Tax Identity Theft
Tax identity theft is simple: someone files a return using your Social Security number, claims a refund, and disappears. You find out when your own return is rejected as a duplicate, usually months later, and the resolution takes a long time. There is a free preventive measure that makes the whole scheme impossible, and it is available to every taxpayer.
- It blocks the filing:: A return without the correct PIN is rejected, which removes the mechanism entirely.
- Open to everyone:: It is no longer restricted to confirmed victims — any taxpayer can request one.
- Renewed each year:: A new PIN is issued annually and must be used on that year's return.
- Losing it is inconvenient, not fatal:: It can be retrieved, though the process takes longer than the original request.
Where the AI summary above gets this wrong
"Protect yourself from identity theft by monitoring your credit report."
That's surface-true. Here's what it misses:
- Credit monitoring does not see a tax filing — A fraudulent return does not appear on a credit report, because no credit was extended. The theft is discovered months later when your own filing is rejected, by which time the refund has gone. Monitoring is worth doing and it does not address this at all.
- The preventive measure is free and takes minutes — The Identity Protection PIN was once limited to confirmed victims and is now open to any taxpayer. It is requested online, issued immediately in most cases, and makes a fraudulent filing in your name fail. Very few people who could use one do.
- Retirees are targeted for a specific reason — Someone who files late, files simply, or has income from several sources reported on forms that arrive at different times is easier to file ahead of. Filing early is itself a defence, and the PIN removes the race entirely.
01 How the fraud works
The thief needs a name, a date of birth and a Social Security number — information exposed in any number of past data breaches. Early in the filing season they submit a return claiming a refund, directed to an account they control.
When you file later, the return is rejected as a duplicate. That rejection is usually the first anyone knows about it, and by then the refund has been paid and withdrawn.
Resolving it involves an affidavit of identity theft, submitting the genuine return on paper, and waiting. Cases have historically taken many months, during which any refund is held — which for a household relying on it is a cash flow problem alongside the administrative one.
Shows: the refund held up by a fraudulent filing plus what is drawn from savings to bridge the delay, which is the practical cost of the disruption rather than of the fraud itself. Ignores: the time spent resolving it, any professional fees, and the effect on state filings.
Source: Get an Identity Protection PIN
02 The PIN, and how to get one
An Identity Protection PIN is a six-digit number known only to you and the IRS. It must appear on your return for it to be accepted electronically, and a return filed without it in your name is rejected.
It is requested through the IRS online account, which requires identity verification, and in most cases is issued immediately. A new number is generated each year and has to be used on that year's return.
The practical caution is to record it where you will find it in January and to make sure whoever prepares the return has it. A PIN that cannot be located does not prevent filing permanently — it can be retrieved — but it turns a simple filing into a slower one, and that is the whole cost of the protection.
Source: Get an Identity Protection PIN
03 If it has already happened
The steps are defined. Respond to any IRS notice using the contact details on it rather than any that arrived separately. File an identity theft affidavit. Submit your genuine return on paper. Request a PIN so it cannot recur.
Where a fraudulent return has already been processed, correcting the record can involve an amended return as well, and the interaction between the fraud case and any correction is worth handling in the right order rather than filing both at once.
Two related checks are worth making at the same time. Confirm that the figures on your own information returns — the statements from employers, custodians and medical accounts — match what you actually received, since a stolen identity is sometimes used for employment as well. And place a freeze with the credit agencies, which addresses the other half of the exposure.
Source: About Form 1040-X
This is the rare case where a single free action removes an entire category of risk, and almost nobody takes it. Get the PIN. It takes about fifteen minutes through the IRS online account, it makes a fraudulent filing in your name fail outright, and the only cost is remembering to use it in January. I would put it on the same list as freezing your credit — done once, forgotten about, and worth a great deal on the day it matters.
FAQ
Can anyone get an Identity Protection PIN?
Yes. It was once limited to confirmed victims and is now open to any taxpayer. It is requested through the IRS online account and in most cases issued immediately.
How do I know if someone filed a return in my name?
Usually your own return is rejected as a duplicate, or you receive a notice about a return you did not file. A fraudulent filing does not appear on a credit report.
What if I lose my Identity Protection PIN?
It can be retrieved, though the process takes longer than the original request and may require filing on paper. Recording it somewhere you will find it in January avoids the problem.
Sources
Regulator references
- Get an Identity Protection PIN · Internal Revenue Service · 2026What the PIN does, who can get one, and how it is renewed.Last verified: 2026-09-07
- About Form 1040-X · Internal Revenue Service · 2026Correcting a return, including after a fraudulent one has been filed.Last verified: 2026-09-07
Calculator unit tests · the assertions this page's worked example is checked against, and their last result
Changelog
- 2026-09-07 — initial publish (new format)
Run this rule against your situation
See what this rule does to your own projection — month by month, to age 90.
Join the Waitlist
Jordan Reeves
Founder of Talk Through Wealth. A software engineer for over a decade before turning to retirement planning, Jordan built the projection engine after watching family members get fragmented, country-by-country advice that never reconciled. He writes about retirement the way the engine computes it: month-by-month, lifetime-long, and skeptical of any rule of thumb that hasn't been run through the math.