Tax identity theft occurs when someone uses your Social Security number or personal information to file a false tax return in your name, usually to claim a refund that gets sent to them instead of you.

The theft typically happens in one of two ways. A criminal either steals your Social Security number, name, and date of birth from a data breach, phishing email, or physical document, then files a return before you do. Or they intercept mail containing tax documents, W-2 forms, or refund checks. The IRS processes returns in the order they arrive, so the first return filed — real or fake — is usually the one that gets paid.

You often don't discover the theft until you try to file your own return and the IRS rejects it because a return has already been filed under your number. By then the refund has been sent, and you're left proving the return wasn't yours while the IRS investigates.

Key Takeaways

  • Tax identity theft most often starts with a stolen Social Security number, which a criminal uses to file a false return and claim your refund.
  • The IRS processes returns in the order received, so a fraudulent return filed before yours can be accepted and paid before you file.
  • You typically discover the theft when you file your own return and the IRS tells you one has already been filed under your number.
  • Thieves target your information through data breaches at retailers or employers, phishing emails that look like legitimate tax or bank messages, and stolen mail containing W-2s or tax documents.
  • The IRS has a process to report and correct tax identity theft, but resolution can take months and requires documentation proving the return wasn't yours.

Where Thieves Get Your Social Security Number and Tax Information

Your Social Security number is the key to tax identity theft because it's the unique identifier the IRS uses to match you to your return. Thieves obtain it through several common routes. Data breaches at large retailers, healthcare providers, or employers expose millions of Social Security numbers at once. A 2023 breach at a major health insurer, for example, exposed Social Security numbers for millions of people who had no idea until months later.

Phishing emails are another frequent source. A criminal sends an email that looks like it's from your bank, the IRS, or your employer's payroll system, asking you to "verify your information" or "confirm your account." The link goes to a fake website that captures whatever you type. Tax season sees a spike in phishing because people expect tax-related emails and are less suspicious.

Thieves also steal mail directly from your mailbox or a postal collection box. W-2 forms, 1099s, and refund checks are all valuable because they contain your name, address, Social Security number, and sometimes employer information — everything needed to file a return.

How a Criminal Files a Return in Your Name

Once a thief has your Social Security number and basic information, filing a false return is straightforward. They use tax software or work with a tax preparer (sometimes unknowingly, sometimes as part of a criminal operation) to file electronically. The return claims a large refund, often inflated by false deductions, business expenses, or education credits that don't belong to you.

The IRS has automated systems that check for obvious fraud, but they don't catch every false return. The agency processes returns in the order they're received, and electronic returns are processed faster than paper ones. A return filed in early February can be approved and a refund issued by late February, before you've even thought about filing your own return.

Some criminals file multiple false returns under the same Social Security number in different names, or file returns claiming refunds for multiple years at once. The goal is always the same: get the refund deposited into a bank account they control, usually one opened with stolen identity information or a prepaid card that can't be traced.

What Happens When You Discover the Theft

Most people discover tax identity theft when they file their own return and receive an error message from the IRS saying a return has already been filed under their Social Security number. This can happen whether you file electronically or on paper. The IRS will reject your return and send you a notice explaining the situation.

At this point, you have not lost money yet — the thief has — but you now have to prove the other return wasn't yours. The IRS will ask you to complete Form 14039, Identity Theft Affidavit, and provide documentation supporting your claim. This might include your actual W-2s, pay stubs, receipts for deductions you claimed, or anything else showing what your real tax situation was.

The investigation process can take several months. During that time, you cannot file your own return or receive your refund. The IRS freezes the account while it investigates, and you may be assigned an IRS representative to work with. Once the IRS confirms the return was fraudulent, they will process your legitimate return and issue your refund, but the delay means you may not receive money you were expecting until late spring or summer.

How Tax Identity Theft Affects Your Credit and Future Returns

Tax identity theft doesn't directly damage your credit score the way credit card fraud does, because it doesn't involve borrowing money in your name. However, it can have ripple effects. If the thief used your Social Security number to open bank accounts or explore for credit cards as part of a broader identity theft scheme, your credit will be affected.

