IRS Data Studies
IRS Identity Protection PIN: Identity Theft Data and How to Lock Your Return (2026)
The short answer: More than 10.4 million taxpayers have locked down their returns with an IRS Identity Protection PIN — the single strongest defense against a thief filing in your name. The IP PIN is free, valid for one calendar year, and anyone with an SSN or ITIN who can verify their identity can enroll — most people in about ten minutes online.
Maybe your e-file just bounced with a "return already on file" rejection. Or maybe a breach notice landed the same week as your mortgage paperwork, and you want the door bolted before a thief tests it. Either way, this data study covers the IRS identity protection PIN, identity theft by the numbers, and the fastest way to lock your Social Security number before someone else uses it.
If you enroll as a confirmed victim, your six digits arrive by mail every January — the image below shows you exactly what that mailing looks like and where to find the number you'll need at filing time.
⏱ The real clock: there's no enrollment deadline — but protection only starts once the PIN is on your account, and fraudulent returns cluster in the first weeks of filing season. An IP PIN is valid for one calendar year; a new one is generated at the beginning of each calendar year for security.
IRS Identity Protection PIN identity theft data: what 10.4 million enrollments tell you
More than 10.4 million taxpayers already have an IP PIN, according to the IRS Security Summit's announcement of the ninth annual National Tax Security Awareness Week (IR-2024-295, Nov. 21, 2024). That number matters because it's the IRS's own answer to the question "how do I stop someone from filing as me?" — not a third-party product, and not a paid service.
The mechanics are simple. An IP PIN is a six-digit number that prevents someone else from filing a federal tax return using a taxpayer's Social Security number or Individual Taxpayer Identification Number (IRS, IR-2024-278). The number is known only to you and the IRS. Without it, a return under your SSN can't post normally — an e-filed return rejects outright, and a paper return gets held for identity screening instead of paying out a refund.
The program started as a victims-only measure and opened to all taxpayers as a voluntary opt-in in 2021. Enrollment is free, and no minimum "risk level" is required — you don't need to prove anything happened to you. That's the whole point: the PIN works best when it's in place before a thief ever tries.
Why identity thieves want to file your tax return
A thief who files under your Social Security number before you do collects the refund — and leaves you the cleanup. They don't need your W-2, your bank login, or your tax software password. A name, an SSN, and a date of birth from a data breach are enough to build a return around a fabricated W-2 with inflated withholding.
Two details make this scheme work. First, thieves file in the earliest weeks of the season, before the IRS has matched employer wage data against returns. Second, "I always owe, so I'm not a target" is false comfort — the thief invents the withholding that generates a refund, so your real tax picture is irrelevant to them.
If you're mid-refinance, your exposure is arguably higher, not lower: a mortgage application puts your SSN, income figures, and signed documents in front of more people and systems than almost any other transaction you'll do this year. Each copy is one more place a breach can start.
What happens when a thief files first — the sequence without an IP PIN
Without an IP PIN, the first sign of tax identity theft is usually an e-file rejection saying a return already exists for your SSN. From there, the sequence runs in a fixed order:
- The thief files early — often in the opening weeks of the season, using breach data and a fabricated W-2, and the refund goes to an account they control.
- Your real return bounces — the e-file system rejects it because a return has already posted for your SSN. This is the moment most victims discover the theft; our guide to someone filed taxes in my name covers that first hour.
- You paper-file with an affidavit — your legitimate return goes in by mail with Form 14039 identity theft affidavit attached, which routes the case to the IRS's identity-theft unit.
- Your refund freezes — while two returns compete for one account, your money is held; on a transcript this often shows as an 810 freeze verify identity situation.
- The case sits in a queue — see our data study on how long the IRS takes to resolve identity theft cases; an entire filing season can pass before the returns are untangled.
- The IRS confirms the theft — your refund is released, your account is flagged, and you're put into the IP PIN program going forward: the exact protection you could have had for free on day one.
The 2026 backdrop makes prevention even more lopsided. The IRS workforce was cut roughly 27% in 2025, per TIGTA reporting, which means fewer humans working identity-theft cases — but the automated filters that freeze refunds never slowed down. The freeze is instant; the fix is not.
A fraudulent return already on your account?
What you file next — the paper return, the Form 14039, the transcript requests your lender needs — affects how cleanly the IRS untangles your case. Get your identity-theft situation reviewed free by an experienced tax professional. No pressure, no obligation.
Your three ways to enroll in the IP PIN program
Anyone with an SSN or ITIN who can verify their identity is eligible to enroll in the IP PIN program — and there are three doors in, sorted from fastest to slowest.
