Skip to main content
Log in Sign up
Help center Log in Sign up for free

How Do I File an IRS Identity Theft Report?

Reviewed by Ann Mahafy-Bickley, EA; JD October 2026

Short answer

If someone used your Social Security number (SSN) on a tax return or other tax document, report it to the IRS using the Identity Theft Affidavit, Form 14039. However, most people don’t need to file the affidavit. For instance, if you received an IRS letter about the problem or already reported it through IdentityTheft.gov. Once the IRS confirms the theft, it issues you a PIN that protects your future returns.

See details

Signs Someone Filed a Return in Your Name

A letter from the IRS is often the first warning sign. Watch for these red flags:

  • You e-file (submit your return online) and the IRS rejects it.
  • You get a W-2 or 1099 (forms that report your pay) from an employer you never worked for.
  • You get a 1099-G for unemployment benefits you never applied for.
  • You receive an employer ID number you didn’t request.
  • You get a CP2000 notice about income you supposedly didn’t report.
  • Social Security account shows wages you didn’t earn or expect

If wages from an unknown employer show up, leave them off your return and don’t amend (correct) a past return. Contact the Social Security Administration and report the unknown employer.

To verify your identity and confirm the IRS has your return, call 800-908-4490. That line can’t give you your refund status.

When to File Form 14039 vs. When to Skip It

Form 14039 is mainly for tax identity theft the IRS doesn’t know about yet.

Your situationWhat to do
The IRS sent you a letter or notice, such as Letter 5071CRespond to the letter and verify your return
You already sent Form 14039 or reported through IdentityTheft.govDon’t file again
You used, or were told to use, the Identity and Tax Return Verification ServiceSkip Form 14039
You can’t use the Identity and Tax Return Verification ServiceFile Form 14039
The theft isn’t tax-relatedSkip Form 14039
The IRS tells you to file itFile Form 14039
You suspect tax identity theft the IRS doesn’t know about, like a data breachFile Form 14039
A business’s identity was stolenFile Form 14039-B

When you do need to file Form 14039, download it, fill it out and send it to the IRS. You can also file the form for your dependent or if you are a surviving spouse, personal representative or a family member of a deceased person.

What Happens After You Report

How Long It Takes

The IRS aims to resolve most cases within 120 days, but the average case now takes about 580 days.

Sending a second Form 14039 or calling about your status causes more delays. While you wait, keep filing returns and paying taxes as usual. You can also follow the recovery steps on IdentityTheft.gov.

Protecting Future Returns With an IP PIN

Once the IRS confirms you’re a victim, it places you in its Identity Protection PIN program. An IP PIN is a six-digit number that stops others from filing a return with your SSN or Individual Taxpayer Identification Number (ITIN). All taxpayers receive it by mail on IRS notice CP01A; you can also access it through your IRS.gov account.

Each IP PIN is valid for one calendar year, and you get a new one yearly. You don’t have to be a victim to get an IP PIN. Anyone with an SSN or ITIN who can verify their identity is eligible. If you can’t use an IRS online account, use Form 15227.

Reporting IRS Scams

The IRS will never ask for your IP PIN, so any message asking for it is a scam. Forward fake IRS emails to phishing@irs.gov.

If someone pretends to be from the IRS, report the impersonation to the Treasury Inspector General for Tax Administration (TIGTA).

Sources

What is an IRS PIN to file taxes? How to Get a PIN to File Taxes What is an IRS Notice CP2000, and how do you respond? What is the Taxpayer Advocate Service?