More when ready, tax identity theft creates a permanent flag on your IRS account. Once you've reported it, the IRS adds a Identity Theft Indicator to your file. This means future returns will be reviewed more carefully and may take longer to process. You may also be required to file on paper rather than electronically, or to provide additional documentation with every return you file going forward.

Some people who've experienced tax identity theft are issued an Identity Protection PIN by the IRS. This is a six-digit number only you know, and you must include it on your return each year. Without the correct PIN, the IRS will reject the return, which protects you from future fraud but also means you cannot file without it.

Steps to Take If You Suspect Tax Identity Theft

If the IRS rejects your return because one has already been filed, contact the IRS Identity Theft Hotline at 1-800-908-4490. Have your Social Security number, date of birth, and filing status ready. The IRS will confirm whether a return was filed and begin the investigation process.

File Form 14039 with the IRS as soon as possible. You can file it electronically through the IRS website, mail it, or fax it. Include copies of documents that prove your identity and your actual tax situation — your real W-2s, pay stubs, receipts, and anything else showing what you actually earned and owed.

Report the theft to the Federal Trade Commission at IdentityTheft.gov. This creates an official record and generates a recovery plan specific to your situation. You should also place a fraud alert with the three major credit bureaus (Equifax, Experian, and TransUnion) and consider freezing your credit to prevent the thief from opening accounts in your name.

File a police report if possible, though many local police departments will not take a report for tax fraud alone. However, having a police report number strengthens your case with the IRS and credit bureaus.

Prevention: Reducing Your Risk

You cannot eliminate the risk of tax identity theft — data breaches happen to companies you don't control — but you can reduce it. Protect your Social Security number by not carrying your card in your wallet, not writing it on checks, and not providing it unless absolutely necessary. Many doctors' offices and employers will accept other identifiers.

Be skeptical of unsolicited emails and calls claiming to be from the IRS, your bank, or your employer. The IRS does not initiate contact by email or text. If you receive a suspicious message, do not click any links. Instead, go directly to the official website or call the organization's main number (not a number in the email).

Monitor your mail. If you're expecting a W-2 or tax refund and don't receive it within the normal timeframe, contact your employer or the IRS. File your return early in the tax season, before a thief has a chance to file first. The earlier you file, the more likely your legitimate return will be processed before a fraudulent one.

Consider filing on paper if you have a history of identity theft or live in an area with high rates of tax fraud. Paper returns take longer to process, but they also take longer for criminals to file because they require more steps.

Frequently Asked Questions

Can I file my tax return if someone has already filed one under my Social Security number?

No, the IRS will reject your return until the fraudulent one is resolved. You must report the theft and complete Form 14039 so the IRS can investigate and remove the false return from their system. Once that's done, you can file your legitimate return.

How long does it take the IRS to resolve tax identity theft?

The investigation typically takes 60 to 120 days, though complex cases can take longer. During this time, you cannot file your return or receive a refund. Once resolved, processing your legitimate return may take an additional 4 to 6 weeks, so total time from discovery to refund can be 4 to 6 months.

Will I have to pay taxes on the refund the thief received?

No. The refund the thief received was fraudulently obtained and is not your income. The IRS will pursue the thief for repayment, but you are not liable for it. Your tax liability is based only on your actual income and deductions.

What if I discover the theft after I've already filed my return?

Contact the IRS when ready. If your return was processed before the fraudulent one, you may have already received your refund and the issue is resolved. If the fraudulent return was processed first, the IRS will work with you to correct the record. Either way, report it to prevent future fraud.

Do I need to freeze my credit if I've had tax identity theft?

A credit freeze is not required but is often recommended. Tax identity theft sometimes occurs alongside broader identity theft involving credit cards or loans. A credit freeze prevents anyone, including you, from opening new accounts in your name without unfreezing first, which adds a layer of protection.