The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If someone used your identity for a tax filing, act in this order: stop the scam and secure exposed financial accounts, lock down your IRS Individual Online Account, obtain an annual six-digit Identity Protection PIN (IP PIN), follow the instructions for the fraudulent return or IRS notice you received, and monitor your refund. Use only the form and submission route that matches your situation; sending duplicate affidavits can delay the case.
1. Stop the exposure before dealing with the tax return
Identity theft often starts with a phishing email, phone call, text message, fake tax-preparation offer or compromised account. Do not continue the conversation, click additional links, send money or disclose another password, Social Security number, Individual Taxpayer Identification Number (ITIN), bank detail or authentication code. Save the messages, phone numbers, email headers and transaction records as evidence.
As an Amazon Associate I earn from qualifying purchases.
When money or banking information was involved
- Call the bank, card issuer, payment service or investment firm using the number on its official statement or card. Ask it to stop or reverse unauthorized transactions and to secure the account.
- Change the affected account password from a device you trust. Change any other account that reused that password.
- Ask the institution whether it should close the exposed account, issue new numbers or add a fraud alert. Follow its written dispute deadlines.
Use the federal recovery path for non-tax identity theft
The IRS directs scam victims to IdentityTheft.gov for broader recovery steps. That process covers identity exposure that extends beyond tax records, such as fraudulent credit, utility or bank accounts. Tax remedies do not replace those steps.
2. Secure your IRS Individual Online Account
The IRS Individual Online Account is the central place to inspect tax activity after an identity-theft event. The IRS announcement dated February 3, 2026 says a verified account can display tax information and transcripts, show refund status, and provide access to request or retrieve an IP PIN. The account also uses multifactor authentication.
#1 Best Overall
Create or sign in to the account
- Use the IRS Individual Online Account sign-in page and complete the IRS identity-verification process. If you cannot verify your identity, do not create a second account with altered information; use one of the alternative IP PIN routes described below and follow the IRS victim-assistance instructions.
- Review the account for returns, notices, payment activity, transcripts and contact information that you do not recognize. Download or print records showing the suspicious filing or refund destination.
- Check refund status inside the account rather than relying on an unsolicited message or a caller who claims to be from the IRS.
- Request or retrieve the current IP PIN from the account when the option is available.
Keep the login under your control
The IRS Tax Tip published February 26, 2026 advises that the account holder should be the only person logging in and should not share login information. A tax professional can prepare or discuss a return through authorized procedures, but you should not hand over your IRS username, password, authentication code or device. Use a unique password, protect the email account used for recovery and do not approve an authentication prompt you did not initiate.
3. Get an Identity Protection PIN
An IP PIN is a six-digit number known to you and the IRS. It helps verify you when a federal return is filed and helps prevent someone from misusing your SSN or ITIN. The IRS issues a new PIN every year, so a number from a prior filing season will not protect the next return.
Choose the route that fits your access
| Route | When it fits | What to know |
|---|---|---|
| IRS Individual Online Account | You can create or access a verified account. | The IRS identifies this as the fastest route. Request or retrieve the current-year PIN in the account after identity verification. |
| Form 15227 | You cannot access or create an online account but meet the IRS eligibility conditions. | The current IRS FAQ lists income limits of $84,000 for an individual and $168,000 for married filing jointly, updated January 8, 2026. Verify the limits and all other conditions before applying because they can change. |
| Taxpayer Assistance Center | You cannot use the online route or Form 15227. | Arrange an appointment and bring the identity documents the IRS requires. The center must be able to complete its identity-verification process before issuing access. |
Use the current IRS IP PIN frequently asked questions for the application rules, accepted verification documents and any updated income thresholds. Do not assume that a past eligibility decision or an old form version still applies.
When to use the PIN
Enter the current six-digit PIN wherever the return software or preparer asks for the taxpayer’s IP PIN. Keep it private. If you file a joint return, each person who has an IP PIN must use that person’s current number. A missing or incorrect PIN can cause an electronic return to be rejected; follow the IRS correction instructions rather than creating another account or requesting multiple numbers.
