Tax Identity Theft: How It Happens & How to Prevent It

Are Scammers Using Your Identity To File Fraudulent Tax Returns?

Tax identity theft happens when someone uses your stolen personally identifiable information (PII) — like your Social Security number (SSN) — to file a tax return and claim a fraudulent refund. In 2023 alone, the IRS flagged over 2.4 million tax returns as being potentially submitted by identity thieves, costing the government and average Americans billions [*].

As you prepare your taxes, it's important to take precautions to keep your identity and your tax return safe.

In this guide, we'll explore the warning signs of tax identity theft, explain how tax fraud happens, and provide actionable steps to protect your personal tax information.

9 Warning Signs of Tax Identity Theft

Awareness is a key piece in a good identity theft prevention strategy. When you can identify suspicious activity and threats early on, it is easier to take action and limit the damage. Here are nine warning signs of tax identity theft:

1. Suspicious tax returns

The first and most glaring red flag is if you receive a direct letter from the IRS inquiring about suspicious activity on your tax account. The IRS flags any tax return that has errors or conflicting information and, if they deem it necessary, will send a notice to you.

Suspicious activity may include:

• Underquoted income
• Overstated deductions
• Multiple filings
• Large personal expense claims

If you receive an unfamiliar notice like this from the IRS, there is a chance that a scammer has stolen your personal information. The thieves could have used your identity to file a fraudulent return.

2. Duplicate Social Security numbers

The U.S. government uses your SSN as a way to track your taxable earnings. Given its importance to your financial accounts, the IRS is quite particular about the accuracy of your SSN on all tax documents. Any tax return with an incorrect, duplicate, or reversed SSN will be flagged.

Criminals intent on committing tax identity fraud need your full SSN, so they often use fraudulent schemes to steal it and other PII. Some thieves resort to hacking agency databases, impersonating IRS agents, or even working as false bank tellers. If successful, criminals can assume your identity to take hold of pension funds, tax refunds, and employment insurance.

3. Unsolicited tax transcripts

The IRS does not send unsolicited tax information, so you should always take notice when documents purporting to be from them arrive at your doorstep. Of these, an unrequested tax transcript should be most unsettling.

Your transcript outlines much of the key information needed for your tax returns, making it highly valuable to thieves. It is an easy way to nick your tax identity information.

Unfortunately, the issue can get confusing, as the IRS occasionally sends legitimate forms to verify taxpayer' identity, such as the 507IC, 4883C, or 5747C forms. Scammers create fake copies of these forms to trick you into handing over your personal information. You assume you have verified your tax numbers with the IRS when you’ve inadvertently sent all your data to a fraudster.

DID YOU KNOW? The IRS sends Form 5071C if there was a fraudulent tax return filed under your name. You may verify your identity online, by phone, or in person. To verify the legitimacy of any forms you have received, visit the IRS website.

4. New account creation notices

Anytime you register for an online IRS service, you receive a CP301 notice as confirmation. Tax tools for filing, refunds and payments, or credits and deductions all require you to sign into your online account. The IRS advises you to take immediate action if this notice was uninitiated.

• Call the number on your notice to disable your account
• Verify your identity to disable your online account

5. Account closure notices

On the surface, a chance account closure notice seems harmless. But thieves may allow your closed records to lay dormant for months or years, waiting for you to forget about these inactive accounts. It is far easier to commit fraud in an account with no customer or IRS activity.  

Thieves can also reopen an account at a later date — now with full access and control. Not only does this cause mix-ups with your tax files, but it exposes your new accounts to further identity theft. Criminals can even use an old tax account to access bank services with your information.

In the news: Andrew Welch of Idaho Falls used a secondary individual's tax and bank accounts to hide over $250,000 worth of investments [*]. Welch failed to disclose those hidden earnings, knowingly committing tax fraud. It resulted in a five-year prison sentence and a fine of $25,000.

6. Additional tax and refund notices

Some tax error notices from the IRS are legitimate and sent in response to suspicious activity. For example, the government will notify you if a thief attempts to refile returns for missed tax years. If any of your tax or refund numbers change, it could be a sign of identity theft.

