Tax-Related Identity Theft: Signs and Steps

Treat tax identity theft as an IRS-account problem first: follow the rejection or notice instructions, file the real return, and use Form 14039 only when the IRS process calls for it.

Tax-related identity theft often announces itself through a very specific event: an e-file rejection saying a return was already filed under your Social Security number or ITIN, an IRS notice about a return you did not file, an unexpected refund, or income that does not belong to you. Do not answer the problem with a generic “identity theft” checklist. Follow the IRS instruction tied to the event. If your e-file is rejected because another return is already on file, preserve the rejection, file the legitimate return as instructed, and use Form 14039 when the IRS identity-theft process calls for it. If the IRS sends a verification notice, follow that notice; some verification paths specifically say not to submit Form 14039 unless told to do so.

Start with the exact IRS signal, because the remedy changes

An ordinary e-file rejection can be caused by a typo in an SSN, name, or other return field. Read the reject code or explanation before concluding a thief filed first. IRS guidance says some errors can be corrected and e-filed again. A duplicate-return rejection is different. When the rejection indicates that you or your spouse already filed, the IRS directs taxpayers to contact it for help, and a paper filing may be necessary. If you file a paper return after an electronic rejection, current IRS guidance describes a special timeliness rule: the paper return must generally be postmarked by the later of the return due date, including extensions, or 10 calendar days after the IRS rejection notice, with the rejection information and explanation attached as instructed.

Do not wait for the identity-theft case to finish before filing the tax return you are legally required to file. Identity-theft resolution can take much longer than the filing deadline. The goal is to get the legitimate return into the IRS process while preserving evidence that the earlier electronic filing was rejected.

Consider two taxpayers who both receive an e-file rejection. One typed an identification number incorrectly and can correct the entry; the other receives a rejection because a return using the same taxpayer identity is already on file. The screen may look similar, but the second situation points to the IRS identity-theft path and may require a paper filing under the instructions for that rejection. The practical lesson is to save the exact rejection language before taking action. “My return was rejected” is not enough detail for a tax professional or the IRS to tell which branch of the process you are actually in.

Do not file Form 14039 merely because personal data was exposed. The affidavit is for tax-related identity theft, not a general notice that an SSN may be at risk. If there is no federal tax misuse, the preventive question may be whether to use an IP PIN and harden the accounts involved in filing. Conversely, when the IRS notice or duplicate-return situation does call for the affidavit, do not send repeated copies for the same incident simply because resolution is slow. Keep one clean record of what was filed and answer later IRS requests by notice and tax year.

Form 14039 is a targeted affidavit, not a universal breach form

Form 14039 is not a generic attachment for every suspicious tax message. Use it when the IRS identity-theft instructions for your situation call for the affidavit. Some IRS letters and online return-verification workflows direct the taxpayer to authenticate a specific return first, and the IRS can tell successful users of that route that a separate affidavit is unnecessary. Read the authentic notice or Identity Theft Central instructions tied to your event before adding forms, because duplicate or unnecessary submissions can complicate an already open case.

A less visible risk is unknown wage income appearing in the tax record while the taxpayer’s own return was otherwise legitimate. That can signal employment misuse rather than a false tax return alone. Keep the IRS notice, review the Social Security earnings record, and correct the records through the agency that owns each piece. The IRS tax account and the SSA earnings record are related evidence but separate systems. Treating them separately prevents one corrected record from creating a false sense that the other government file has also been repaired.

Protect the IRS online account and the email behind it

If someone changed your IRS online-account credentials, follow the IRS account-recovery instructions rather than repeatedly attempting sign-ins or creating duplicate accounts. Secure the email address connected to tax software and IRS services as well. Change reused passwords, remove unfamiliar recovery methods, and enable strong multifactor authentication where available. Tax identity theft can begin with stolen tax documents, but it can also be sustained by a compromised mailbox that receives filing confirmations or password resets.

Keep copies of every IRS notice and your responses. The notice number, tax year, date, and method of response matter. Do not send the IRS a full library of unrelated identity-theft paperwork if the notice asks for a narrow set of documents. The IRS works tax years and account issues separately, so label your files by tax year and notice number.

An IP PIN is the preventive control to carry forward

An IRS Identity Protection PIN is a six-digit number used to help verify the taxpayer’s identity on federal individual income-tax returns. IRS guidance says an IP PIN is valid for one calendar year and a new number is generated each year. Confirmed tax-identity-theft victims are placed into the IP PIN program; other taxpayers can also opt in if they can verify identity. Protect the number as sensitive tax data and share it only with the IRS and a trusted tax professional who is preparing your return.

The IP PIN does not repair a fraudulent return that was already filed. It is a forward-looking filing control. If you use one, make sure the current year’s PIN is entered on any federal return filed during that calendar year, including a prior-year return filed now, according to IRS instructions. A stale prior-year PIN can cause another rejection and create confusion during recovery.

Check Social Security when the tax problem points to employment misuse

An IRS notice about wages from an employer you do not recognize can indicate employment identity theft rather than, or in addition to, fraudulent tax filing. Review your earnings record through a personal my Social Security account. SSA says it can help correct earnings that are not yours, including through an online correction path for some users or through a local office with supporting records. SSA does not run the broader identity-theft investigation; it corrects the Social Security record while the FTC and IRS handle their respective parts.

Expect resolution to be slower than filing

Tax-identity-theft cases can remain open while the IRS verifies the legitimate return and removes fraudulent activity. Do not interpret a long process as permission to ignore later notices. Open every IRS letter, confirm that it is genuine using IRS.gov, and answer the specific request by the deadline shown. A clean recovery file should let you explain which return was yours, which filing was fraudulent, what identity-theft report was made, and what IP PIN protects future filings. That is a better finish line than waiting for a vague feeling that your SSN is “safe again.”