Someone filed a tax return in your name
Most people find out one of two ways. You try to e-file and the return bounces back rejected, because the IRS already has a return on file for your Social Security number. Or a letter arrives asking you to verify your identity for a return you never sent, or telling you that you owe tax on wages from an employer you have never worked for. Either way, somebody used your Social Security number to file, and if there was a refund, they collected it.
This is one of the more fixable kinds of identity theft, and the IRS has a dedicated process for it. The catch is that the process is slow, so the useful thing is to start it properly rather than quickly. Here is the order that works.
First, work out which situation you are in
If your return was rejected as a duplicate, or you got a notice about a return you did not file, that is tax-related identity theft and the steps below apply. If instead you received a letter asking you to verify your identity before the IRS will process a return, the fraudulent filing may have been caught in advance, and following the verification instructions in that letter is all you need to do. And if the notice says you owe tax on income from an employer you have never heard of, someone is working under your Social Security number, which is a related but separate problem worth flagging to the IRS in the same report.
One thing to be careful about: only respond to a letter that arrived by mail, using contact details you look up yourself on IRS.gov. The IRS does not open these conversations by phone, text, or email, and scammers follow tax-fraud victims closely. Our post on the IRS back taxes call covers what that follow-up sounds like.
Report it with Form 14039
Form 14039, the Identity Theft Affidavit, is how you tell the IRS that a return filed under your number was not yours. The IRS now prefers you submit it online through its digital form portal, which is faster and gives you a confirmation; fax and mail remain available if you would rather not file online. Filing it does two things at once: it reports the theft and it opens a case with the unit that untangles your account.
Fill it in for the tax year affected, and keep your own copy along with the confirmation. If your legitimate return still needs to be filed, print it on paper, attach Form 14039 to the back of it, and mail both together to the IRS address for the state you live in. Do not keep retrying the electronic filing; it will keep rejecting, and paper is the intended route once a fraudulent return is sitting in the system.
It is also worth filing a report at IdentityTheft.gov, the FTC’s site, which generates a recovery plan and an identity theft report you can use with banks and credit bureaus. And if your state has an income tax, report it to that state’s revenue department separately, because a federal report does not reach them.
Expect it to take a while, and plan around that
This is the part nobody warns people about. Untangling a tax identity theft case has recently averaged well over a year at the IRS, and a refund you are owed can be held up for the duration. It is not a sign that your report went into a void. It is the queue.
So plan for the wait rather than fighting it. Keep every letter in one folder in date order. Note the date you filed the affidavit and the confirmation number. If you get no movement and the delay is causing real financial hardship, the Taxpayer Advocate Service is an independent office inside the IRS that exists for exactly this, and it is free. Your congressional representative’s casework office can also nudge a stalled IRS case, which surprises people but works more often than you would expect.
Get an IP PIN so it cannot happen again
An Identity Protection PIN is a six-digit number that must appear on your return for the IRS to accept it. Confirmed identity theft victims are enrolled automatically and issued a new one each year, but the program is now open to anyone who wants it, and it is the single most effective thing you can do to stop a repeat. If you have been hit once, your details are on a list somewhere, and next filing season is a predictable date.
Set up your IRS online account and request the PIN there. Write down where you keep it, because a lost IP PIN means another paper return.
Assume the Social Security number is out, and act accordingly
Someone had your name, date of birth, and Social Security number. Tax fraud is rarely the only thing done with that combination, so treat this as a signal to check the rest. Freeze your credit at all three bureaus, which is free and stops new accounts being opened in your name, and look at whether anything has already been opened, which our guide on accounts opened in your name walks through. If the details most likely came from a company that lost them, our post on data breach notification letters covers what the exposure usually means in practice.
Also check your Social Security earnings record at ssa.gov once a year. If someone is working under your number, that record is where it shows up, and catching it early keeps it from affecting your benefits later.
What this is, and what it isn’t
A stolen refund is not a debt you have to pay and not a mark against you. The IRS treats it as fraud committed against you, and the process, slow as it is, is designed to put your account back the way it should be. Your job is to file the affidavit, file your real return on paper, get an IP PIN before the next season, and lock down the credit side. Then it becomes waiting rather than worrying, which is a much easier thing to carry.
— Gus