Recovering from Tax-Related Identity Theft: Immediate Actions to Take

Immediate steps to take in the first 24–72 hours

If you suspect or discover tax-related identity theft, act quickly. Below is a prioritized checklist I use with clients to stop further damage and begin recovery.

1. Secure documentation right away

• Save any IRS notices, emails, rejected e-file receipts, or letters mentioning someone else filed using your Social Security number.
• Take screenshots of suspicious account activity, phishing emails, or alerts from your tax software.

1. Report the crime to the Federal Trade Commission (FTC)

• Go to IdentityTheft.gov and follow the guided steps to report tax-related identity theft. The site generates a recovery plan and an official Identity Theft Report you can use with the IRS and creditors. (FTC: https://www.identitytheft.gov)

1. Notify the IRS about identity theft

• If you receive IRS notices about multiple returns, unexpected refunds, or a rejected e-file stating a duplicate return, contact the IRS and submit Form 14039, Identity Theft Affidavit, if instructed. See the IRS Identity Theft Central for guidance and current procedures. (IRS: https://www.irs.gov/identity-theft-central and https://www.irs.gov/forms-pubs/about-form-14039)

1. File a police report

• Obtain a local police report documenting the identity theft. Many agencies accept the FTC Identity Theft Report as supporting documentation. In my practice, a police report helps speed interactions with creditors and sometimes the IRS when a local law enforcement number is required.

1. Place a fraud alert or credit freeze

• Contact the three nationwide credit bureaus—Experian, TransUnion, and Equifax—to place a fraud alert (at minimum) or a credit freeze (stronger control). A freeze prevents new credit from being opened in your name; a fraud alert warns creditors to take extra steps. For free annual reports see https://www.annualcreditreport.com.

1. Notify the tax preparer or platform you used

• If you used a tax preparer or online tax software, inform them immediately. They may have additional steps to protect your account and can flag suspicious activity.

1. Monitor tax transcripts and financial accounts

• Order your IRS tax transcript and review bank and credit-card accounts for unauthorized activity. In many cases, I advise clients to check transcripts quarterly until their account is cleared.

Detailed next steps and documentation checklist

Recovering from tax-related identity theft is documentation-heavy. The IRS and other agencies will want proof.

• Gather proof of identity and residency: government-issued photo ID, Social Security card, birth certificate, and a utility bill with your name and address.
• Collect tax records: copies of the tax return you filed (if any), W-2s, 1099s, and any correspondence from the IRS (letters, CP notices, rejection emails).
• Keep a record of all communications: dates, names, phone numbers, copies of letters you send or receive, and screenshots of online chats or forms.

Common documents you’ll likely need to share:

• FTC Identity Theft Report (from IdentityTheft.gov)
• Police report or complaint number
• Form 14039 (if IRS requests you file it)
• Proof of earnings (W-2/1099) to show that the fraudulent return did not match your wages

How to work with the IRS during recovery

• Use the IRS Identity Theft Central site for the most current steps. (IRS: https://www.irs.gov/identity-theft-central)
• If the IRS tells you to file Form 14039, follow the instructions on the form page. The IRS sometimes requests additional documentation or asks you to verify your identity by phone or mail. (About Form 14039: https://www.irs.gov/forms-pubs/about-form-14039)
• If you get an identity verification letter such as Letter 5071C or similar, follow the IRS instructions immediately—these letters give specific steps and deadlines. For practical guidance on responding quickly to IRS identity verification requests, see our guide: Responding to an IRS Identity Verification Request: Steps to Resolve Quickly.

Pro tip from my practice: when you first call the IRS about identity theft, ask for a claim or reference number and confirm the correct mailing address for any requested documents. Always send certified mail for important documents and keep tracking info.

Credit actions: freezes, alerts, and monitoring

• Credit freeze: free and the strongest immediate protection; it blocks new creditors from accessing your credit file without your permission. Place freezes with each bureau individually.
• Fraud alert: easier to set up quickly and lasts one year (longer options available if you can confirm identity theft with documentation).
• Ongoing monitoring: enroll in credit monitoring or identity-protection services if surveillance helps you act faster on suspicious activity.

Resources and instructions for freezes and alerts can be found on each bureau’s site and through IdentityTheft.gov.

