Tax Identity Theft

Tax identity theft, which the IRS more often calls tax-related identity theft, is the unauthorized use of someone's identifying information within the tax system. It takes two main forms. In refund-related theft, someone files a federal or state return using your Social Security number or ITIN and directs the refund to themselves, which usually surfaces when your own return is rejected as a duplicate. In employment-related theft, someone uses your Social Security number to get a job, and the income reported under your number appears on your account as unreported income. Internal Revenue Code section 7529(b) treats the second as part of the same subject, providing that unauthorized use of an identity "includes the unauthorized use of the identity of the individual to obtain employment."

Why a tax return is such a valuable target. A single return carries a Social Security number, a current address, filing status, employer information, the names and identifying numbers of dependents, and often bank account details. That concentration is what makes tax identity theft different in kind from a single compromised card: one successful theft supplies material for years of further fraud, and the victim usually cannot tell which of those elements was taken.

The warning signs, with the caution the IRS attaches to them. The IRS's guide for individuals lists unusual activity on tax and Social Security accounts, including: a tax return rejected; a Form W-2 or Form 1099 from an employer you did not work for; a Form 1099-G for unemployment benefits you did not receive or apply for; an employer identification number you did not apply for; an unreported income alert such as a CP2000 series notice; someone offering to "help" with your online account; accounts created or accessed that you did not create or access; alerts about password resets or log-in verifications; a data breach that leaked your information; and a Social Security account showing wages you did not earn or expect. The guide then says, in terms: "These don't always mean you've been affected by identity theft, but still be cautious." That sentence matters. A rejected return has ordinary explanations, and a mismatched information return is often an employer's error rather than a theft. The list is a prompt to check, not a diagnosis. The guide also notes that the target could be you, your children, other dependents, or a nonfiler.

The statutory rights, which are the least-known part of the subject. The Taxpayer First Act of 2019 created two. Section 2006 directed the Secretary to establish and implement procedures ensuring that "any taxpayer whose return has been delayed or otherwise adversely affected due to tax-related identity theft has a single point of contact at the Internal Revenue Service throughout the processing of the taxpayer's case," and that this contact "shall track the taxpayer's case to completion and coordinate with other Internal Revenue Service employees to resolve case issues as quickly as possible." The statute describes that contact as a team or subset of specially trained employees who can work across functions and who are accountable for the case until resolution. Section 7529, now in the Code, requires the IRS, where it determines there has been or may have been an unauthorized use of an individual's identity, and without jeopardizing an investigation, to notify the individual, explain how to file a report with law enforcement, identify steps to let law enforcement access personal information during the investigation, provide information on actions the individual may take to protect themselves, and "offer identity protection measures to the individual, such as the use of an identity protection personal identification number." Section 7529(a)(2) then requires follow-up notifications about whether an investigation was opened, whether it substantiated the unauthorized use, and whether any action or criminal referral followed.

Section 7529(b) is the provision that reaches the employment variety, and it explains a notice that otherwise looks like a mistake. It requires the IRS, in deciding whether an identity may have been used to obtain employment, to review wage statements under section 6051, information returns for non-employee compensation, and information the Social Security Administration provides about wage statements, looking for cases where the Social Security number on the statement does not correspond with the name on it or with the name on the return reporting that income. So an unreported income notice for wages you never earned is not simply an IRS error; it is the visible end of a matching process the statute requires. The IRS's instruction for this variety is specific and cuts against the instinct: where a Form W-2 or Form 1099 arrives from an employer the taxpayer has never worked for, the guide says not to put that income on the return and not to amend a return already filed, and to contact the Social Security Administration. The same route applies where a Social Security account shows more income than the taxpayer earned or expected.

Form 14039 and the one instruction people miss. Form 14039, Identity Theft Affidavit, revision February 2026, is the form a victim files to report the theft to the IRS. Its own instructions say it is for victims of identity theft, that the IRS process for assisting victims is explained at IRS.gov/victimassistance, and, importantly, "To avoid delays do not use this form if you have already filed a Form 14039 for this incident." Filing a second affidavit out of anxiety slows the case down. The form can also be completed online rather than on paper.

What the IRS asks a victim to do, and the one item that surprises people. The guide's list of immediate steps includes stopping all interaction with the thief, updating the online account password, following the instructions in any IRS letter or notice, reporting the identity theft, following the recovery steps at IdentityTheft.gov, obtaining an identity protection PIN, keeping records of letters, calls and emails, and checking with the state tax agency for further steps. Among them sits an instruction that reads oddly to someone whose return has just been rejected: "File returns and pay tax as usual." A fraudulent filing in your name does not suspend your own obligations, and a return that cannot be filed electronically can be filed on paper.

On how long it takes. Resolution can run for many months, and the honest answer is that no reliable current figure should be quoted, because published case-resolution times in this area have moved materially over the years. The statutory single point of contact exists precisely because these cases cross several IRS functions, and it is the accountable route for a case that appears to have stalled.

The path a refund-related case follows, from the victim's side.

1. Discovery. Usually a rejected e-file, an unexpected notice, or a refund that never arrives.
2. Report it to the IRS. File Form 14039, Identity Theft Affidavit, on paper or online, unless the IRS has written to you and given a different instruction, in which case follow the letter. Do not file a second affidavit for the same incident.
3. File your own return anyway. The IRS's instruction is to file returns and pay tax as usual. If electronic filing is blocked by the fraudulent return, the return goes in on paper.
4. Work the broader recovery in parallel. IdentityTheft.gov is the federal recovery route for the non-tax consequences, and your state tax agency has its own process.
5. Close the door on repeat filings. An identity protection PIN prevents a further return being filed under your number without it, and section 7529(a)(1)(E) makes offering it part of what the IRS is required to do.
6. Track the case. Keep records of every letter, call and email. Where a case has been delayed or adversely affected, the Taxpayer First Act's single point of contact is the accountable route.

A worked sequence rather than a dollar example, since nothing here turns on an amount. Priya e-files in February and the return is rejected as a duplicate. She prints and mails the same return, files Form 14039, and starts a log. In April a CP2000 series notice arrives proposing additional tax on wages reported under her number by an employer she has never worked for, which is the employment-related variety and is within section 7529(b)'s matching duty. She responds to the notice on its own terms, contacts the Social Security Administration as the IRS's guidance directs for wages reported by an employer she never worked for, and does not file a second affidavit, because the incident is already reported. She obtains an identity protection PIN so that the following January's filing cannot be pre-empted again. The refund she was owed arrives when the case is resolved, and her obligation to file and pay on time was never suspended by any of it.

What the law gives a victim

• A statutory right to notification and follow-up under Internal Revenue Code section 7529, including whether an investigation was opened and whether it substantiated the theft.
• A single point of contact at the IRS, required by the Taxpayer First Act, who tracks the case to completion rather than handing it between functions.
• A statutory duty on the IRS to offer identity protection measures, naming the identity protection PIN specifically.
• A matching duty that reaches employment-related theft, which is how a victim learns about wages reported under their number at all.

Where a victim is still exposed

• The theft is usually discovered by its consequences, months after the data was taken, and often through a rejected filing rather than a warning.
• Your own filing and payment obligations continue unchanged while the case is open.
• A refund you are owed is delayed until the case is resolved, and resolution can take many months.
• The tax case is only part of the problem: the same data supports credit, unemployment and benefits fraud, each with its own separate recovery process.
• State tax agencies run their own processes, so a federal resolution does not resolve a state filing.
• Dependents and children are targets too, and nobody checks a child's tax account until something goes wrong.