The online route is the default: verify through your IRS account (our walkthrough on IRS online account setup covers the ID.me steps) and the PIN appears on screen the same day. If online verification fails, the paper route opens — but only below an income line. For 2025, taxpayers who cannot verify their identity online and whose income is under the threshold can use Form 15227; the threshold was $84,000 for individuals / $168,000 for married filing jointly. Above that line, the fallback is an in-person appointment at a Taxpayer Assistance Center.
| How to enroll | Who it's for | How you get the PIN |
|---|---|---|
| IRS online account (fastest) | Anyone with an SSN or ITIN who can pass online identity verification (ID.me, photo ID) | Immediately, on screen — retrieve the new PIN there each January |
| Form 15227 by mail | Can't verify online AND income under the 2025 threshold: $84,000 for individuals / $168,000 for married filing jointly | The IRS contacts you by phone to verify identity, then mails the PIN |
| Taxpayer Assistance Center appointment | Everyone else — can't verify online and over the Form 15227 income line | Verify in person with a government photo ID plus a second identity document; PIN arrives by mail |
Two situations change the mechanics. Married filing jointly: there is no "joint" IP PIN — each spouse enrolls separately and gets their own six digits, and each PIN goes with its own SSN on the return. The $168,000 figure is only the Form 15227 income test for joint filers, not a shared PIN. Dependents: children and other dependents with an SSN or ITIN can be enrolled too, which blocks anyone from claiming them on a fraudulent return — a different problem from the custody-season dispute covered in both parents claimed child irs, which a PIN doesn't referee.
How to get an IP PIN and respond to identity theft, step by step
- Enroll online first. Sign in to (or create) your IRS online account and request the IP PIN from your profile — the six digits appear on screen immediately.
- Fall back to Form 15227 if you can't verify online. If your income is under the threshold — $84,000 for individuals / $168,000 for married filing jointly for 2025 — mail Form 15227; the IRS verifies you by phone and mails the PIN.
- Book a Taxpayer Assistance Center appointment if neither works. Bring a government photo ID plus a second identity document; the PIN arrives by mail afterward.
- Enter the six digits on every federal return you file. E-filed or paper — a return without the correct IP PIN rejects or gets pulled for manual identity review.
- Retrieve your new PIN each January. An IP PIN is valid for one calendar year — log back into your online account, or watch the mail for your CP01A if you're a confirmed victim, before you file.
- Already a victim? File Form 14039 with your real return. Paper-file your legitimate return with the Identity Theft Affidavit attached so your case enters the IRS identity-theft queue.
Your IP PIN expires every year — how the annual cycle works
An IP PIN is valid for one calendar year; a new one is generated at the beginning of each calendar year for security. That annual rotation is the program's second lock: even if a thief somehow captured last year's six digits, they're worthless this filing season.
How you receive the new number depends on how you're enrolled. Voluntary online enrollees log back into their IRS account each January and read it off their profile. Confirmed identity-theft victims get it by mail on a CP01A notice — our guide to the irs ip pin cp01a breaks down that notice line by line, and the document image in this guide shows you what to look for. If you've moved, update your address with the IRS before January — the CP01A goes to your address of record, and a PIN you never received is the most common cause of self-inflicted filing delays.
Got an identity letter instead of a refund? Decode it
Several distinct IRS letters touch identity verification, and each demands a different response — answering the wrong way (or ignoring the right one) is what turns a two-week hold into a months-long freeze.
| Letter or event | What it means | Your move |
|---|---|---|
| CP01A | Your annual IP PIN for the new calendar year — protection, not a problem | Keep it; enter the six digits on this year's return |
| 5071C letter | The IRS received a return under your SSN and wants you to confirm it's really yours | Verify online or by phone using the letter's instructions before your refund moves |
| 4883C letter | Identity verification required by phone only | Call the number on the letter with last year's return and the flagged return in hand |
| 5747C letter | In-person identity verification required | Book the Taxpayer Assistance Center appointment the letter directs |
| E-file rejection: return already on file | Someone filed under your SSN before you did | Paper-file your real return with Form 14039 attached |
If the online verification tool refuses to accept you — a common complaint during peak season — see our troubleshooting guide for idverify irs gov not working before you burn an afternoon on hold.
What tax identity theft costs a refinancing homeowner: a worked example
This is a hypothetical, but the math is the kind that plays out every spring. Say you're a homeowner planning a March refinance of a $320,000 mortgage, and you're expecting a $3,150 refund. In late January, a thief e-files under your SSN, claiming fabricated wages and a $9,400 refund.
Your real return, filed in February, rejects. Three costs stack at once:
- Your $3,150 refund freezes until the IRS untangles the two returns — money you'd earmarked for closing costs.
- Your lender's transcript pull stalls. The refinance underwriter requests your tax transcript through Form 4506-C, and until the fraudulent return is resolved, your account may show the thief's data or nothing usable at all.
- Your rate lock is at risk. If the delay pushes you past the lock and your rate slips from 6.25% to 6.625%, that 0.375-point difference on $320,000 is $320,000 × 0.00375 = $1,200 in extra interest in the first year alone — more than a third of the refund you're waiting on.
Total first-year exposure in this scenario: roughly $1,200 in rate slippage plus a frozen $3,150, against a free six-digit PIN that takes about ten minutes to set up. That asymmetry is the entire argument for enrolling before anything happens.
When you can handle this yourself — and when help changes the outcome
Enrolling in the IP PIN program takes about ten minutes online and needs no professional help. If you can verify your identity through your IRS account, do it yourself today — same for retrieving the new PIN each January, entering it on your return, and even a straightforward single-year theft where you paper-file with Form 14039 and wait out the queue.