Request an IRS Identity Protection PIN (IP PIN)

• If the thief used your SSN to file, enroll in the IRS Identity Protection PIN program to prevent future use. The IRS issues a six-digit IP PIN that must be entered on your federal tax return to verify your identity. Learn how to get an IP PIN on the IRS site: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin

Note: Not every taxpayer is immediately eligible for the IP PIN program without prior IRS interaction; follow the IRS guidance for enrollment.

If a fraudulent return was already filed

• If the IRS accepted a fraudulent return for your SSN before you filed, follow IRS instructions and submit required identity-theft paperwork. You may be asked to file a paper return with a clear explanation and supporting documents. See our in-depth steps for recovering a withheld refund here: Handling Identity Theft-Related Tax Returns: Steps to Recover Your Refund.

• If the refund has already been issued to the thief, the IRS and Treasury Department will work to recover it, but recovery can be slow—document everything and follow up regularly.

Communicating with employers and other agencies

• If the theft includes fraudulent employment or earnings statements (e.g., W-2s from unknown employers), notify the employer(s) and your state tax agency.
• If your state tax refund was affected, contact your state department of revenue; many states have identity-theft pages modeled on the IRS process.

Avoid scams during recovery

• You may receive fake IRS calls or phishing emails preying on victims. The IRS will not demand payment via gift cards, prepaid debit cards, or cryptocurrency; nor will it threaten immediate arrest. Verify any IRS contact by checking the official IRS site before responding. (IRS scams and phishing: https://www.irs.gov/newsroom/taxes-and-schemes)

• Do not provide additional personal information over email or text unless you initiated the request from the IRS or other verified agency website.

Timeline and expectations

• Initial verification and flagging may take weeks to months depending on complexity. Simple cases where only a duplicate return was filed can be cleared more quickly; complex identity-theft cases (multiple fraudulent returns, synthetic identity, cross-state fraud) can take several months.

• Keep following up every 30 days. In my work with clients, persistent, documented follow-up accelerates outcomes significantly—don’t assume silence means inactivity.

Practical scripts and sample language

• When calling the credit bureaus: “I am a victim of identity theft. I want to place a credit freeze and receive confirmation by mail. Please provide the freeze PIN or password and mailing address for documentation.”

• When contacting the IRS (if you have a notice): “I received [IRS notice number] and believe my Social Security number was used fraudulently to file a tax return. I’ve filed an FTC Identity Theft Report and a police report. How should I submit Form 14039 and supporting documents?”

Common mistakes to avoid

• Waiting to report: Delayed reporting allows thieves to cause more damage.
• Sharing excessive personal information: Don’t upload extra documents to unknown sites or respond to unsolicited emails claiming to be the IRS.
• Assuming credit monitoring alone is enough: it helps, but freezes and official reports are necessary for recovery paperwork.

Related resources on FinHelp

• For preventative steps and how thieves often target returns, read: Identity Theft and Tax Fraud: How to Protect Your Return.
• For step-by-step recovery when refunds are impacted, see: Handling Identity Theft-Related Tax Returns: Steps to Recover Your Refund.
• If you get an IRS verification letter, our guide explains common letter codes and how to respond: Responding to an IRS Identity Verification Request: Steps to Resolve Quickly.

Final professional tips and conclusion

From over a decade of working with taxpayers, the most effective approach is fast, documented action: report to IdentityTheft.gov, file police and IRS paperwork, freeze credit, and request an IP PIN if eligible. Keep copies of everything and maintain a single binder or secure digital folder with dates and correspondence. Recovery is often a process, but with consistent documentation and follow-up you can minimize delay and protect future returns.

Disclaimer: This article is educational and reflects current procedures from the IRS and FTC as of 2025. It is not legal or tax advice. For help tailored to your situation, consult a qualified tax professional, attorney, or your state tax agency.

Authoritative links cited:

• IRS Identity Theft Central: https://www.irs.gov/identity-theft-central
• About Form 14039 (Identity Theft Affidavit): https://www.irs.gov/forms-pubs/about-form-14039
• IdentityTheft.gov (FTC): https://www.identitytheft.gov
• AnnualCreditReport.com: https://www.annualcreditreport.com