But criminals also understand that no one wants a surprise discovery of hidden debts. As a result, they use fear tactics that prey on that exact feeling. Many fraudsters send fake letters demanding extra tax payments to trick or scare victims into sharing information.

Remember, the IRS will send out notices for only these reasons:

• Overdue balance
• Eligible for a larger or smaller refund
• Questions about your tax return
• Identity verification — like Form 5071C from our previous example
• Changes in returns
• Delays to process returns

7. Extraneous income taxes

One of the easiest ways for thieves to increase the total refund amount on a tax return is to falsely quote income. If your tax return shows that you earned money from an unknown employer, that may indicate tampering.

If the IRS receives a wrongful income statement (by accident or due to fraud schemes), criminals will follow up by sending you fake documents. The paperwork they send will tell you to rectify any false claims along with a demand for immediate repayment. At this point, unsuspecting victims who think they’re dealing with bona fide contacts at the IRS will send their cash and identity information to criminals.

Unfortunately, this bogus filing doesn’t exempt you from filing your real tax return with the IRS. The government also levies penalties for wrongful tax claims. Fees start at $50 for erroneous filing spotted in the first 30 days.

8. New EIN notices

If you receive a notice from the IRS about a new Employee Identification Number (EIN), consider it a big red flag for possible tax identity theft. The IRS uses an EIN to identify a business. Also known as a federal tax number, the nine-digit reference makes it easier for entities to report their taxes.

An EIN contains a lot of sensitive tax information, making it a target for identity thieves. With that data, they can create fictitious wages, change expense amounts, alter employee earnings, and falsify employee tax withholding. Criminals will try to take your EIN to commit fraud under the disguise of your legitimate business.

Zoom out: Submit a Form 14039-B (PDF) to the IRS if you think someone is misusing your EIN to file fraudulent tax returns.

9. Unexpected tax returns

Receiving multiple tax returns is another sinister precursor to identity theft or tax preparation fraud. Keeping track of your tax documents is straightforward for those who file a single personal tax return. But if you have to fix refund mistakes, file for a spouse, or send in multiple returns for different businesses, your paperwork can pile up. Criminals can catch you off guard here.

If a criminal can slip an incorrect or false tax return into your account, they may be able to access your tax refund. Plus, if the illegal tax return gains approval from the IRS, that could also give the fraudsters access to your tax accounts. At that point, they can use your information for additional schemes.

What to Do If Your Tax Identity Is Compromised

Partners in the Identity Theft Tax Refund Fraud Information Sharing and Analysis Center (ISAC) collaborate to share vital information that helps authorities and taxpayers detect and prevent sophisticated fraud schemes.

You can help the IRS in their investigation process when you embrace a proactive approach to sharing and managing information around your financial accounts.

Here are several steps you should take if your personal information is compromised by tax identity theft.

Respond to IRS notices

The IRS set up the Taxpayer Protection Program to investigate fraudulent tax return cases. If there is any suspicious activity on your account, you will receive a prompt notice.

Often, the IRS sends a Letter 4883C as a precautionary measure. It is a standard request for you to verify your identity. You might need to visit a taxpayer assistance center to confirm your identity, and the IRS can freeze your account if they think fraud has occurred.

For all other IRS notices, call the listed support numbers within the document right away. If your account has been compromised, the faster you respond, the better the IRS can protect your tax information.

Submit an Identity Theft Affidavit

If you discover that you are a victim of tax identity fraud, you should complete an Identity Theft Affidavit. Also known as Form 14039, this document is the official method for alerting the IRS to potential tax identity theft.

Fill out each section to the best of your knowledge, as the more data you provide, the easier it is to protect your accounts. Form 14039 has mail-in and fax submission instructions, and you must often include any compromised tax documents.

You will also receive an official confirmation by mail when the IRS has received your form. An accepted Identity Theft Affidavit starts an investigation by the IRS's Identity Theft Victim Assistance organization. They will work with you to resolve your case, with standard resolution times between 120 and 260 days.

