Why acting in the first 24 hours matters

Tax identity fraud spreads damage quickly: a thief who files a phony return can lock you out of a refund, trigger IRS notices, and open accounts in your name. Rapid action stops further account misuse, preserves evidence, and speeds official recovery steps with the IRS, FTC, and credit bureaus. The IRS and FTC prioritize identity‑theft reports and can issue protective measures like an Identity Protection PIN (IP PIN) or special processing for your tax account (IRS) [https://www.irs.gov/identity-theft-central].

Step‑by‑step 24‑hour checklist (prioritized)

Follow this ordered list. Treat the phone calls and online reports as the highest priority because they initiate official records you will need later.

  1. Secure your digital access (within minutes to hours)
  • Immediately change passwords on your primary email, tax‑preparer portal, bank and brokerage accounts, and any online accounts that store financial data. Use unique, strong passwords and a password manager.
  • Turn on two‑factor authentication (2FA) for email and financial accounts. If 2FA is already enabled, check recent devices and sign‑out unfamiliar sessions.
  • If you suspect malware or account compromise, disconnect the device from Wi‑Fi and run a trusted antivirus scan; consider accessing accounts from a different, clean device.
  1. Call the IRS Identity Protection Specialized Unit (within 24 hours)
  • Phone: 1‑800‑908‑4490 (IRS Identity Protection Specialized Unit). Report that you suspect tax identity theft and request guidance for your tax account. Ask whether an Identity Protection PIN (IP PIN) or Identity Theft Indicator is appropriate. (IRS: Taxpayer Guide to Identity Theft) [https://www.irs.gov/newsroom/taxpayer-guide-to-identity-theft]
  • If you have already received an IRS letter, reference the notice number and read the notice before calling. Keep the call log: date, time, agent name, and reference number.
  1. Report the theft to the FTC and create a recovery plan (within 24 hours)
  • Go to IdentityTheft.gov and file a report. The FTC generates a personalized recovery plan and an Identity Theft Report that is legal proof of the crime. Use this report when contacting creditors and the IRS. (FTC: IdentityTheft.gov) [https://www.identitytheft.gov]
  1. Place a fraud alert or credit freeze (same day)
  1. Collect and secure documentation (same day)
  • Assemble: government photo ID, Social Security card, recent IRS notices, bank statements showing suspicious activity, and any emails or screenshots indicating fraudulent use.
  • If a tax return was filed by the fraudster, request a copy of the return from the IRS and make copies for your records.
  1. File IRS Form 14039 if instructed (within 24 hours after IRS direction)
  • Form 14039, Identity Theft Affidavit, is used when the IRS tells you to submit one or if your e‑file is rejected because your SSN was already used. Complete and submit only if the IRS instructs you to do so. (IRS Form 14039) [https://www.irs.gov/forms-pubs/about-form-14039]
  1. Notify your tax preparer and state tax agency (within 24 hours)
  • Tell your tax preparer or CPA about the suspected fraud so they can hold filings and watch for suspicious filings. Notify your state revenue department because tax identity theft can occur at the state level as well.
  1. Monitor accounts and mail (ongoing from day one)
  • Check bank and credit card accounts for unauthorized transactions and dispute charges immediately. Sign up for monitoring alerts where available.
  • Watch your mail for IRS or state tax notices. If you receive an unexpected refund check, do not cash it — contact the issuing agency.
  1. Document every step (ongoing)
  • Keep a detailed log: who you contacted, dates, times, phone numbers, and reference numbers. Save copies of letters, screenshots of online reports, and any mailed correspondence.

What to say when you call (scripts you can use)

Keep your comments factual and concise. Here are short scripts:

  • To the IRS IP Unit: “Hello, my name is [Full Name]. I suspect someone filed a tax return using my Social Security number. I have not filed my return for tax year [YEAR]. I want to report tax identity theft and confirm next steps, including whether I should submit Form 14039 or request an IP PIN.”

  • To the FTC (IdentityTheft.gov is the preferred starting point): Use the online form to create a recovery plan and obtain the Identity Theft Report you can show lenders and the IRS.

  • To a credit bureau: “I am a victim of identity theft. Please place a fraud alert / freeze on my credit file. My FTC Identity Theft Report number is [ID].”

Documents to gather and keep in your file

  • Government ID (driver’s license, passport)
  • Social Security card or SSA correspondence
  • Any IRS notices (CP, CP2000, etc.) and the date received
  • Bank and credit card statements showing suspicious activity
  • Email screenshots, phishing messages, or suspicious login alerts
  • FTC Identity Theft Report and proof of filing
  • Logs of phone calls (agent names, ID numbers, reference numbers)

What the IRS and agencies may do next

  • The IRS may place an Identity Theft Indicator on your tax account and ask you to verify identity or file Form 14039. The agency can also issue an IP PIN to protect future returns. (IRS IP PIN program) [https://www.irs.gov/identity-theft-central/get-an-identity-protection-pin]
  • The FTC provides a recovery plan and identity‑theft affidavit you can use with creditors. (IdentityTheft.gov) [https://www.identitytheft.gov]
  • Credit bureaus will note alerts or freezes and provide instructions to lift a freeze when you apply for credit.

Common mistakes to avoid in the first 24 hours

  • Waiting to report to the IRS or FTC. Early official reports make later disputes and identity restoration much easier.
  • Ignoring mail from the IRS. Even suspicious letters are worth verifying with the IRS because they may contain important instructions.
  • Over‑sharing on phone calls or social media. Only provide full details to verified government agencies and your financial institutions.

Where to learn more and next steps

For more detailed guidance on restoring credit reports after identity theft, see our guide on “Identity Theft on Credit Reports: Detecting and Fixing Fraud” and for tax‑specific prevention and recovery steps, read “Protecting Yourself from Tax‑Related Identity Theft: Prevention and Recovery.” These pages include deeper steps and templates you can use.

Final practical tips from experience

  • File your tax return early. Fraudsters often file bogus returns early in the tax season; filing first reduces the chance they will beat you to it.
  • Use an IP PIN if eligible — it is one of the most effective ways to stop a thief from filing a federal return in your name.
  • Keep an organized, dated folder of all communications. In my practice, the clients who kept meticulous logs resolved issues faster and with fewer appeals.

Professional disclaimer

This checklist is educational and not a substitute for personalized legal, tax, or financial advice. If your situation is complex or you’ve lost significant funds, consult a qualified tax professional, identity‑theft attorney, or your financial institution for tailored help.

Authoritative sources referenced