The IRS identity protection PIN: how to get one and what to do about tax identity theft

Tax identity theft usually looks like this: someone files a return in your name early in the season, claims a refund, and you find out when your own e-filed return is rejected. The strongest single defense is an identity protection PIN (IP PIN), a six-digit number the IRS issues that only you and the IRS know. Any return filed with your Social Security number has to carry it. This page covers how to get one, how it works each year, the warning signs of identity theft, and what to do if it happens.

What an IP PIN does

An IP PIN prevents anyone else from filing a federal tax return using your Social Security number or individual taxpayer identification number (ITIN). An e-filed return with a wrong or missing IP PIN is rejected, and a paper return is delayed until the IRS can verify it. ¹

It used to be only for confirmed victims. Now anyone with an SSN or ITIN who can verify their identity can opt in, as a precaution, even if they don't have to file a return. Parents and legal guardians can also get one for a dependent. ¹ That matters, because children's numbers are a favorite target: a thief can use them to claim dependent credits.

How to get one

There are three routes, from fastest to slowest. ¹

1. Online. Sign in to your IRS online account at irs.gov, typed in yourself, and request it in the IP PIN section of your profile. If you don't have an account, you'll need to create one and verify your identity first. For a dependent under 18, you have to use one of the other two routes.
2. Form 15227. If you can't verify your identity online and your income is below the limit the IRS sets on its page, you can apply with Form 15227. The IRS calls you to verify your identity, then mails the IP PIN.
3. In person. Make an appointment at a Taxpayer Assistance Center and bring photo ID plus a second form of identification (two forms for a dependent).

The mail routes take weeks, so if you want protection for the coming filing season, start in the fall.

How it works each year

• A new number every year. Each IP PIN is good for one calendar year; a new one is generated for your account each year. ¹
• Online enrollees retrieve it themselves. If you opted in online, you get the new number from your online account each year. The IRS doesn't mail it. ¹
• Victims get it by mail. If the IRS enrolled you after confirmed identity theft, it mails a CP01A notice with the new number each year. ¹
• Use it on every return that year, including any return for an earlier year you file during that calendar year. It goes on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS. ¹

Give it only to the tax professional preparing your return, and only when you're ready to sign. The IRS never asks for your IP PIN by phone, email or text. Any such request is a scam. ¹

If you lose it, retrieve it from your online account or follow the IRS's reissue steps. Don't file another Form 15227 to replace it. ¹

Warning signs of tax identity theft

The IRS lists signs that someone may be using your information: ²

• Your e-filed return is rejected because a return with your number was already filed.
• A Form W-2 or Form 1099 arrives from an employer you never worked for.
• A Form 1099-G reports unemployment benefits you never applied for.
• An IRS notice about income you didn't earn, such as a CP2000.
• An employer identification number you didn't apply for.
• Alerts about password resets, or accounts created in your name, that you didn't start.

Sometimes the first sign is a letter from the IRS asking you to verify your identity, such as Letter 5071C, before it processes a return filed in your name. If you didn't file, say so; if you did, verifying releases your return.

If your identity was stolen

The IRS's own list of steps, in plain terms: ²

1. Stop all contact with the thief. Don't give money or information, and don't click links.
2. Change your IRS online account password to a strong, unique one.
3. Follow the instructions in any IRS letter. If a letter tells you to use the Identity and Tax Return Verification Service, use that, and don't also file Form 14039.
4. Report it through IdentityTheft.gov and follow its recovery plan.
5. Get an IP PIN to protect future returns.
6. Keep filing and paying as usual. If your e-filed return is rejected, file on paper.
7. Keep records of every letter, call and email.
8. Check with your state tax agency, which may have its own steps.

When to file Form 14039

Form 14039, the Identity Theft Affidavit, is for telling the IRS about tax-related identity theft it doesn't already know about. Most people don't need it. Don't file it if the IRS already sent you a letter about the problem, if you already reported through IdentityTheft.gov, or if the theft isn't tax-related. Businesses use Form 14039-B instead. ²

Two common special cases

• A W-2 or 1099 from an unknown employer. Someone may be using your number to work. Don't put that income on your return or amend a return you've already filed; contact the Social Security Administration. ²
• Your dependent was already claimed. It may be a mistake, such as a former spouse claiming the child, or it may be fraud. Check that you're entitled to claim the dependent. If your e-filed return is rejected for the duplicate, the IRS now accepts the e-filed return when the primary taxpayer includes a valid IP PIN; otherwise file on paper and expect a delay. The IRS can't tell you who claimed your dependent. ²