Freeze your credit

Once you inform the IRS, you can also protect other credit or financial accounts by initiating a credit freeze and by placing a fraud alert.

The three major credit bureaus (Equifax, Experian, and TransUnion) will install extra security measures on your credit card accounts when you notify them of potential fraud. Common services include credit freezes, additional verifications for account openings, and account monitoring. Credit bureau fraud alert services often stay in place for a full calendar year.

You can contact one of the three major credit bureaus through the websites or numbers below:

You can also request a free credit report to review your accounts. If you see any suspicious activity, check in with your financial institutions to ensure it is not identity theft.

For more resources about placing fraud alerts, notifying the Federal Trade Commission (FTC), or filing a police report, read our in-depth guide.

Close inactive or exposed accounts

If someone can file a fraudulent tax return, they probably have enough of your personal identity information to commit other crimes. It is smart to close any related accounts that show evidence of tampering.

In particular, disable any new accounts that a fraudster attempts to open. You can explain to any business or institution how someone stole your identity so they can help protect your data and their systems. Most companies will need authorization, so having a copy of your identity theft affidavit can help.

Rapid account closures can prevent further financial information damage if you are a victim of tax-related identity theft. More importantly, it will help businesses and the IRS collect data that builds a case against the criminal.

Pay your taxes

If your tax identity is compromised, be sure to resubmit your tax return. Even if you must do so through a paper return and without the help of a tax preparer, the IRS still expects you to file and pay your taxes for that calendar year. Just make sure you submit a new return after you respond to any IRS notices and have sent in your Identity Theft Affidavit.

Some specific instances will require a delay in your submission, such as issues with your Social Security number. Identity Theft Victim Assistance will ensure that you can still submit a legitimate tax return while your current case is open.

Get specialized assistance

If you completed all the steps listed above and received no further response from the IRS, you may need extra help. This also applies to cases that last longer than the standard resolution time of 260 days. In such cases, call the IRS at 800-908-4490.

You can also contact the FTC's identity theft helpline: 1-877-ID-THEFT (1-877-438-4338)

Get Ahead of Tax Identity Theft: Here’s How

In an ideal world, you never have to experience tax fraud. But identity theft protection is not a game of chance. Here’s what you need to know to combat the recent wave of tax-related scams.

File your taxes on time

The longer you wait to file your taxes, the more time a criminal has to create schemes with your information. Fraudsters know how busy tax season can get, and they are ready to strike unsuspecting victims.

If someone manages to steal your Social Security number, you’ll be playing into their hands with a delayed tax return. While you wait, they have time to file their false return with your data, swooping in to claim your money and leaving you to face the music.

The FTC received over 5.4 million fraud and identity theft reports from consumers in 2023 — with fraud losses hitting a record-breaking $10 billion [*]. There is no denying that tax identity theft is on the rise, so the less time your information is exposed, the better. Once you receive all the necessary tax documents, send in your tax return.  

Obtain an IP PIN

Your Identity Protection PIN (IP PIN) is a six-digit number known only to you and the IRS. Think of it as an additional layer of security in case someone compromises your tax numbers or SSN.

The IP PIN is only valid for a single year and makes tax filing and verification services easier. You can obtain your IP PIN through an online portal, a paper application using Form 15227 (PDF), or in person at your local tax assistance center.

Secure your devices

Anyone with online accounts is susceptible to data breaches and password leaks. Minor adjustments to how you set up your accounts and devices can keep bad actors at bay. Here’s how you can get started:

• Use a password manager to generate and store strong, complex passwords
• Use multi-factor authentication (MFA) when possible (biometrics, security codes, etc.)
• Install a firewall to protect against malware
• Use a Virtual Private Network (VPN) on your devices, especially on public Wi-Fi
• Only provide your information online to secure websites (look for HTTPS security certificates in the URL of a webpage)
• Clean out your computer to remove old data, enable regular updates, and maintain backups
• Do not download suspicious files from unknown websites
• Be cautious with your email, and do not click unfamiliar links from unknown senders

🎯 Related: Fingerprint Identity Theft: How To Keep Your Devices Secure →

Beware of phishing scams

Identity thieves use phishing emails to trick users into giving up passwords and other sensitive information. It is a common ploy that is fast becoming unnerving.