Experienced help changes the outcome in messier situations: fraudulent returns spanning multiple years; a phantom balance or underreporter notice generated by income someone else earned under your SSN; employment identity theft where a stranger's W-2s keep landing on your account; or a hard deadline — like a refinance closing — that can't wait for the normal queue. And if the theft left a balance the IRS insists you owe, start with our guide on how to settle tax debt yourself, then bring in an experienced tax professional if the balance is disputed or spans years.
Terms on your notice, decoded
- IP PIN — the six-digit number, known only to you and the IRS, required on your federal return once you're enrolled.
- CP01A — the annual mailed notice carrying a confirmed victim's new IP PIN each January.
- Form 14039 — the Identity Theft Affidavit that formally reports tax identity theft and opens your case.
- IDTVA — Identity Theft Victim Assistance, the IRS unit that untangles duplicate returns.
- TC 810 — the transcript code marking a refund freeze, often applied while identity questions are open.
- ID.me — the identity-verification service the IRS online account uses; passing it is the gate to instant online enrollment.
IP PIN and identity theft questions, answered
Does an IP PIN actually stop tax identity theft?
It stops the most damaging form of it — a fraudulent refund filed in your name. An IP PIN is a six-digit number that prevents someone else from filing a federal tax return using a taxpayer's Social Security number or Individual Taxpayer Identification Number: e-filed returns without the correct PIN reject, and paper returns without it face extra screening. It does not stop other misuse of your SSN, such as fraudulent credit accounts — pair it with a credit freeze for those.
Who is eligible for an IRS Identity Protection PIN?
Anyone with an SSN or ITIN who can verify their identity is eligible to enroll in the IP PIN program — you do not need to be a confirmed identity-theft victim. The fastest route is your IRS online account. If you cannot verify online, Form 15227 is available when your income is under the threshold — $84,000 for individuals / $168,000 for married filing jointly for 2025 — and an in-person appointment covers everyone else.
Do I get a new IP PIN every year?
Yes. An IP PIN is valid for one calendar year; a new one is generated at the beginning of each calendar year for security. Most enrollees retrieve the new number by logging back into their IRS online account each January, while confirmed identity-theft victims receive theirs by mail on a CP01A notice. Using last year's PIN on this year's return will get an e-filed return rejected.
What if I lost my IP PIN?
Sign back into your IRS online account — the current PIN is displayed in your profile. If you cannot access the account, you can ask the IRS to reissue the PIN by mail to your address of record, which takes several weeks. Never guess: a wrong six digits rejects an e-filed return, and a paper return filed without the PIN gets pulled for manual identity review and a slower refund.
Can my child or dependent get an IP PIN?
Yes — dependents with an SSN or ITIN can be enrolled, which blocks anyone from claiming them on a fraudulent return. A parent or guardian who cannot complete online verification for a dependent can use Form 15227 (subject to the income threshold) or an in-person IRS appointment. Note that an IP PIN stops fraudulent claims, not custody disputes — if two parents legitimately claim the same child, the IRS applies its tiebreaker rules.
Someone already filed a return in my name — will an IP PIN fix it?
An IP PIN prevents the next fraudulent return; it does not undo one already filed. You will need to file your real return on paper with Form 14039, the Identity Theft Affidavit, so the IRS's identity-theft unit can untangle the two returns — your refund stays frozen in the meantime. Once the case is confirmed and closed, the IRS typically enrolls you in the IP PIN program automatically going forward.
Can I opt out of the IP PIN program later?
If you enrolled voluntarily, generally yes — the IRS allows opt-out through your online account. Confirmed identity-theft victims usually cannot opt out; the annual PIN stays on the account to keep protecting it. Weigh the trade-off before leaving: without the PIN, the only thing standing between a thief and a return in your name is whether you file before they do.
Does an IP PIN delay my refund?
No — if anything, it does the opposite. A return filed with the correct IP PIN clears the IRS's identity filters cleanly, while returns flagged for possible identity theft can sit in verification for weeks or months. The delays people associate with IP PINs come from entering the number wrong or using an expired year's PIN, both of which cause rejections you can fix immediately by correcting the six digits.
Your next 24 hours
- Check your account. Log into your IRS online account and confirm whether a return has already posted under your SSN this year — and whether you can pass online verification, since that one gate decides which enrollment door you use.
- Gather your verification kit. Last year's tax return, a government photo ID, and your income figures — the same set works for online enrollment, Form 15227, or Form 14039 if theft has already happened.
- Get the free review if something's already wrong. A fraudulent return, a frozen refund, or a balance you don't recognize won't resolve itself — call (888) 825-7779 or use the 2-minute form. The sooner your affidavit and real return are filed, the sooner your case enters the IRS queue.
Sources: IRS Security Summit, National Tax Security Awareness Week announcement (IR-2024-295); IRS, Get an Identity Protection PIN; and the Taxpayer Advocate Service for help when a case stalls.
This guide is general information, not tax or legal advice for your specific situation. Eligibility for IRS programs depends on individual facts and circumstances; no outcome is guaranteed.