Impact of Identity Theft on Tax Filing and How to Protect Yourself

Your e-file bounced back. The reason: a return was already filed under your Social Security number. That is tax identity theft, and the IRS’s own watchdog reported in June 2026 that victims wait about 20 months for their cases to close. Here is how to protect your tax account and what to do if someone filed first.

---

What Is Tax Identity Theft?

Tax identity theft happens when someone uses your Social Security number to file a federal tax return and collect a refund. The thief invents the wages and withholding, then routes the money to an account they control.

In our experience, the fake return usually lands early in the season. You find out when you try to file.

It is not always about refunds. The IRS also deals with a few related forms of the same crime:

• Refund fraud: A return filed with your SSN to claim a refund you never see.
• Employment-related identity theft: Someone works under your SSN. Their employer reports those wages to the IRS, and you get a notice about income you never earned.
• Business identity theft: A company’s Employer Identification Number (EIN) is used to file fake business returns or issue bogus W-2s and 1099s.

One of these is enough. Don’t wait for a second sign.

---

Why Tax Identity Theft Cases Now Take Nearly Two Years

Once the IRS suspects a fraudulent return on your account, your refund stops. It stays stopped until the case is resolved.

That wait has grown. In her June 2026 mid-year report to Congress, National Taxpayer Advocate Erin Collins said identity theft victim assistance cases were taking about 20 months to resolve, with more than half a million cases pending at the end of the filing season. She has flagged these delays as unacceptable for three straight years.

About 20 months: the average time to resolve an IRS identity theft victim assistance case, according to the National Taxpayer Advocate’s June 2026 report to Congress.

Reaching someone by phone is its own problem. Reporting on the same report found the Taxpayer Protection Program line, the number victims call to verify their identity, answered only about one in five calls during the 2026 filing season. The IRS entered that season with roughly 27% fewer employees than a year earlier.

Here is what the wait looks like in practice:

• Your refund is frozen: Money you may have counted on for rent, bills, or debt sits with the IRS, including refundable credits like the Earned Income Tax Credit.
• Notices keep arriving: If someone worked under your SSN, you may get an underreported income notice that still needs a response by its deadline.
• Filing gets harder that year: A rejected e-file usually means mailing a paper return, which adds processing time.
• The damage can spread: A stolen SSN used on a tax return can also be used to open credit in your name.

---

How to Protect Yourself From Tax Identity Theft Before You File

The strongest single step is an Identity Protection PIN, or IP PIN. It is a free six-digit number known only to you and the IRS. A Form 1040-series return filed with your SSN but without your current IP PIN is rejected if e-filed and held for verification if mailed.

You no longer need to be a victim to get one. Anyone with an SSN or Individual Taxpayer Identification Number (ITIN) who can verify their identity may enroll, and parents can request one for a dependent.

Three Ways to Get an IP PIN

Method	Who Can Use It	When You Get the PIN
IRS Online Account	Adults 18 and over who can pass the IRS online identity check	Immediately, on the Profile tab
Form 15227	Adjusted gross income on your last filed return below $84,000, or $168,000 if married filing jointly, plus access to a phone	By mail, usually 4 to 6 weeks after the IRS verifies you by phone
Taxpayer Assistance Center visit	Anyone who can’t verify online or qualify for Form 15227. Book at 844-545-5640 and bring two forms of ID.	By mail, usually within 3 weeks

Fall is a good time to set this up. You avoid the January rush and the PIN is ready before your W-2s arrive.

Other Steps That Close the Gaps

• Open an IRS Online Account: You can see your filed returns, transcripts, and notices, which is often the fastest way to spot a return you didn’t file.
• Treat unexpected “IRS” texts and emails as suspect: The IRS does not start contact by email, text, or social media to ask for personal or financial information. Real contact usually begins with a mailed letter.
• Freeze your credit: Freezes at Equifax, Experian, and TransUnion are free and stop new accounts from being opened in your name.
• Guard your paperwork: Keep W-2s, 1099s, and old returns locked up, and shred what you no longer need.
• Vet your preparer: Use someone with a valid Preparer Tax Identification Number who sends documents through a secure portal, not plain email attachments.

---

What to Do If Someone Already Filed a Tax Return in Your Name

The right response depends on how you found out. Sending the IRS paperwork it didn’t ask for can actually slow your case down.

If Your E-File Was Rejected as a Duplicate

File your return on paper and attach Form 14039, the Identity Theft Affidavit. You can also submit Form 14039 online through IRS.gov, or through IdentityTheft.gov, which sends it to the IRS for you. File it once per incident. A second affidavit for the same problem does not help.

Keep filing and paying on time. Identity theft does not pause your own obligations.

If You Received Letter 5071C, 4883C, or 5747C

These letters mean the IRS caught a suspicious return before processing it. Do not file Form 14039. Follow the letter instead:

• Letter 5071C: Verify online at idverify.irs.gov or call the number on the letter.
• Letter 4883C: Call the number on the letter to confirm your identity.
• Letter 5747C: Make an appointment to verify in person at a Taxpayer Assistance Center.

Not sure the letter is real? Compare it to the IRS.gov page for that letter number before you call anyone.

If a Notice Shows Wages You Never Earned

This points to employment-related identity theft. Respond to the notice by its deadline and explain that the wages are not yours. It also makes sense to check your earnings record in your my Social Security account, since the same employer is reporting those wages under your number.

