Tax Identity Fraud: How Refund Fraud Works and How to Protect Your Tax Return
Tax identity fraud happens when criminals file a fake tax return using your Social Security number and claim your refund before you file. The IRS identified over $10 billion in fraudulent refund attempts in 2024.
Tax-related identity theft is one of the most common forms of identity fraud reported to the FTC. Criminals obtain your Social Security number through data breaches, phishing attacks, or stolen documents, then file a fraudulent tax return early in the tax season, claiming a refund before you file your legitimate return. They use fabricated W-2 information showing inflated income and generous withholding to maximize the refund, often depositing the fraudulent refund onto a pre-paid debit card or into a temporary bank account. The IRS may issue the refund before detecting the fraud if the return looks legitimate.
The victim discovers the fraud when they try to e-file their legitimate return and it is rejected because a return with their SSN has already been filed. This typically happens early in tax season, but some victims do not discover the fraud until they receive an IRS notice about a return they did not file, or when the IRS sends a letter questioning a suspicious return. Resolving tax identity fraud can take months — the victim must file a paper return, complete IRS Form 14039 (Identity Theft Affidavit), and work with the IRS Identity Protection Specialized Unit. The process often delays legitimate refunds by six months or more.
How to Prevent Tax Identity Fraud
File your tax return as early as possible — the earliest legitimate filers make it harder for fraudsters to beat you to the IRS. Use the IRS Identity Protection PIN (IP PIN) program — this six-digit number is required to file your tax return electronically or on paper, preventing anyone else from filing in your name. Once you opt in, you receive a new IP PIN each year. Be extremely cautious about phishing emails that appear to be from the IRS — the IRS does not initiate contact by email, text, or social media. Protect your SSN by storing it securely and sharing it only when absolutely necessary. Monitor your credit reports for signs of broader identity theft. If you receive an IRS notice about a suspicious return or if your e-file is rejected as a duplicate, contact the IRS immediately.
What to Do If You Are a Victim
If the IRS rejects your e-file because a return with your SSN was already filed, immediately complete IRS Form 14039 and mail it with your paper tax return. Call the IRS Identity Protection Specialized Unit at 800-908-4490. Respond to any IRS notices promptly. Continue to pay any taxes you owe — identity theft does not relieve you of your tax obligations. Close any financial accounts that may have been compromised. Place a fraud alert on your credit reports and monitor them for 12-24 months following the incident. If you suspect a broader identity compromise, also report to the FTC. The IRS will assign you an Identity Protection PIN for future tax filings, making it much harder for fraud to recur.
FAQs
How does the IRS detect fraudulent tax returns?
The IRS uses sophisticated algorithms to detect anomalies including suspicious income levels, unusual withholding amounts, mismatched employer information, and duplicate filings. In 2024, the IRS prevented over $10 billion in fraudulent refunds, but criminals continue to evolve their tactics.
What is an Identity Protection PIN (IP PIN)?
An IP PIN is a six-digit number that prevents anyone from filing a tax return using your SSN. You receive a new PIN each year. Opting in requires identity verification, but it is the most effective protection against tax identity fraud. Get yours at irs.gov/ippin.
Can a child be a victim of tax identity fraud?
Yes. Children's SSNs are frequently targeted because the fraud may go undetected for years. A child's SSN can be used to claim them as a dependent on a false return or to claim tax credits. File a tax return for your child to report their identity theft to the IRS.