During the 2023 tax season, Aura's Smart Network detected a 2,700% increase in fake tax-related websites [*].

Most online phishing scams share these traits:

• Incorrect links
• Suspicious or unnamed attachments
• Requests for you to download unknown data
• Made-up logos, images, or website addresses posing as reputable sources
• Demands for personal information
• Impersonal greetings or awkward email subjects

Do not enter or click into an email that looks like a scam. Report all fraudulent tax-related solicitations to the IRS at phishing@irs.gov.

Know what the IRS does (and does not do)

In recent years, many victims have fallen prey to sophisticated phone scams targeting taxpayers. Fraudsters impersonate IRS employees — complete with fake names and badge numbers — to coerce victims into paying money  to the IRS through a wire transfer or gift card.

The targets are often immigrants, and the callers threaten arrest or deportation to pressure the victims into making payments. Other variations of the phone scam involve messages that demand the recipient gets in touch.

In an effort to circumvent this, the IRS has taken a rigid stance on how it communicates with taxpayers. Knowing how the IRS operates makes it easier to distinguish between official government correspondence and criminals posing as agents:

• An IRS agent may contact you about money owed, but all payments will only go to the U.S. Treasury
• First contact is always initiated by mail delivered through the U.S. Postal service
• The IRS does not communicate via social media or text messages
• Phone, email, and in-person visits are contact methods. Secondary contact options only occur in specific circumstances after the initial mailed notice
• No immediate payment demands are ever made over the phone or online
• The IRS won't request sensitive information before the initial mailed notice
• Always request at least two forms of identification from an IRS agent at any time

If you receive unsolicited communication from a fraudster, report the call to the Treasury Inspector General for Tax Administration (TIGTA) using their online reporting form, or over email to phishing@irs.gov.

Vet tax professionals with a data security plan

Tax preparer scams are among the twelve most common forms of tax identity fraud listed by the IRS. It is a good idea to investigate each authorized IRS E-File practitioner you hire.

Most tax preparers file returns electronically, so seek out professionals with a high-level data security plan. Legitimate firms take data protection seriously and will not hesitate to show how they defend against fraud. Good data security will include:

• Strong passwords
• Malware and virus protection
• Extended fraud security software
• Secured networks
• Encryption for sensitive files
• Digital reviews of all document submissions
• Robust plans for wiping old data and hard drives
• Limited file access, even with multiple company users

You can use the information in the IRS Publication 4557 (PDF) to create an individual data security plan, which most tax preparers are happy to follow.

Take extra care to protect personal information

Finally, take additional steps to safeguard your sensitive data. Here are some simple yet effective ways to prevent a criminal from accessing your PII:

• Shred all old and unused tax documents  
• Keep your Social Security card in a safe place at home and do not share your number outside of official environments
• Use fraud detection software to actively monitor your information online
• Review all sensitive documents for inconsistencies
• Protect your mail with a PO box, or lock your mailbox when unused
• Allow automatic updates on all your devices
• Do not post sensitive information on social media

For Identity Theft Protection, Look No Further

If you suspect someone has applied for fraudulent tax returns in your name, the IRS recommends that you continue paying your taxes and filing your tax return. But living  a normal life through a harrowing experience like ID theft may not be easy.

A proactive approach is the best way to protect your tax accounts today. When you have comprehensive coverage on your digital identity, you can protect your financial accounts and reduce the likelihood of being defrauded.

Identity Guard is one of the best fraud prevention services to protect you and your family in 2024. Every Identity Guard membership includes advanced security features such as credit monitoring, Dark Web monitoring, and near-real time fraud alerts. Tax fraud is a year-round activity. So is your digital identity protection.

Take action against tax identity theft today with Identity Guard →