Steps Every Victim Should Take

• Report it at IdentityTheft.gov: The FTC builds a recovery plan and can generate Form 14039 for you.
• Freeze your credit at all three bureaus if you haven’t already.
• Request the fake return: Form 4506-F lets you get a copy of the fraudulent return filed with your SSN.
• Keep a paper trail: Save every letter, write down dates, and note who you spoke with at the IRS.
• Call the Taxpayer Advocate Service at 877-777-4778 if the delay is causing financial hardship, such as trouble paying rent or utilities.
• Watch your mailbox for an IP PIN: The IRS automatically enrolls confirmed victims, and you’ll need that PIN on every future return.

A licensed representative can also deal with the IRS for you. With a signed Form 2848, power of attorney, an Enrolled Agent, CPA, or tax attorney can call on your behalf, respond to letters, and track the case. That won’t shorten the IRS’s queue. It can keep your case from stalling on a missed letter or an unanswered phone line.

The team at Badran Tax helps individuals and businesses respond to IRS identity verification letters and related notices across all 50 states. If you’re unsure which letter you received or what the IRS needs from you, a free consultation can clarify where you stand before you send anything.

---

Business Owners: Protecting Your EIN and Payroll Data

Businesses get hit too, just differently. A thief can file a business return under your EIN, request a new EIN in your company’s name, or issue fake W-2s to create refund claims.

Watch for a rejected e-file because your EIN was already used, IRS letters about returns or employees you don’t recognize, or a notice about a filing requirement you never had. If any of those show up, the form is Form 14039-B, the Business Identity Theft Affidavit. Individual and business cases go to different IRS units, so use the right one.

Payroll is the soft spot. A common scheme is an email that appears to come from an owner or executive asking payroll staff to send over every employee’s W-2. One reply can expose your whole workforce.

• Confirm by phone: Any request for W-2s or payroll data gets verified with a call to a known number.
• Limit access: Only the people who run payroll should be able to pull employee SSNs.
• Use multifactor login: Payroll software, bank accounts, and tax software should all require it.

If your company’s payroll or 941 filings are already tangled up with a fraud problem, tax problem resolution support may help sort out what the IRS has on file versus what your business actually owes.

---

Frequently Asked Questions

What is tax identity theft?

Tax identity theft is when someone uses your Social Security number to file a tax return and claim a refund, or uses it to work so wages get reported under your name. Businesses can also be targeted through their EIN.

How do I know if someone filed a tax return with my Social Security number?

The most common sign is an e-file rejection saying a return with your SSN was already filed. Other signs include an IRS letter asking you to verify a return you didn’t file, or a notice listing wages from an employer you don’t know.

Should I file Form 14039 if I received Letter 5071C?

No. Letters 5071C, 4883C, and 5747C mean the IRS already flagged the return. Follow the verification steps in the letter instead of filing an affidavit.

How long does the IRS take to resolve an identity theft case?

According to the National Taxpayer Advocate’s June 2026 report, identity theft victim assistance cases were averaging about 20 months. Individual cases can be faster or slower depending on the facts.

Can I get an IP PIN if I have never been a victim?

Yes. Anyone with an SSN or ITIN who can verify their identity can enroll, and parents can request one for dependents. The fastest route is your IRS Online Account.

Do I need a new IP PIN every year?

Yes. The IRS generates a new PIN each calendar year. Continuous enrollees get a new one automatically, while one-time enrollees are removed from the program at year-end.

Can I still e-file after tax identity theft?

For the year your return was rejected as a duplicate, you’ll generally file on paper with Form 14039. Once the IRS assigns you an IP PIN, you can e-file future returns using it.

Will the IRS contact me by email or text about identity theft?

The IRS does not start contact by email, text, or social media to ask for personal or financial information. Legitimate identity theft contact usually begins with a mailed letter.

Can a tax professional handle my identity theft case?

Yes. With a signed Form 2848, an Enrolled Agent, CPA, or tax attorney can represent you before the IRS, respond to letters, and follow up on your case.

Does tax identity theft affect my state tax return?

It can. State returns are processed separately, so contact your state tax agency as well, since many states run their own identity verification process.

---

Bottom Line

Tax identity theft is cheaper to prevent than to fix. An IP PIN takes minutes to set up online. A stolen return, by the IRS’s own watchdog’s count, is now taking close to two years to untangle.

If it has already happened, move quickly and match your response to the letter or rejection you received. Filing the wrong form, or waiting weeks to answer, only adds time to a clock that is already long.

If you’re dealing with a frozen refund or an IRS identity verification letter, Amro Badran, EA, Managing Partner of Badran Tax, and the firm’s licensed tax professionals are available to help. With over 40 years of experience resolving IRS and state tax problems, and a team that includes Enrolled Agents, CPAs, Tax Attorneys, and Former IRS Agents, Badran Tax works with taxpayers in all 50 states to identify options and pursue resolution.

---

Sources & Helpful Resources

• IRS: Identity Theft Central
• IRS: Identity Theft Guide for Individuals
• IRS: Get an Identity Protection PIN
• IRS: IP PIN Frequently Asked Questions
• IRS: When to File an Identity Theft Affidavit
• IRS: National Taxpayer Advocate Issues 2026 Mid-Year Report to Congress
• Taxpayer Advocate Service
• FTC: IdentityTheft.gov

 

 

---