In Fact Sheet 2022-25, the IRS has provided information about how taxpayers should handle non-tax and tax-related identity theft.

When a taxpayer believes their personal information is being used to file fraudulent tax returns, they should submit a Form 14039, Identity Theft Affidavit, to the IRS. But in most cases, taxpayers do not need to complete this form. Only victims of tax-related identity theft should submit the Form 14039, and only if they haven’t received certain letters from the IRS.

All taxpayers can request an Identity Protection Personal Identification Number (IP PIN) using the Get An Identity Protection PIN (IP PIN) tool on IRS.gov to protect themselves from becoming a victim of tax-related identity theft.

What is tax-related identity theft?

Tax-related identity theft occurs when someone uses a taxpayer’s stolen Social Security number (SSN) to file a tax return claiming a fraudulent refund.

In the vast majority of tax-related identity theft cases, there is no need to file the Form 14039 affidavit. That’s because the IRS identifies a suspicious tax return based on hundreds of processing filters and pulls the suspicious return for review. The IRS will send a letter to the taxpayer and will not process the tax return until hearing back from the taxpayer.

In this situation, the taxpayer will receive Letter 5071C, which asks them to use an online tool to verify their identity and tell the IRS if they filed the return in question. A variation, Letter 4883C, asks the taxpayer to call the IRS to verify their identity and tell the IRS if they filed the return. For those who have been a victim of a data breach, they may receive Letter 5747C and be asked to verify their identity in person at a Taxpayer Assistance Center. Read more about the letters at Understanding Your 5071C Letter, Understanding Your 5747C Letter or Understanding Your 4883C Letter. If the taxpayer receives any of these letters, there is no need to file a Form 14039. Instead, they should follow the instructions in the letter. This will provide all the information that the IRS needs.

But there are various other signs of possible tax-related identity theft:

• A taxpayer can’t e-file their tax return because of a duplicate tax return filed using their Social Security number. (However, make sure there is no error in the SSN, such as transposed numbers.)
• A taxpayer can’t e-file because a dependent’s Social Security number or ITIN was already used by someone on another return without the taxpayer’s knowledge or permission. (Also check that the SSN or ITIN is correct, and be sure the dependent hasn’t filed a separate tax return.)
• A taxpayer receives a tax transcript in the mail they did not request.
• A taxpayer receives a notice from a tax preparation software company confirming an online account was created in their name, and they did not create one.
• A taxpayer receives a notice from their tax preparation software company that their existing online account was accessed or disabled when they took no action.
• A taxpayer receives an IRS notice informing them that they owe additional tax, or their refund was offset to a balance due, or that they have had collection actions taken against them for a year they did not earn any income or file a tax return.
• The IRS sends a taxpayer a notice indicating that the taxpayer received wages or other income from an employer for whom they didn’t work.
• The taxpayer was assigned an Employer Identification Number (EIN), but they did not request or apply for an EIN.

If any of the above conditions apply, the taxpayer should complete and submit a Form 14039 affidavit. See additional details about filing the affidavit below.

What is non-tax-related identity theft?

Non-tax-related identity theft occurs when someone uses stolen or lost personal identifiable information (PII) to open credit cards, obtain mortgages, buy a car, or open other accounts without their victim’s knowledge.

Potential evidence of non-tax-related identity theft can include:

• An individual receives balance due bills from companies they didn’t conduct business with, magazine subscriptions they didn’t order, notifications of a mortgage statement and/or credit cards for which they didn’t apply.
• An individual receives notices of unemployment benefits for which they didn’t apply.
• An individual receives a Notice CP 01E, Employment Identity Theft.
• An individual receives a Form W-2 or 1099 from a corporation or employer from whom they did not receive the income reported and they have not received a notice or letter from the IRS questioning them about that income.
• A taxpayer can’t e-file because a dependent’s Social Security number or ITIN was already used by someone who is known to the taxpayer but is not the parent or legal guardian, and the taxpayer did not provide permission for that person to claim the dependent. For additional information about this issue, see Publication 1819, Divorce and non-custodial, separated, or never married parents.