4. Report the fraudulent return correctly
The correct response depends on what happened: a return was filed in your name, your valid return was rejected, your information was exposed but no tax return is known, or the IRS sent a notice with its own instructions. These situations are related but they do not use one universal form.
| Situation | Primary action | Important distinction |
|---|---|---|
| A return was filed in your name without permission | Follow the IRS identity-theft victim-assistance guidance and the current Form 14039 instructions. | Submit the affidavit through the route specified for your case and keep proof of delivery. |
| Your legitimate e-filed return was rejected because a return already used your SSN or ITIN | File a paper return and follow the identity-theft instructions for including or separately sending Form 14039. | An e-file rejection does not mean you should abandon the valid return. |
| Your information was exposed but no fraudulent tax return is confirmed | Secure the IRS account, obtain an IP PIN if eligible, and use IdentityTheft.gov for broader recovery. | Do not submit an affidavit merely because you received a suspicious message; match the filing to an actual IRS identity-theft event. |
| You received a specific IRS notice | Read every page and follow that notice’s response address, deadline and document list. | A notice-specific process can differ from the general victim-assistance process. |
Form 14039: file once for the incident
Form 14039 is the IRS Identity Theft Affidavit. Use the current revision and complete the explanation accurately: identify the taxpayer, describe the suspected misuse and answer whether a return was filed without authorization. The February 2026 instructions warn: To avoid delays do not use this form if you have already filed a Form 14039 for this incident.
A duplicate submission can send the case into additional handling and delay resolution.
Keep a copy of the signed form, the return, attachments and delivery confirmation. If the IRS victim-assistance instructions tell you to submit Form 14039 with a paper return, follow that sequence. If they tell you to send it separately, use the address or method printed in the current instructions rather than an address found in an old article.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf your e-file was rejected
Prepare the return that you actually owe, print and sign it, and mail it as the IRS victim-assistance guidance directs. Include the required identity-theft documentation. Keep the postal tracking record and a complete copy. Do not alter income, withholding or filing status to make the return pass electronically, and do not submit a second electronic return after the IRS has rejected it for a duplicate SSN or ITIN.
5. Respond to a refund hold or CP53B notice
A refund can be held while the IRS verifies who filed the return. Open the notice in your IRS account or use the contact details printed on the mailed notice, then read all pages before responding. The notice controls the deadline, documents and delivery method.
CP53B: you did not file the return
IRS CP53B guidance says that a person who did not file the return should submit Form 14039. Complete the form for the specific return and follow the notice’s submission instructions. If you did file the return, answer the notice as instructed instead of automatically claiming that it was fraudulent.
Track the refund without creating a second claim
Use the IRS Individual Online Account to check refund status and retain screenshots or downloaded notices for your records. A status message can change while the identity review is pending. The IRS materials do not promise one universal resolution date, so be wary of anyone offering to release the refund immediately for a fee or asking for a second affidavit.
6. Protect the rest of your identity
Tax-return theft may be one part of a larger compromise. After securing the IRS account, work through the other accounts and records that could have been exposed.
- Place fraud alerts or freezes with the credit-reporting agencies if your credit information was exposed, and review reports for accounts or inquiries you did not authorize.
- Contact health, employment, student-loan, brokerage and utility providers if the stolen information could be used with them.
- Replace a compromised driver’s license, passport or other government credential through the issuing agency.
- Tell your mobile carrier if a phone number or SIM could have been taken over; secure the carrier account with a new account PIN.
- Preserve police, bank and service-provider case numbers. They can help establish the timeline if another agency asks for proof.
IdentityTheft.gov is the IRS-recommended starting point for these non-tax actions. The IRS does not require a paid identity-monitoring subscription, password manager or security device to use its remedies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. A practical sequence for the first days and filing season
First 24 hours
- Stop contact with the scammer and secure any bank, payment or email account involved.
