How tax identity theft typically works

Tax identity theft starts when a scammer gets access to personally identifiable information (PII) — most commonly a Social Security number (SSN), name, and date of birth. Criminals obtain PII through data breaches, phishing emails and texts, stolen mail, or buying records on the dark web. Once they have an SSN, they can often file a federal tax return electronically and claim a refund before the real taxpayer files.

In my practice advising clients, I’ve seen two common patterns: (1) a fraudster files an early return to intercept the refund, and (2) a fraudster uses the stolen SSN to set up accounts or benefits that trigger IRS notices to the legitimate taxpayer months later. Either way, the victim usually only discovers the problem when the IRS flags a duplicate return, rejects an e-file because a return was already filed, or contacts the taxpayer for verification.

Authoritative resources: IRS Identity Theft Central (https://www.irs.gov/identity-theft-central), FTC’s identitytheft.gov (https://www.identitytheft.gov), and the CFPB recovery guide (https://www.consumerfinance.gov/about-us/blog/how-to-recover-from-identity-theft/).

Common signs you may be a victim

  • You receive an IRS notice that a duplicate return was filed or that income you didn’t earn was reported.
  • Your e-file is rejected because the SSN already has a return on file.
  • You get an unexpected IRS refund, balance due, or collection notice.
  • You find unfamiliar income on your IRS transcript (get your transcript via IRS.gov).
  • You notice new accounts or hard inquiries on your credit reports you didn’t authorize.

If you spot any of these, treat it promptly—early action reduces the risk of credit damage and speeds IRS resolution.

First actions to take right away

  1. Save all IRS letters and notices. Do not destroy any mail from the IRS; it will be needed for the resolution process.
  2. If an e-file was rejected for a duplicate return, do not repeatedly re-file electronically — instead follow the IRS instructions or file a paper return as directed.
  3. File Form 14039, Identity Theft Affidavit, with the IRS if you confirm tax-related identity theft. Use the IRS instructions and send any supporting documents the IRS requests (see https://www.irs.gov/identity-theft-protection).
  4. Create or review your account with the IRS at IRS.gov and check your account transcript for unauthorized filings.

Practical note from my experience: when a client received a duplicate-return notice, the fastest path to case opening was filing Form 14039, attaching a copy of the IRS notice, and calling the IRS Identity Protection Specialized Unit if additional guidance was needed.

Tax-specific recovery steps (IRS-focused)

  • File Form 14039 (Identity Theft Affidavit) if the IRS tells you someone filed using your SSN or if you suspect identity theft tied to taxes. This initiates the IRS identity-theft case file.
  • Apply for an Identity Protection PIN (IP PIN) from the IRS. An IP PIN is a six-digit number the IRS issues to verified individuals to block fraudulent e-files using their SSN. You can apply or learn more on the IRS site about the IP PIN program (Get an Identity Protection PIN).
  • Respond promptly to any IRS identity verification requests. The IRS may send a letter asking you to verify your identity; follow the instructions and provide requested documents.
  • If the IRS has already issued a refund to a thief, keep documentation of all communication; you may need to coordinate additional steps through the IRS caseworker assigned to your identity-theft file.

Caveat: some situations require a paper return and extra documentation; avoid repeated e-filing attempts that can slow the case.

Credit and non-tax recovery steps

  • Place a fraud alert with one of the three major credit bureaus (Equifax, Experian, TransUnion). A fraud alert is free and lasts one year for most alerts; it prompts lenders to verify your identity before approving credit.
  • Consider a credit freeze if you want to block new credit entirely. A freeze prevents new lenders from accessing your credit report; it’s free and can be lifted temporarily when you need to apply for credit.
  • Get free copies of your credit reports at AnnualCreditReport.com and carefully review them for unknown accounts or inquiries.
  • File a report at FTC’s IdentityTheft.gov — you’ll get a recovery plan and an identity-theft report you can use with companies and law enforcement (https://www.identitytheft.gov).
  • File a local police report if recommended; some creditors and agencies request a police report when investigating identity theft.

Documentation: build a recovery packet

Maintain a dedicated folder (paper and digital) with: copies of IRS notices, Form 14039 copies and proof of mailing, your FTC identity-theft report, police reports (if any), correspondence with credit bureaus, and notes of phone calls (date, time, name, summary). That packet simplifies disputes with the IRS, banks, or credit bureaus and serves as evidence if you need to escalate.

Prevention and hardening your identity

  • File early. Filing your taxes as soon as you have W-2s and 1099s makes it harder for thieves to beat you to the refund.
  • Use strong, unique passwords and enable two-factor authentication (2FA) on financial and tax-preparation accounts.
  • Keep tax records and mailed forms in a locked safe; shred documents with SSNs before disposal.
  • Use reputable tax software and be cautious with email and text links. Phishing remains one of the most common ways criminals harvest data.
  • Monitor your IRS account and sign up for IP PIN if you are eligible or have been a victim; an IP PIN is a proven, effective preventive control.

From practice: I encourage clients who travel frequently or use public Wi-Fi to avoid accessing tax or bank websites on public networks unless they use a personal VPN. It’s a simple habit that prevents credential theft.

Timeline: what to expect for IRS resolution

Resolving tax identity theft can take weeks to many months. After you file Form 14039, the IRS will open a case and may take time to research the fraudulent filing, confirm your identity, and correct your account. If a refund is involved, the IRS may delay processing while it investigates. Expect follow-up letters and be prepared to provide documentation.

If you need to file a timely return and the IRS has already processed a fraudulent return under your SSN, the IRS may ask you to file a paper return with supporting identity documents; follow IRS instructions carefully and include form 14039 where instructed.

When to hire a professional

Consider a tax attorney, enrolled agent, or CPA when:

  • The IRS pursues collection for taxes you did not owe, and the case is not resolving.
  • Identity theft coincides with complex tax issues (e.g., business returns, multiple-year fraud).
  • You’re unsure how to verify identity to the IRS or handle litigation risk.

In my practice, hiring an enrolled agent helped a client close a lingering identity-theft case faster because the agent maintained consistent contact with the IRS Identity Protection unit and provided structured documentation.

Related FinHelp.io resources:

Final checklist (quick-action items)

  • Preserve IRS notice(s) and any suspect communications.
  • File Form 14039 if tax-related identity theft is suspected.
  • Order credit reports, place a fraud alert or freeze if needed.
  • File a report with IdentityTheft.gov and consider a police report.
  • Apply for an IRS IP PIN to block future fraudulent e-files.
  • Keep a detailed record of all steps and communications.

Disclaimer

This article is educational and does not replace personalized legal, tax, or financial advice. If you are facing ongoing identity-theft problems or complex tax exposure, consult a qualified tax professional, attorney, or the IRS Identity Protection Specialized Unit for direct assistance.