🎯 In 30 seconds: A thief with your SSN can file a fake return early and collect a refund before you file. The IRS Identity Protection PIN (IP PIN) is a six-digit code that changes every year; with it on your account, a return without the right PIN is rejected. Anyone with an SSN or ITIN can get one. If it already happened, expect a long fix, so start the paperwork right away.
How tax identity theft happens
- Refund fraud: someone files a return in your name with made-up wages and withholding, and has the refund sent to their account.
- Employment fraud: someone works under your SSN. You find out when the IRS sends a notice about income you never earned.
- Dependent fraud: someone claims your child, so your own return is rejected when you claim them.
- Fake preparers and phishing: scammers pose as the IRS or a tax pro to collect your details or your IP PIN.
The signs
- Your e-filed return is rejected because a return with your SSN was already filed.
- An IRS letter asks you to verify your identity for a return you didn’t file.
- You get a Form W-2 or 1099 from an employer you never worked for, or a notice about unreported income.
- Your IRS online account shows a return, transcript or refund you don’t recognize.
The IRS normally makes first contact by mail. If a letter looks odd, check it through your IRS online account rather than any phone number in the letter (more on spotting fakes on Real or fake official).
Getting an IP PIN in 2026
| Route | Who it suits | How long |
|---|---|---|
| IRS online account | Anyone who can verify identity online. Request it in the IP PIN section of your profile. | Immediately |
| Form 15227 | People who can’t verify online, with adjusted gross income on the last return below $84,000 (single) or $168,000 (married filing jointly), per the IRS page in October 2026. The IRS calls you to verify. | PIN by mail, usually 4–6 weeks |
| In person at a Taxpayer Assistance Center | Anyone who can’t use the other two. Book an appointment; bring a photo ID plus one more ID. | PIN by mail, usually about 3 weeks |
Parents and guardians can get IP PINs for dependents too, but dependents under 18 can’t use the online route; use Form 15227 or an in-person visit.
Living with an IP PIN
- It changes every year. Each PIN is good for one calendar year.
- If you signed up online, nothing comes in the mail. Log in each filing season to see the new PIN; the IRS says it is generally viewable from mid-January to mid-November.
- Confirmed victims get the new PIN mailed each year on a CP01A notice.
- Share it only when filing. Type it into your tax software, or give it to your preparer when you are ready to sign. The IRS will never call, text or email to ask for it.
- Lost it? Look it up in your online account. Don’t file Form 15227 again just to get a new one.
A worked example: Priya’s rejected return
Priya, 29, expects a $1,840 refund. On February 10 her software says her return was rejected: a return with her SSN was already filed. A thief claimed $6,200 in her name a week earlier.
| Day 1 | Checks her IRS online account: sees a return she didn’t file. Changes her IRS password. |
| Day 1 | Freezes her credit at all three bureaus and files at IdentityTheft.gov. |
| Day 2 | Follows the IRS identity theft guide: prints her return and files it on paper, with Form 14039 (Identity Theft Affidavit) as the guide directs. |
| Next season | Gets an IP PIN online so no one can file as her again. |
| The wait | The Taxpayer Advocate reported in August 2026 that identity theft cases were taking about 611 days to resolve, which is roughly 20 months. |
Her $1,840 is not lost, only delayed. She keeps copies of everything and contacts the Taxpayer Advocate Service if the wait causes real hardship. See How US income tax works for the return itself.
If it already happened
- If the IRS sent a letter, follow it exactly. Letters that point you to the Identity and Tax Return Verification Service mean you verify there, and you don’t need Form 14039.
- If no letter came and you found the theft yourself (rejected e-file, strange W-2), the IRS guide says Form 14039 is the way to report it.
- Keep filing and paying on time, even on paper.
- Get an IP PIN, freeze your credit, and file at IdentityTheft.gov.
- Check with your state tax agency; many have their own steps.
- How long is an IP PIN valid? Answer: One calendar year; a new one is issued each year.
- You opted in online. Will the IRS mail you next year’s PIN? Answer: No. You retrieve it from your online account.
- Your income is $70,000, single, and you can’t verify online. Which route fits? Answer: Form 15227, since income is below $84,000; or an in-person appointment.
- Roughly how long were identity theft cases taking in 2026? Answer: About 611 days, around 20 months, per the Taxpayer Advocate.