# Tax Identity Theft: IP PINs and What to Do If It Happens

URL: https://elevatedtaxstrategies.com/irs-and-compliance/tax-identity-theft-ip-pin/
Markdown: https://elevatedtaxstrategies.com/irs-and-compliance/tax-identity-theft-ip-pin.md
Category: IRS + Compliance
Published: 2026-08-27
Author: Ramon Liriano Jr.

> An IP PIN blocks someone else filing under your SSN. Here's how to get one, why most victims should not file Form 14039, and the recovery steps in order.

## TLDR

An **IP PIN** is a six-digit number that stops anyone else filing a return under your SSN or ITIN. It is the single most effective protection available, it is **free**, and since the program opened up, **anyone** who can verify their identity can get one, even if you have never been a victim and even if you are not required to file. Get it through your IRS **online account**. It is **valid for one calendar year** and regenerates annually. If theft has already happened, work the steps in order, and note the part most articles get wrong: **most victims should NOT file Form 14039**. If the IRS has already written to you, follow the letter instead.

Nobody discovers tax identity theft at a convenient moment. It is almost always the same scene: you file, and the return bounces back rejected because a return has already been filed under your Social Security number.

At that point you are not filing a tax return anymore. You are opening a case.

The good news is that the thing that prevents this entirely is free, takes about fifteen minutes, and most people still have not done it.

## The IP PIN, and why it is the whole ballgame

An **Identity Protection PIN** is a six-digit number known only to you and the IRS. Correct IP PINs must be entered on electronic **and** paper returns. A missing or wrong one gets an e-filed return rejected, and delays a paper return until it can be verified.

Read that from the thief's side. Without your IP PIN, they cannot successfully file under your number. The mechanism that makes it annoying for you is exactly what makes it impossible for them.

> **Tip: You no longer have to be a victim to get one**
>
> The program used to be limited to confirmed identity theft victims. It is now open to **anyone with an SSN or ITIN who can verify their identity**, explicitly as a proactive step, **even if you are not required to file a tax return**. Parents and legal guardians can request one for dependents too, which matters because children are targeted precisely because nobody is monitoring their credit.

## How to get one

**The fast way: your IRS online account.** Request it in the IP PIN section of your profile page. If you do not have an account on IRS.gov, register and validate your identity first. This is same-day.

**If you cannot create an online account**, there are two fallbacks, both slower:

- **Form 15227**, available if your AGI on your last filed return was **below $84,000** (individuals) or **$168,000** (married filing jointly), and you have access to a telephone. The IRS calls the number on the form to validate your identity, then mails the IP PIN, usually in **four to six weeks**, and annually thereafter.
- **In person at a Taxpayer Assistance Center**, if you cannot verify online or are ineligible for Form 15227. Bring one federal or state issued photo ID plus one additional form of identification. For a dependent, bring two forms of identification for them, such as a birth certificate and Social Security card. IP PIN arrives by mail, usually within **three weeks**.

Note: if you or your dependent are **under age 18**, you must use one of the alternative enrollment options rather than the online request.

## The four things people get wrong about IP PINs

**It changes every year.** An IP PIN is valid for **one calendar year** and a new one is generated annually. Last year's number will not work.

**How you get the new one depends on how you enrolled.** If the IRS enrolled you because you were a confirmed victim, they mail a **CP01A Notice** with your new IP PIN each year. But if you **opted in online**, no CP01A is mailed. You have to retrieve it from your online account yourself, each year. This is where most self-inflicted problems come from: people wait for a letter that was never coming.

**It is generally viewable in your online account from mid-January to mid-November.** Plan around that window if you file an extension.

**It applies to prior year returns too.** An IP PIN must be used on any federal return you file during the year, including back-year filings. Relevant if you are [catching up on unfiled years](https://elevatedtaxstrategies.com/irs-and-compliance/catch-up-filing-strategy/).

> **Heads up: The IRS will never ask you for your IP PIN**
>
> Give it only to your tax professional, and only when you are ready to sign and submit. Any phone call, email or text asking for your IP PIN is a scam. The number exists to prove you are you, so handing it out defeats it entirely.

## If it has already happened

Work these in order. The order matters, because two of these steps cancel each other out.

1. **Stop interacting with the thief.** Hang up. Send nothing. Do not click links or open attachments. If you already did, run antivirus software.
2. **Change your IRS online account password** to something complex and unique.
3. **Follow the instructions in any IRS letter or notice you received.** This takes precedence over everything below.
4. **Report it** at IdentityTheft.gov and follow the recovery steps there.
5. **Get an IP PIN** to protect the account going forward.
6. **Keep records** of every letter, call and email.
7. **Keep filing and paying as usual.** This is the step people skip while waiting for resolution, and it creates a second, entirely separate problem on top of the first.
8. **Check with your state tax agency**, which runs its own process.

## The Form 14039 trap

This is where most advice goes wrong, so it is worth being precise.

**Should you file Form 14039, Identity Theft Affidavit?**

|  | Do NOT file it if... | DO file it if... |
| --- | --- | --- |
| IRS contact | They already sent you a letter or notice | They tell you to file it |
| Verification service | You were told to use the Identity and Tax Return Verification Service | You cannot use that service |
| Already reported | You filed it already, or via IdentityTheft.gov | The IRS has no record of it yet |
| Type of theft | It is not tax-related | A data breach exposed your information |
| Entity | You are a business, trust or estate (use 14039-B) | You are an individual |

The IRS is direct about this: **most people do not need to file this form.** If they have already written to you, they already know, and filing an affidavit on top of an open case adds processing time rather than removing it.

The specific trap: if a notice directs you to the **Identity and Tax Return Verification Service**, use it and **do not** file Form 14039. Doing both is slower than doing the right one.

## Warning signs worth knowing

Most of these show up months before you would otherwise notice:

- A **rejected e-filed return** when you know you have not filed
- A **W-2 or 1099 from an employer you never worked for**
- A **1099-G for unemployment benefits** you never applied for or received
- An **EIN you did not apply for**
- A **CP2000 notice** about income you do not recognize
- **Account activity you did not initiate**, or password reset alerts you did not request
- Your **Social Security record showing wages you did not earn**

If you want to check the last one directly, you can [pull your IRS wage and income transcript](https://elevatedtaxstrategies.com/irs-and-compliance/irs-wage-income-transcript-how-to-pull/) and compare it against what you actually earned. That single document surfaces employment identity theft faster than almost anything else.

> **Note: If a W-2 or 1099 arrives from an employer you never worked for**
>
> Do not put that income on your return, and do not amend a return you already filed to include it. Contact the Social Security Administration. Employment identity theft affects your Social Security benefits and work history, not just your tax bill, so it needs fixing in both places.

## What this costs you if you ignore it

A stolen refund is the visible loss and usually the smallest one. The real costs are time and delay: a fraudulent return in the system ahead of yours means your legitimate return is processed manually, refunds take months rather than weeks, and every subsequent year gets extra scrutiny until the account is cleaned up.

Set against that, fifteen minutes in your IRS online account to enroll in a free program is not a close call.

## What to actually do this week

1. **Create or log into your IRS online account** if you have not.
2. **Request an IP PIN**, and one for each dependent.
3. **Put a calendar reminder for mid-January** to retrieve next year's number, because if you opted in online, nobody is mailing it to you.
4. **Store it somewhere you will find it** at filing time, and give it to your preparer only at signing.

If you are already dealing with a rejected return or an IRS notice you do not understand, that is worth a conversation rather than a search result. Bring the notice itself, since which letter it is determines which of the paths above you are on, and picking the wrong one adds months.