successfully steal thousands of dollars per tax return. The only real challenge for tax identity thieves is to file before you do. That’s why most tax identity theft happens early in the filing season or to individuals who may no longer have a filing requirement, like retired people.

Sometimes, the IRS will get in touch with you if its filters detect a potentially fraudulent return. In that case, you may get a letter (usually, Letter 5071C) asking you to verify your identity on a special Identity Verification Service website, at, or by calling the IRS. However, with recent scams designed to look like legitimate identity-theft verification measures, many taxpayers have become suspicious of IRS letters.

How do you know if you’ve become the victim of tax identity theft?

There are basically two ways to detect tax identity theft.

1. The IRS rejects your return – and you haven’t filed yet.

When you try to e-file your return, the IRS rejects it because a return has already been already filed under your name and SSN. If you file a paper return, the IRS will send you a notice letting you know the same thing. At that point, you may be confused because you haven’t filed yet. Chances are, you’re the victim of tax identity theft.

2. The IRS contacts you about income that you didn’t earn.

Employment-related tax identity theft happens when someone uses your SSN to get a job or otherwise earn income. It’s an even bigger headache to resolve than a stolen refund. If this happens, you’d find out about it later in the year when the IRS sends you a notice about additional income that was not included on your tax return. (In fact, the income is not yours at all, but instead was earned by a thief and reported under your identity.)

Now, the IRS is auditing you or trying to collect taxes from you. These cases take about a year to resolve. During that time, victims receive IRS notices and may even have future refunds frozen until the problem is fixed.

One way to combat the employment-related tax identity theft is to find out what information statements (W-2 or 1099) are being filed under your SSN. In May of each year, you can ask the IRS to provide your wage and income transcripts. You can order them online, and the IRS will mail them to you in about a week.

Review the document for any discrepancies or unfamiliar income and contact any unfamiliar payers if you don’t think you should have received an information statement from them. This is a great way to stay proactive and guard against someone using your SSN for employment-related tax identity theft.

What you should do if you are a victim of tax identity theft

If you are a victim of tax identity theft – that is, someone used your SSN to file a fraudulent return and get a refund – you should act immediately.

Here is what you should do:

  1. Contact the IRS. Confirm that a return was filed using your information and register that you are a victim of tax identity theft. The IRS has a special unit to help: the Identity Protection Specialized Unit. Call (800) 908-4490, from 7 am to 7 pm, Monday-Friday
  2. Complete an IRS identity theft affidavit. Complete IRS Form 14039, Identity Theft Affidavit (a new version was released in April 2016). Attach proof of your identity (such as a copy of your driver’s license or other government ID). The IRS encourages you also to report your tax identity theft to local police, the Federal Trade Commission and credit agencies. However, you don’t have to attach those reports with the Form 14039.
  3. File your tax return. Immediately file your return by mail and attach the Form 14039 and your proof of identity. Don’t wait to file. If the IRS receives your return after the tax deadline (April 18 this year), and you have a balance due on your return, the IRS may charge you a late-filing penalty regardless of your circumstances.

After you’ve completed these steps, the IRS will send you Letter CP01A every December or early January. This letter will provide you with an Identity Protection Personal Identification Number, or IP PIN, that you will need to use to file your tax return. Without this IP PIN, you won’t be able to file electronically for that year. You’ll receive a new IP PIN by mail each year.

The IRS is always contemplating changes on how to protect taxpayers who become the victim of tax identity theft, including making changes to the IP PIN program. Keep an eye out for changes so that you know how to file every year.

Refund delays: How long?

The IRS currently issues more than 90 percent of refunds to all taxpayers within 21 days of accepting the return. However, if you are a victim of tax identity theft, your refund will be delayed. In 2016, most identity theft victims have been waiting about four months to receive their refunds. Victims of employment-related tax identity theft are waiting much longer because the IRS must correct the audit or collection issues that delay the refund.

An ounce of prevention: how to help better protect yourself from becoming a victim of tax identity theft

You can help better protect yourself by practicing simple measures to keep your personal information private and secure. For example, don’t carry your Social Security card or give out your SSN or birth date on the phone, email, text or in public. Do not share your user IDs, passwords or PINs – and make them hard to guess. Close unused credit card accounts and destroy the card. Shred documents containing your personal information. Request a copy of a credit report and keep tabs on who might be accessing it.

You should also beware of scams. The IRS will always contact taxpayers by mail first about taxes owed. And the IRS will never:

  • call to demand immediate payment or ask for credit or debit card information over the phone,
  • email or connect on social media to request personal information or
  • require specific payment methods.

But these measures alone won’t always be sufficient. Remember that tax identity thieves can get the information they need to file a return from data breaches of companies and governments. In these cases, taxpayers need to be vigilant.

For example, one taxpayer was able to avoid tax identity theft because she signed up for H&R Block’s Tax Identity Shield, the first service specifically directed to helping protect against the growing problem of tax identity theft. After signing up last tax season, she got a notice from H&R Block that someone had attempted to use her information to file a return this year. She called to confirm that she had not filed yet and H&R Block was able to stop the fraudulent return. Because of the Tax Identity Shield’s quick notification and her action, she was able to e-file her tax return as normal.

When the worst happens, the Tax Identity Shield supports taxpayers in the tax identity restoration process with completing the necessary tax documents, setting up fraud alerts and filing an FTC complaint and police report. Another taxpayer with Tax Identity Shield said the team, which she described as a task force busy on her case, helped her recover her tax identity with empathy and compassion.

Tax identity theft is relatively easy in today’s current tax system but recovering from it is not nearly as simple. As the threat grows and the risk spreads, taxpayers are taking action to protect themselves. In fact, the Tax Identity Shield is helping better protect nearly twice the taxpayers it did last season. To learn more, you can check out the IRS’ Taxpayer Guide to Identity Theft and H&R Block’s newsroom.

Related Resources

H&R Block

Connect with us