Tax-Related Identity Theft: Signs and Steps
Treat tax identity theft as an IRS-account problem first: follow the rejection or notice instructions, file the real return, and use Form 14039 only when the IRS process calls for it.
Tax-related identity theft often announces itself through a very specific event: an e-file rejection saying a return was already filed under your Social Security number or ITIN, an IRS notice about a return you did not file, an unexpected refund, or income that does not belong to you. Do not answer the problem with a generic “identity theft” checklist. Follow the IRS instruction tied to the event. If your e-file is rejected because another return is already on file, preserve the rejection, file the legitimate return as instructed, and use Form 14039 when the IRS identity-theft process calls for it. If the IRS sends a verification notice, follow that notice; some verification paths specifically say not to submit Form 14039 unless told to do so.
Start with the exact IRS signal, because the remedy changes
An ordinary e-file rejection can be caused by a typo in an SSN, name, or other return field. Read the reject code or explanation before concluding a thief filed first. IRS guidance says some errors can be corrected and e-filed again. A duplicate-return rejection is different. When the rejection indicates that you or your spouse already filed, the IRS directs taxpayers to contact it for help, and a paper filing may be necessary. If you file a paper return after an electronic rejection, current IRS guidance describes a special timeliness rule: the paper return must generally be postmarked by the later of the return due date, including extensions, or 10 calendar days after the IRS rejection notice, with the rejection information and explanation attached as instructed.
Do not wait for the identity-theft case to finish before filing the tax return you are legally required to file. Identity-theft resolution can take much longer than the filing deadline. The goal is to get the legitimate return into the IRS process while preserving evidence that the earlier electronic filing was rejected.
Form 14039 is a targeted affidavit, not a universal breach form
The February 2026 revision of Form 14039 is the IRS Identity Theft Affidavit for victims of tax-related identity theft. The form itself warns against filing duplicate affidavits for the same incident. It also distinguishes tax-related misuse from a mere data exposure: if your information was breached but there is no federal income-tax issue, the form directs you toward preventive measures such as an IP PIN rather than filing an affidavit simply because data might be at risk.
Form 14039 is not a generic attachment for every suspicious tax message. Use it when the IRS identity-theft instructions for your situation call for the affidavit. Some IRS letters and online return-verification workflows direct the taxpayer to authenticate a specific return first, and the IRS can tell successful users of that route that a separate affidavit is unnecessary. Read the authentic notice or Identity Theft Central instructions tied to your event before adding forms, because duplicate or unnecessary submissions can complicate an already open case.
Protect the IRS online account and the email behind it
If someone changed your IRS online-account credentials, follow the IRS account-recovery instructions rather than repeatedly attempting sign-ins or creating duplicate accounts. Secure the email address connected to tax software and IRS services as well. Change reused passwords, remove unfamiliar recovery methods, and enable strong multifactor authentication where available. Tax identity theft can begin with stolen tax documents, but it can also be sustained by a compromised mailbox that receives filing confirmations or password resets.
Keep copies of every IRS notice and your responses. The notice number, tax year, date, and method of response matter. Do not send the IRS a full library of unrelated identity-theft paperwork if the notice asks for a narrow set of documents. The IRS works tax years and account issues separately, so label your files by tax year and notice number.
An IP PIN is the preventive control to carry forward
An IRS Identity Protection PIN is a six-digit number used to help verify the taxpayer’s identity on federal individual income-tax returns. IRS guidance says an IP PIN is valid for one calendar year and a new number is generated each year. Confirmed tax-identity-theft victims are placed into the IP PIN program; other taxpayers can also opt in if they can verify identity. Protect the number as sensitive tax data and share it only with the IRS and a trusted tax professional who is preparing your return.
The IP PIN does not repair a fraudulent return that was already filed. It is a forward-looking filing control. If you use one, make sure the current year’s PIN is entered on any federal return filed during that calendar year, including a prior-year return filed now, according to IRS instructions. A stale prior-year PIN can cause another rejection and create confusion during recovery.
Check Social Security when the tax problem points to employment misuse
An IRS notice about wages from an employer you do not recognize can indicate employment identity theft rather than, or in addition to, fraudulent tax filing. Review your earnings record through a personal my Social Security account. SSA says it can help correct earnings that are not yours, including through an online correction path for some users or through a local office with supporting records. SSA does not run the broader identity-theft investigation; it corrects the Social Security record while the FTC and IRS handle their respective parts.
| Signal | Likely first route | Record to keep |
|---|---|---|
| E-file says you or spouse already filed | IRS e-file rejection instructions; paper return and identity-theft steps as directed | Reject notice, paper-return proof, Form 14039 confirmation if filed |
| IRS asks you to verify a return | Use the verification method named in the notice | Notice, verification confirmation, notes of any call |
| Wages from an unknown employer | Review IRS tax account and SSA earnings record | W-2/notice, earnings record, correction request |
| Data exposed but no tax misuse yet | Consider an IP PIN and account hardening | IP PIN enrollment or retrieval record |
| Unexpected refund for a return you did not file | Follow IRS erroneous-refund and identity-theft instructions | Refund record, IRS correspondence, affidavit if required |
Expect resolution to be slower than filing
Tax-identity-theft cases can remain open while the IRS verifies the legitimate return and removes fraudulent activity. Do not interpret a long process as permission to ignore later notices. Open every IRS letter, confirm that it is genuine using IRS.gov, and answer the specific request by the deadline shown. A clean recovery file should let you explain which return was yours, which filing was fraudulent, what identity-theft report was made, and what IP PIN protects future filings. That is a better finish line than waiting for a vague feeling that your SSN is “safe again.”
Questions specific to Tax-Related Identity Theft: Signs and Steps
Should I file Form 14039 every time my SSN is exposed?
No. Form 14039 is for tax-related identity theft. The 2026 form distinguishes actual federal tax misuse from a data breach with no tax impact. If there is no tax issue, an IP PIN may be the more relevant preventive step.
What if my e-file was rejected because a return was already filed?
Save the rejection and follow the IRS duplicate-return instructions. You may need to file a paper return and use the identity-theft process. IRS rules also provide a special timeliness window for certain paper returns filed after an e-file rejection.
Do I still file my real return while the identity-theft case is open?
Yes. Follow IRS instructions to submit the legitimate return even if identity-theft resolution is still pending. Recovery should not replace your filing obligation.
Will an IP PIN fix the fraudulent return already on my account?
No. It is primarily a forward-looking identity-verification control for returns filed with your SSN or ITIN. The existing fraudulent filing still has to be resolved through the IRS identity-theft process.