Tax Relief Services

Tax Identity Theft: The Warning Signs, the IRS Steps, and How To Lock Your Account

Updated September 6, 2026

By Angeline Balsitis, EA · Reviewed by Melissa Ly, Chief Tax Officer

Tax identity theft usually announces itself sideways: an e-filed return bounces because one was already filed, or a notice arrives about income from an employer you have never heard of. The IRS's own guidance is direct about what to do first, and the single most useful step, the IP PIN, is one you can take before anything has gone wrong.

What tax identity theft looks like

The IRS's guide for individuals lists the signs to watch for, and the list is longer than a rejected return. A tax return rejected because one has already been filed. A Form W-2 or 1099 from an employer you did not work for. A Form 1099-G for unemployment benefits you did not get or apply for. An employer identification number you did not apply for. An unreported income alert, like a CP2000 series notice. Someone wanting to help with your Online Account. Accounts created or accessed that you did not create or access. Alerts about password resets. A data breach that leaked your information. A Social Security account showing wages you did not earn.

The IRS adds that these do not always mean identity theft, and that the targets can be you, your children, other dependents and nonfilers. The full guide is the IRS's identity theft guide for individuals. In practice the two we see most are the rejected e-file in February and the CP2000 months later for wages someone else earned under your number.

When the IRS writes to you first

The IRS says it sends a letter or notice when it suspects identity theft on a return, and that sometimes getting its mail is your first sign you could be affected. It also says it sends a fax to verify income, withholding or employment. Its instructions for that letter are specific: verify it is from the IRS, follow the instructions, and if told to, use its Identity and Tax Return Verification Service. If you need a copy of your own return, check your Online Account or call the number the IRS gives. To get a copy of a fraudulent return filed in your name, the IRS points to Form 4506-F, Identity Theft Victim's Request for Copy of Fraudulent Tax Return.

That first instruction, verify it is from the IRS, exists because identity thieves also send letters. A real IRS letter about identity theft will direct you to IRS.gov tools, not to a phone number that asks for your Social Security number and a payment.

The IRS's steps, in order

If your identity was stolen, the IRS's list is this, and we have not found a better one.

• Stop interacting with the identity thief. Hang up, do not give money or information, do not click links or open attachments. If you did, run antivirus software.
• Update your Online Account password. Complex and unique.
• Follow the IRS instructions from your letter, notice or representative.
• Report identity theft to the IRS, and follow the recovery steps on IdentityTheft.gov.
• Get an Identity Protection PIN to protect your tax account.
• Keep records of letters, phone calls and emails.
• File returns and pay tax as usual. The IRS says this explicitly. A stolen identity does not pause your own obligations.
• Check with your state tax agency for its own steps.

The IRS also says to check whether you should file Form 14039, Identity Theft Affidavit. Not every case needs it; the IRS's own verification letter sometimes resolves the matter without one. Where the affidavit is needed, it is what opens a case with the IRS's Identity Theft Victim Assistance Program, which the guide names.

The IP PIN, which is the lock

The IRS describes an Identity Protection PIN as a six-digit number that prevents someone else from filing a tax return using your Social Security number or ITIN, known only to you and the IRS, used to verify your identity when you file. Its page says you may get one as a proactive step even if you are not required to file, and that anyone with an SSN or ITIN who can verify their identity is eligible. Parents and legal guardians can request one for dependents.

The IRS says the fastest way to get one is through your online account, in the IP PIN section of your profile, after registering and validating your identity. If you cannot establish an online account there are alternatives, including Form 15227, though the IRS notes the alternatives take longer. The page is the IRS's Get an identity protection PIN. Our advice to every client, victim or not: get the PIN. It closes the door the thief used.

Dependents, and the duplicate-claim problem

The IRS's guide has a section on dependent identity theft, because a child's information can be used to claim a credit. If your dependent was claimed on another return in the same year, the IRS says it could be a misunderstanding, a mistake, or a crime, and it says to determine who can claim the dependent before you file and to check that the dependent's information is correct on your return.

There is a practical change worth knowing. The IRS says that beginning with 2024 tax returns it will accept an e-filed return even if a dependent has already been claimed, provided the primary taxpayer on the second return includes a valid IP PIN. The dependent does not need a PIN unless one was previously issued. So a parent with an IP PIN can file electronically over a fraudulent dependent claim rather than being forced to paper.

What Clarity does with tax identity theft

Our job is separating what is yours from what is not, on the IRS's own record, and then cleaning up whatever the fraud left behind. We pull your wage and income transcript, which lists every form filed under your number, and mark each one as yours or not. That list is the case. It is also usually where the first surprise is, because a fraudulent W-2 often sits alongside a fraudulent return that claimed a refund against it.

• We prepare the IRS forms: Form 14039 where it is needed, Form 4506-F to obtain the fraudulent return, and the verification steps the IRS's letter asks for.
• We get the IP PIN in place for you and, where appropriate, for dependents.
• We clear the balance. Identity theft often leaves a false balance, a false CP2000, or a frozen refund on your account. Each has its own fix, and we handle them with the IRS under a power of attorney.
• We keep you filing. The IRS says to file and pay as usual, and a victim who stops filing while the case runs creates a second problem. If years are already unfiled, our unfiled tax returns page covers that.

The investigation fee is $495 for an individual and $695 for a business. It covers the transcript pull, the yours-or-not review of every form on the account, and a written plan, and it comes with a 15-day money-back policy from the date you sign. You have the written agreement before anything is charged.

The hard part, stated plainly

The hard part is time. Identity theft cases move at the IRS's pace, refunds held during a case stay held, and the IRS's guide points you to its own page on how long forms and returns are taking to process. Nothing on this page speeds that up. What it does is make sure the case is opened correctly, with the right forms, so the delay is the IRS's queue and not a rejected affidavit.

The second hard part is that the fraud can keep generating notices for years, as forms filed under your number surface in later matching cycles. The IP PIN stops new fraudulent returns. It does not stop a thief's employer from filing a W-2 under your number, and each one of those is a CP2000 waiting to happen unless the account is flagged and watched.

When you do not need anyone

If your return was rejected, you know why, and the IRS's letter tells you to verify your identity through its service, do that and file. If nothing has happened yet and you want the protection, get the IP PIN through your online account today. That is the whole of it, and it costs nothing.

Where a review earns its fee: fraudulent income is showing on your transcript, a balance or a CP2000 has resulted from it, a refund has been held for months, dependents are involved, several years are affected, or you also have unfiled returns of your own mixed in. Those are the cases where separating the record and working the balance changes what you owe.

Tax Identity Theft Questions, Answered

Results vary based on individual facts and circumstances. How quickly the IRS resolves an identity theft case, and whether a held refund is released, depends on the IRS's own processing, and no specific outcome is guaranteed. This page is general information about tax-related identity theft, not tax or legal advice.

Related Services: CP2000 Notice · Unfiled Tax Returns · Tax Consultation · IRS Audit Representation · or return to All Tax Relief Services.

“We send a letter or notice when we suspect identity theft on a return. Sometimes, getting our mail is your first sign you could be affected by identity theft.”

— IRS, Identity theft guide for individuals

The passage quoted above is from IRS, Identity theft guide for individuals.