- Change reused passwords and revoke unfamiliar sessions or connected applications.
- Sign in to the IRS Individual Online Account if you can complete verification; save unfamiliar return and transcript information.
- Read any IRS notice in full and note its deadline.
Within the next few days
- Request the annual IP PIN through the online account, or check whether Form 15227 or a Taxpayer Assistance Center appointment is the appropriate alternative.
- Determine whether a fraudulent return was actually filed. Distinguish that from a phishing attempt or general exposure.
- Complete Form 14039 only when the IRS instructions call for it, and do not file it again for the same incident.
- Start the broader IdentityTheft.gov recovery steps and notify financial institutions as needed.
Before submitting your next return
- Retrieve the current year’s IP PIN; do not rely on last year’s number.
- Check that your name, address, dependents, withholding and bank details are correct.
- Use a reputable filing channel and keep a PDF or paper copy of the signed return and confirmation.
- Monitor the IRS account for notices and refund-status changes after filing.
8. Troubleshooting common problems
| Problem | What to do | What to avoid |
|---|---|---|
| You cannot pass online identity verification. | Use the current IP PIN FAQ to check Form 15227 eligibility or arrange a Taxpayer Assistance Center appointment. Continue securing your other accounts. | Do not open repeated accounts with different personal details. |
| Your return is rejected as a duplicate. | Print and mail the valid return and follow the victim-assistance instructions for Form 14039. | Do not change factual tax data or repeatedly retransmit the same return. |
| You already sent Form 14039. | Keep the confirmation and respond to later IRS correspondence using the existing case information. | Do not send another affidavit for the same incident unless the IRS specifically directs you to do so. |
| A caller asks for your IP PIN or login code. | End the call and use an official IRS contact route or the notice’s instructions. | Never disclose sign-in credentials, one-time codes or the IP PIN to an unsolicited caller. |
| Refund status has not changed. | Check the account and notice instructions, and keep records of every response. | Do not pay a third party that guarantees a release date; the IRS provides no universal timeline. |
9. Records that make recovery easier
Create one secure folder, digital or paper, containing the fraudulent-return details, IRS notices, Form 14039 copy, IP PIN correspondence, account and bank case numbers, postal receipts and a dated log of calls. Record the representative’s name or identification number when available and summarize what was requested. Store the folder separately from the compromised email account and protect it with a strong, unique password.
When mailing tax documents, use the delivery method specified by the IRS instructions and retain the tracking record. Send only the documents requested; extra copies of identification or unrelated financial records increase exposure without improving the case.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
10. What the IRS process can and cannot tell you
The IRS can mark a resolved tax account with an identity-theft indicator to help protect it in the future. That indicator does not repair unrelated credit, banking or government-account fraud, so complete the broader recovery steps separately. An IP PIN reduces the risk of another fraudulent federal filing, but it does not stop every form of identity theft and it does not replace careful review of notices and transcripts.
Account features, form revisions, IP PIN access rules, income thresholds, notice instructions and processing procedures can change. The sources cited here reflect IRS materials available in 2026, including the IP PIN FAQ update of January 8, 2026, the February 3, 2026 online-account announcement, the February 26, 2026 security tax tip and Form 14039 Revision February 2026. Before sending anything, use the current IRS page and the exact instructions printed on your notice or form.
Quick Recap
Final checklist
- Scam stopped; bank, payment and email accounts secured.
- IRS Individual Online Account verified and reviewed.
- Current annual IP PIN obtained through an eligible route.
- Fraudulent return, rejected valid return or notice correctly identified.
- Form 14039 filed only when required, with no duplicate for the same incident.
- Refund status monitored through the IRS account.
- IdentityTheft.gov and other affected institutions contacted for non-tax recovery.
- Copies, deadlines and delivery confirmations preserved.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
