IRS Identity Theft and the IP PIN: How to Protect Your Tax Return

The short answer

Tax-related identity theft happens when someone uses your Social Security number or ITIN to file a fake return and claim a refund, or to claim your dependents. The IRS Identity Protection PIN (IP PIN) is a six-digit number, known only to you and the IRS, that must be on any federal return filed with your SSN or ITIN — so a thief without it cannot file in your name. Anyone with an SSN or ITIN who can verify their identity can get one, even if not required to file. It protects your tax return, not every account you have.

Warning signs

The IRS lists signs such as:

• your e-filed return is rejected because a return with your SSN was already filed;
• a Form W-2 or 1099 from an employer you did not work for, or a Form 1099-G for unemployment benefits you did not apply for;
• an EIN you did not request, or an unreported-income notice such as a CP2000 for income that is not yours;
• IRS online account activity, password resets, or log-in alerts you did not start; and
• a Social Security record showing wages you did not earn.

These do not always mean identity theft, but act on them.

How to get an IP PIN

When enrolling online you can choose continuous enrollment (this year and future years) or one-time enrollment (this calendar year only). If IRS records show you were a victim of tax-related identity theft, the IRS enrolls you automatically.

Dependents and children

• A dependent 18 or older can request an IP PIN through their own online account.
• For a dependent under 18, or one who cannot verify online, you can use Form 15227 or make an in-person appointment; in person, bring your own ID and two documents for the dependent, such as a birth certificate, Social Security card, or passport.
• On an e-filed return, enter each dependent's IP PIN on Form 1040, Form 2441, and Schedule EIC where required; on a paper return, you do not enter dependents' IP PINs.
• If someone already claimed your dependent, the IRS says it now accepts e-filed returns with a duplicate dependent if the primary taxpayer includes a valid IP PIN.

Filing with an IP PIN

• Where it is used: only on federal Forms 1040, 1040-NR, 1040-PR, 1040-SR, 1040-SS, and 1040-X — including prior-year and amended returns filed during that calendar year. Not on Form 4868 or a state return.
• Joint returns: each spouse who has an IP PIN enters their own.
• Wrong or missing IP PIN: an e-filed return is rejected until you enter the correct one; a paper return takes longer to process.
• Rejected because an IP PIN is required: check the reject code to see whose IP PIN is needed, retrieve it, and resubmit.
• No faster refund: the IRS says returns with an IP PIN go through the same checks as other returns.

If you got an IRS letter about your identity

• Verify it is really from the IRS and follow its instructions. If the letter tells you to, use the IRS Identity and Tax Return Verification Service.
• Do not file Form 14039 if you use that service, if the IRS already sent you a letter about the issue, or if the identity theft is not tax-related.
• File Form 14039, Identity Theft Affidavit, only if the IRS tells you to, you cannot use the verification service, or you want to report possible tax-related identity theft the IRS does not know about, such as a data breach. You can file it for yourself, a dependent, or a deceased person, but not again for an incident you already reported. If you cannot e-file because your (or your spouse's or dependent's) SSN or ITIN was misused, the form's instructions say to attach it to the back of your paper return and mail it where you normally file.
• Keep filing and paying as usual while the issue is resolved.

Example (illustrative)

Mina tries to e-file her 2025 return in March 2026, and it is rejected because a return was already filed with her SSN. She has not received an IRS letter. Because the IRS has not contacted her and she has not reported this before, she completes Form 14039, attaches it to the back of a paper return, and mails it to the IRS location where she normally files, as the Form 14039 instructions say. She keeps copies of everything. If an IRS letter had arrived first, she would follow its instructions instead — for example, using the Identity and Tax Return Verification Service rather than filing Form 14039. After the case is resolved, she sets up an IRS online account with a strong, unique password and enrolls in continuous IP PIN protection so future returns need her IP PIN.

IRS impersonation scams

Some legitimate letters come from IRS-contracted private collection agencies. To check a notice, search the IRS notices and letters page, and report suspicious contacts to the IRS.

Identity protection vs. account security

• IP PIN: blocks returns filed with your SSN or ITIN without the PIN.
• Online account security: a complex, unique password protects your IRS account, where your IP PIN and tax records are.
• Everything else: credit reports, bank accounts, and state tax agencies need their own protections; the IRS points victims to IdentityTheft.gov for recovery steps.

Common mistakes

• Using last year's IP PIN. It changes every year.
• Filing Form 14039 when an IRS letter already told you to use the verification service.
• Giving personal details to a caller who claims to be from the IRS.
• Forgetting a dependent's IP PIN on an e-filed return.
• Assuming the IP PIN protects state returns or bank accounts.