Victims of non-tax-related identity theft do not need to file Form 10439. Instead, they should be proactive and report these non-tax-related incidents to the correct authorities and take other measures:

• Get an Identity Protection PIN by visiting IRS.gov/getanippin. This is an important step to take to prevent them from becoming a victim of tax-related identity theft.
• Contact one of the 3 Credit Bureaus to report the incident: Equifax, Experian or Transunion.
• Contact the Social Security Administration.
• Contact the appropriate state unemployment office to have them issue a corrected Form 1099-G.
• Report the incident to their financial institution.
• Report the incident to local police – If the taxpayer knows the identity thief, or the thief used the taxpayer’s name during a traffic stop or any encounter with the police, the taxpayer should report the incident.
• Report the incident to the Federal Trade Commission. Do not complete a Form 14039 through that process.

Remember, there is no need to report a non-tax-related incident to the IRS.

Identity Protection PIN

An IP PIN is a six-digit number assigned to an individual to help prevent the misuse of their Social Security number or ITIN on federal income tax returns. The IP PIN protects the taxpayer’s account, even if they are no longer required to file a tax return, by rejecting any e-filed tax return filed without the taxpayer’s IP PIN. A new IP PIN is generated every year for added security. The taxpayer will need to enter their IP PIN when they file their return. Once an individual is enrolled in the IP PIN program, there is no way to opt-out.

Taxpayers should request an IP PIN:

• If they want to protect their SSN or ITIN with the IRS.
• If they want to protect their dependent’s SSN or ITIN with the IRS
• If they think their SSN, ITIN or other personal information was exposed through theft or fraudulent acts
• If they suspect or confirm they are a victim of identity theft

Taxpayers can go to IRS.gov/getanippin to complete a thorough authentication check. Once authentication is complete, an IP PIN will be provided online immediately.

Alternatively, taxpayers can submit Form 15227, Application for an IP PIN, to the IRS by mail or fax. An IRS employee will call the taxpayer to complete authentication. Once confirmed, the IRS will issue an IP PIN within four to six weeks. Or taxpayers can schedule an appointment at their local Taxpayer Assistance Center to authenticate their identity in person and, once confirmed, the IRS will issue an IP PIN via mail within four to six weeks.

Parents and legal guardians can also request an IP PIN for their dependents by completing and submitting Form 15227, Application for an IP PIN, using the dependent’s SSN or ITIN. The IRS may automatically assign an IP PIN if the IRS determines the taxpayer is a victim of tax-related identity theft. The taxpayer will receive a notification confirming the tax-related ID theft incident along with an assigned IP PIN for future tax-return filings.

Once issued, IP PINs must be used when filing or e-filing tax returns with the IRS, including any late-filed returns for prior years being filed in the current filing season.

IP PINs are good for 12 months and can be used for any return filed during that year. Taxpayers will either receive a notice with their new IP PIN every year by early January for the next filing season or the taxpayers must retrieve their IP PIN by going to IRS.gov/getanippin.

Filing Form 14039, Identity Theft Affidavit

Only taxpayers who believe they’re victims of tax-related identity theft – and who haven’t received one of the IRS letters outlined above – should complete Form 14039.

A fillable Form 14039 is available on IRS.gov. It can be completed online, printed and attached to a paper tax return for mailing to the IRS. Or taxpayers may complete the form online at the Federal Trade Commission and the FTC will electronically transfer the Form 14039 – but not the tax return – to the IRS.

The IRS will work to verify the legitimate taxpayer, clear the fraudulent return from the taxpayer’s account and generally, place a special marker on the account that will generate an IP PIN each year for the taxpayer who is a confirmed victim.

For information about tax-related identity theft, see Identity Protection: Prevention, Detection and Victim Assistance and IRS Identity Theft Victim Assistance: How It Works on IRS.gov. The Federal Trade Commission website also includes information about tax-related identity theft.

(This is Blog Post #1190)