Need to Know Tax › Questions everyone gets asked
Identity theft
IP PINs and tax identity theft
A six-digit number from the IRS that keeps anyone else from filing a return in your name. It costs nothing, takes minutes online, and most people still have not used it. Children’s numbers are the ones thieves want most, and enrolling the children is the step families skip.
Tax identity theft is quiet. Someone files a return with your Social Security number in February, takes the refund, and is gone before you sit down with your own paperwork in March. You almost never find out from the thief. You find out from a rejection: your return is e-filed, and within minutes the IRS sends it back with a code saying a return has already been filed under your number. The second version is just as common: your return is rejected because one of your dependents has already been claimed on somebody else’s return. Sometimes that is a relative who was supposed to ask first. Sometimes it is a stranger who bought the child’s number.
The Identity Protection PIN
An IP PIN is a six-digit number the IRS assigns to you. Any return filed under your Social Security number must then include it, or it is rejected on the spot. The thief does not have your PIN, so the thief’s return bounces instead of yours. The program used to be limited to confirmed victims. Today anyone can opt in, and you can get PINs for your spouse and each dependent. Children’s numbers are prime targets, because no one checks them for years, and enrolling the children is the step most families skip.
| Method | Who it is for | How long |
|---|---|---|
| IRS Online Account at IRS.gov/account | Anyone who can pass the online identity check (photo ID and a phone) | Minutes; the PIN appears on screen |
| Form 15227, by mail or fax | Income under about $84,000 (verify); the IRS calls to verify | Several weeks; mailed, usually for the next season |
| In person at a Taxpayer Assistance Center, by appointment | Anyone else; two forms of ID | A few weeks, by mail |
The online account is the fastest and the only method that lets you look up a lost PIN yourself. The IRS issues a new PIN each January, by mail on notice CP01A or in your online account. Last year’s number will not work, and your preparer cannot e-file without the new one; the IRS will not give it to a preparer. Bring the CP01A notice with your other tax papers. Give it to no one else. The IRS never calls, texts, or emails to ask for your IP PIN. Anyone who does is a thief.
Worked example: the same February, with and without a PIN
| Without an IP PIN | With IP PINs for the family | |
|---|---|---|
| Feb 3: thief e-files using the father’s SSN and claims both children | Accepted; $6,400 refund issued to a prepaid card | Rejected instantly: no valid IP PIN |
| Mar 10: family’s real return e-filed | Rejected: SSN already used; both dependents already claimed | Accepted |
| What the family does next | Files on paper with Form 14039; reports at IdentityTheft.gov; freezes credit; waits | Nothing |
| Refund arrives | Typically 6 to 12 months later, after the IRS case is worked (verify) | About 3 weeks |
| Following years | IRS enrolls the father in the IP PIN program; the children remain exposed unless enrolled too | New PINs each January |
The family’s refund is the same in both columns. The difference is a year of paper filing, letters and a frozen credit file, against fifteen minutes online in December.
IRS letters, and how to tell them from scams
The IRS does sometimes stop a return and ask you to prove you are you. Letter 5071C sends you to an online verification tool; Letter 4883C asks you to call a specific IRS number. Both come by U.S. mail. Respond promptly. If you filed the return, verify it and the refund proceeds, though the IRS says to allow up to nine weeks. If you did not, say so, and the IRS treats it as theft from there.
A scam is a phone call, text, or email claiming to be the IRS, with threats of arrest or a request for your IP PIN or bank login. If it is urgent and it wants a number from you, it is not the IRS. The IRS starts with a letter, does not demand a specific payment method, and never asks for an IP PIN by phone. When in doubt, log into your IRS Online Account: every genuine notice the IRS has sent you is listed there.
If it already happened
A rejected return still has to be filed by the deadline, on paper. File Form 14039, the Identity Theft Affidavit, with it, unless the IRS has already written to you; in that case, answer the letter instead. Once the case is resolved, the IRS enrolls you in the IP PIN program automatically. Then report it at IdentityTheft.gov, which generates a recovery plan and the letters you will need, and freeze your credit at all three bureaus, which is free and takes ten minutes each. A thief with your Social Security number has it forever; the freeze and the PIN are what make it useless.
Behind the scenes
Before a Form 14039 goes on, a preparer checks whether the duplicate is really theft. Often a rejected dependent turns out to be the other parent, a grandparent, or the child filing a first return and claiming themselves by mistake. Those get fixed with an amended return and a phone call, not an affidavit, and the IRS case an affidavit opens is one nobody wants unless they need it. The second check is the IP PIN itself: a return rejected for a wrong PIN is usually last year’s number typed from memory, and the fix is the January letter, or five minutes in the online account.
The Colorado side
Colorado runs its own identity checks and may hold a state refund while it sends a letter asking you to confirm that you filed; answer it through Revenue Online, and the refund proceeds. There is no state IP PIN. A federal identity-theft case usually means a Colorado return filed on paper as well, and the Department of Revenue will want a copy of the federal Form 14039. Colorado letters, like IRS letters, come by mail; a text asking you to verify a Colorado refund is a scam.
What to bring your preparer
- The CP01A notice with this year’s IP PIN, for every person on the return who has one
- If a return was rejected: the rejection code and the date
- Any IRS letter (5071C, 4883C, CP01, or others), unanswered
- If a dependent was claimed elsewhere: who else might have claimed the child, so theft can be ruled in or out
- If theft is confirmed: the IdentityTheft.gov report and any police report
- Government photo ID, which paper-filed identity-theft returns require a copy of
Questions people ask
Is the IP PIN the same as my e-file PIN or last year’s AGI?
No. The e-file signature uses last year’s AGI or a five-digit PIN you choose. The IP PIN is six digits, assigned by the IRS, new every year, and required on the return if you are enrolled.
I lost the letter. What now?
Log into your IRS Online Account and the current PIN is displayed. Without an online account, the IRS can reissue it by mail, which takes weeks; set up the account instead.
Once I opt in, can I opt out?
Yes, through the online account, unless you were enrolled because of confirmed theft. Most people keep it; it costs nothing once the January letter is in the tax folder.
My return was rejected because my son was claimed on another return. Is it theft?
Ask the obvious people first: the other parent, a grandparent, and your son, who may have filed a first return without checking the dependent box. Most duplicates are family. If none of them did it, file on paper with Form 14039 and get the whole family IP PINs.
Should my 8-year-old have an IP PIN?
Yes. A child’s number is the most valuable one a thief can buy, because nobody checks it for a decade. A parent enrolls a dependent through the parent’s online account.
Enroll everyone on the return, and keep the January letter
An IP PIN for you, your spouse and each dependent closes the door the thief uses. The IRS mails a new one every January; it goes in the tax folder, and it goes to nobody who calls, texts or emails asking for it.