Preventing Tax Identity Theft From Happening to You

Thieves always find new ways to steal money. In the digital age, opportunities for theft are abundant — and relatively easy to execute. This time of year, one type of theft to be especially vigilant in guarding against is “tax identity” theft.

Instead of stealing a tax refund check from your mailbox, a thief can now file a fraudulent return in your name and request the IRS to send the “refund” to an address or an account that isn’t yours. You won’t know you’ve been scammed until you try to file and your real return is rejected because the IRS thinks it’s a duplicate.

Fortunately, the IRS catches most fraudulent returns before they are fully processed, but some aren’t discovered until refunds have been paid out to thieves. That’s bad news for victims. According to a 2023 report to Congress by the National Taxpayer Advocate, “victims of tax-related identity theft are waiting an average of nearly 19 months for the IRS to process their returns and send their refunds” (see table).

How thieves get your information

To file a fraudulent tax return, a thief must first gain access to information that can be used to impersonate the actual taxpayer, including the taxpayer’s Social Security number. Such information can be gleaned in several ways.

Thieves may use database hacking or online “phishing” scams to acquire a taxpayer’s identity details. But low-tech approaches are simpler and often more fruitful. For example, medical forms typically request a patient’s Social Security number, providing easy access for a “dirty” employee at a doctor’s office, clinic, or hospital. (Kiplinger.com lists medical offices and hospitals among the riskiest places to divulge a Social Security number.)

Other low-tech approaches include stealing documents from a person’s mailbox or trash. Another is “pretexting,” in which a thief obtains personal information via phone by impersonating a bank employee or government official.

Here are several “best practices” for protecting your personal information.

An ounce of prevention…

One way to reduce the likelihood of a fraudulent tax return being filed in your name is to file as early as possible in the tax season. That increases the likelihood that your return will reach the IRS before any fraudulent version may show up.

Because early filing may not always be possible, the IRS offers another way to protect yourself against fraudsters. Upon request, the tax agency will provide a unique six-digit code, called an IP PIN, to include with your tax return. (A husband and wife can each request an IP PIN if desired, even if filing jointly.)

The IP PIN is similar to an authentication code used to provide security for an online bank or brokerage account. “The IP PIN prevents someone else from filing a tax return using your Social Security number,” says the IRS website.

An IP PIN lasts only one year, so you must retrieve a new one each tax year via your online IRS account — unless you have already been the victim of tax-related ID fraud. In that case, the IRS will automatically generate a code and send it to you by postal mail.

What to do if you’ve been a victim

The IRS recommends these steps if you suspect or know you’ve been a victim of tax-related ID theft.

• If your e-filed return is rejected because of a duplicate filing, complete IRS Form 14039 (PDF). Attach that form (Identity Theft Affidavit) to a completed paper return and mail it to the IRS.
• If you get an ID theft alert from the IRS (via postal mail), respond immediately. Many victims fail to respond, thus delaying the resolution of their cases.
• Go to IdentityTheft.gov. That site offers details on protecting your financial accounts following an ID theft.

For more help, visit the IRS web page titled “IRS Identity Theft Victim Assistance: How It Works.” Images used with permission.