The Internal Revenue Service has issued guidance to taxpayers and tax professionals regarding protections against identity theft.

Why It Matters

Tax-related identity theft occurs when stolen Social Security numbers are used to file fraudulent returns and claim refunds. According to an interim report by the Treasury Inspector General For Tax Administration, 58,276 fraudulent tax returns were identified in the 2025 filing season.

What To Know

The IRS has encouraged the use of Identity Protection PINs (IP PINs), IRS Online Accounts and multi-factor authentication to reduce the risk of tax-related identity theft.

An IRS IP PIN is a unique six-digit code known only to the taxpayer and the IRS, used to prevent tax-related identity theft. Participation is voluntary but encouraged. Each IP PIN is valid for one year, with a new one issued annually.

Only verified taxpayers can obtain an IP PIN, and it should be shared only with the IRS or a trusted tax preparer. The IRS will never request it by phone, email, or text.

The IRS also recommends taxpayers set up an IRS Online Account and tax professionals create a Tax Pro Account. An IRS Online Account offers secure access to personal tax information, helps prevent fraudulent account creation, and allows safe information sharing with a trusted tax professional.

The Tax Pro Account enables professionals to securely manage active client authorizations, submit authorization requests directly to a taxpayer’s online account, and request power of attorney or tax information authorization.

Multi-factor authentication (MFA) is a security process requiring two or more verification methods to confirm a user’s identity. This typically combines something you know (password), something you have (security code or device), and sometimes something you are (fingerprint or facial recognition) to provide stronger protection against unauthorized access.

The IRS says enabling MFA helps protect against “phishing, social engineering and other technology attacks that exploit weak or stolen passwords.”

How To Spot Identity Theft

Most of the time, identity theft is found when you go to file your tax return and discover that a fraudulent return was already sent to the IRS using your details. If this happens, you should visit IdentityTheft.gov and report it using as many details as possible.

Tax-related identity theft cases vary depending on who detects the issue first—you or the IRS.

If the IRS suspects identity theft, its Taxpayer Protection Program will flag the suspicious return and send you a letter explaining the concern. This letter will request that you verify your identity and confirm your tax return details before processing continues.

If you believe you are a victim, you should file a paper tax return if e-filing is not possible. Complete Form 14039, Identity Theft Affidavit, attach it to your paper return, and mail it to the IRS office for your state. Alternatively, you can submit Form 14039 online and mail your paper return separately.