Identity Protection PIN (IP PIN)

An Identity Protection PIN is a six-digit number issued by the IRS that acts as a second factor on a federal individual income tax return. The IRS describes it as "a six-digit number that prevents someone else from filing a tax return using your Social Security number (SSN) or individual taxpayer identification number (ITIN)," known only to the taxpayer and the IRS, and used to verify identity on an electronic or paper return. The program is not a discretionary IRS service: section 2005 of the Taxpayer First Act of 2019 directed the Secretary to establish a program to issue such a number "upon the request of any individual" and to make it available nationwide within five years of that Act's enactment on July 1, 2019.

The statute is easy to miss, because it was never codified. Section 2005 of the Taxpayer First Act sits as a note under Internal Revenue Code section 6109 rather than in the body of the Code, so searching title 26 for "identity protection" turns up nothing and it is natural to conclude that the program has no statutory basis. It has one. The note also contains the mechanism by which the program went nationwide: subsection (b)(1) required the Secretary to serve more states each calendar year than the year before, and (b)(2) required availability to any individual residing in the United States not later than five years after enactment. That is why the answer to "am I eligible in my state" is now simply yes, subject to being able to verify your identity.

Two scope limits defeat what a reader is likely to assume. The first is the form list. The IRS states that the IP PIN "is used only on Forms 1040, 1040-NR, 1040-PR, 1040-SR, and 1040-SS," which means it protects the individual income tax return and nothing else. A business return filed under an employer identification number is outside it. The second is delivery. If the IRS enrolled you because you were a confirmed victim of tax-related identity theft, it mails a CP01A notice with the new number each year. If you opted in yourself online, no CP01A is mailed and you have to retrieve the new number from your online account every year. Someone who opts in and then forgets in a later year will have their return rejected on e-filing, or delayed on paper, by their own protection.

Annual regeneration, and the window it lives in. The number is valid for one calendar year and a new one is generated each year for the account. The IRS states the number is generally available to view in the online account from mid-January through mid-November, and that an IP PIN must be used on any federal tax return filed during the year, including a prior-year return filed late. So the PIN you use is the one for the year of filing, not for the tax year of the return.

The three enrollment routes, and why they are not interchangeable. The online route through an IRS online account is the fastest, and the IRS notes that someone under 18 must use an alternative route. Form 15227, Application for an Identity Protection Personal Identification Number, is available to someone who cannot establish an online account, subject to an income ceiling; Form 15227 (revised January 2026) and the IRS's own IP PIN page as it read on August 4, 2026 both set that ceiling at adjusted gross income on the last filed return below $84,000 for individuals or $168,000 for married filing jointly. Those are IRS operational thresholds rather than statutory ones, so they can move without an announcement, and the figures should be checked on the form itself before relying on them. This route delivers the PIN by mail, usually in four to six weeks, and then annually by mail thereafter. The third route is an in-person appointment at a Taxpayer Assistance Center with identification, which the IRS says delivers the PIN in about three weeks and then annually by mail. The routes differ in more than speed: the two offline routes convert you into someone who receives the number by mail each year, which is a materially different arrangement from having to log in and fetch it.

What it does not do. An IP PIN does not stop identity theft. It closes one specific door, the filing of a fraudulent federal individual return in your name, and it does nothing about credit accounts opened in your name, state tax returns, unemployment claims, or the underlying exposure of your personal data. It also does not replace the recovery process for someone whose identity has already been used on a return; that is a separate process with its own form and its own statutory rights. Internal Revenue Code section 7529 links the two, directing the IRS, where it determines that there may have been an unauthorized use of an individual's identity, to "offer identity protection measures to the individual, such as the use of an identity protection personal identification number."

The one instruction that matters more than any other. The IRS states: "Don't reveal your IP PIN to anyone. It should be known only to your tax professional and only when you are ready to sign and submit your return. The IRS will never ask for your IP PIN. Phone calls, emails or texts asking for your IP PIN are scams." That makes it one of the very few pieces of tax information with a bright-line rule attached: a request for it is proof of a fraud attempt, with no legitimate case on the other side.

The lifecycle, once you are in the program.

1. Enroll. Online through an IRS online account, or by Form 15227 if you cannot establish one and meet the income ceiling, or in person at a Taxpayer Assistance Center with identification.
2. Receive the number. Online enrollees see it immediately in the account. The Form 15227 route takes roughly four to six weeks by mail; the in-person route roughly three weeks.
3. Use it on the return. Enter it on the return, whether filed electronically or on paper, for any federal return you file during that calendar year, including a prior-year return.
4. Expect a hard failure if it is wrong. The IRS states that an incorrect or missing IP PIN "will result in the rejection of your e-filed return or a delay of your paper return until it can be verified."
5. Collect the new number next year. A confirmed identity-theft victim receives a CP01A notice by mail. A voluntary online enrollee does not, and must retrieve the new number online, generally between mid-January and mid-November.

A worked sequence rather than a dollar example, because nothing here turns on an amount. Suppose Teo opts in online in June. He receives a PIN valid for that calendar year and uses it on the return he files in October for the prior tax year, because the PIN belongs to the year of filing rather than to the year the return covers. In January the IRS generates a new number for his account. No notice arrives in the mail, because he opted in voluntarily rather than being enrolled as a confirmed victim. If he files in February using the June number, the return is rejected. He signs in, retrieves the current number, and refiles. If instead he waits until December to file, the number may no longer be viewable in the account, since the IRS states the display window generally runs through mid-November.

Pros

• It closes a specific attack outright. A return filed with your Social Security number and without your current PIN is rejected.
• Enrollment is a statutory right rather than a favor. The Taxpayer First Act directs the IRS to issue a number on the request of any individual.
• It is free, available nationwide, and available for a dependent at a parent's or legal guardian's request.
• The rule that the IRS will never ask for it gives a reader one unambiguous test they can apply with no judgment involved.

Cons

• It covers the Forms 1040 family only, so it does nothing for a business return or for identity misuse outside the tax system.
• The number changes annually, and a voluntary enrollee receives no mailed reminder, so forgetting is the most likely failure and it blocks your own filing.
• Getting it wrong is a hard stop: a rejected e-file or a delayed paper return.
• Enrollment requires either an online account, which not everyone can establish, or a route gated by an income ceiling, or an in-person appointment.
• The online display window closes around mid-November, so a very late filer may have to take another route to obtain the number.
• The income ceiling on the Form 15227 route is an IRS operational figure with no statute behind it, so it can change without notice.