What Is Tax Identity Theft?

Understanding tax identity theft

Identity theft occurs when your personal information, including your SSN, is stolen and used for fraudulent purposes, such as stealing the contents of your bank or investment account.

Tax identity theft is a specific type of identity theft that occurs when a thief uses your personal information to file a tax return in your name or obtain employment.

Several types of personal details can be stolen and used for tax identity theft:

• Name and address
• Social Security numbers
• Bank and investment account numbers
• Credit card numbers
• Medical account numbers

Thieves use these details to file a tax return or claim a tax credit with false information. They then request that the disbursement of funds goes to a prepaid card that only they can access, canceling it when they are done.

“It’s a form of identity theft that can go undetected until your legitimate return is rejected or delayed,” explained Ian Bednowitz, general manager at LifeLock.

Thieves can also use your personal data to create a fraudulent online account with the IRS. From there, they can file tax returns, claim tax credits, access financial data and request an employer identification number (EIN).

Detecting tax identity theft

It can be extremely difficult to detect tax identity theft. A thief may file a fraudulent tax return and collect your tax return before you even realize it happened. This is because taxpayers often wait an average of nearly 19 months for their returns to be processed and refunds issued, according to a 2023 Taxpayer Advocate Service report.

Therefore, many taxpayers don’t even realize they are the victim of tax identity theft until the IRS notifies them of a duplicate tax return.

“What makes it so concerning is that criminals often file early in the season to beat you to your own refund, and once that’s done, unraveling the fraud can be complicated and time-consuming,” explained Bednowitz.

Types of tax identity theft

There are two types of tax identity theft: refund fraud and employment fraud.

Refund fraud

Refund fraud is the most common type of tax identity theft.

This is when thieves use your stolen information, including your SSN, to fraudulently file a tax return and claim a tax refund or credit. By the time the IRS notifies you of a duplicate tax return, the identity thieves may have already stolen your tax refund.

Employment fraud

For this type of tax season scam, an identity thief uses your personal data to get a job.

In this case, they use your name and SSN to legitimize their employment record with their employer. This allows them to report income to the IRS and collect a tax refund under your name.

Be sure to review both types carefully and work with your financial advisor to secure your accounts so neither type of tax identity theft happens to you.

» IN THE NEWS: Tax season scams are back — and they’re getting harder to spot

How tax identity theft occurs

It’s all too easy to find yourself vulnerable to tax identity theft, as your information can be stolen in a number of ways.

“Cybercriminals are constantly evolving their tactics, whether they’re impersonating IRS agents or crafting phishing emails,” commented Scott Edwards, director of enterprise fraud risk management at Bank of Oklahoma, “and unfortunately, innocent people are falling into their traps.”

Imposter scams are among the most common. Known as phishing, these scams involve thieves posing as government officials to obtain your personal details, which they can then use to steal your tax return.

There are many other ways your information can be compromised:

• Dark web. Today, it’s all too easy for scammers to go on the dark web and purchase your information to exploit.
• Data breaches. Data breaches are all too common today and extremely widespread, affecting companies such as University of Phoenix, Petco, DoorDash, Qantas Airways, Dairy Farmers of America and The Washington Post.
• Stolen correspondence. Thieves may steal your mail or your W-2 from your employer, revealing your personal details.
• Wi-Fi hotspots. Unsecured and public Wi-Fi hotspots make it easy for hackers to steal your information, so always use a secure connection when accessing personal data.
• Compromised officials. There have also been cases of corrupt insiders at CPA and tax preparation offices who manipulate and steal your data for their own personal gain.
• Stolen documents. Finally, identity thieves can get their hands on your private information the old-fashioned way by stealing your wallet or purse with your ID and bank cards inside. They’re also known to use skimmers at ATMs and fish through trash to find discarded financial statements or documents containing personal data.

Warning Signs of Tax Identity Theft

You may be the victim of tax identity theft if the IRS notifies you that:

• You owe additional tax.
• You have a refund offset.
• A suspicious tax return has been filed under your name.
• More than one tax return has been filed using your personal data.
• There has been a request for your tax transcript.
• The IRS has received a request for an EIN.
• An online IRS account has been created that you didn’t open.
• You have been sent to collections for back taxes after failing to file a tax return for a specific year.
• IRS records show more income than you actually earned.
• Your federal or state benefits are reduced or cancelled due to a change in income.
• You have a 1099-G for unemployment income, but you never filed for unemployment benefits.

Protecting yourself from tax identity theft

Here are 10 more ways to reduce your risk of becoming a victim in the future:

TIP: File as early as possible to beat out any would-be impostors, as tax identity thieves typically file their fraudulent return early in the season.

1. Safeguard personal documents, ensuring that anything with your sensitive data is properly destroyed when discarded, using a shredder if possible.
2. Set up multi-factor authentication and employ biometric authentication for the highest level of security at log-in.
3. Never give out your information unless you have properly confirmed an official’s identity. Note that the IRS will never contact you by email or phone.
4. Carefully vet any tax preparers you consider to ensure their legitimacy. ConsumerAffairs offers real customer reviews for today’s best financial advisors and accounting firms.
5. Closely monitor your credit score and credit report to check for identity theft and any other discrepancies that may arise. You can get free copies of your credit report from the three main credit bureaus by visiting AnnualCreditReport.com.
6. Enroll in an identity theft protection service or a credit monitoring service, such as LifeLock, IDShield or PrivacyGuard, if your budget allows.
7. Freeze your credit so new lines of credit cannot be opened without your approval.
8. Place a fraud alert so lenders must verify your identity before opening new lines of credit in your name.
9. Use a private, secure internet connection, always avoid public Wi-Fi, and install a VPN service for extra security.
10. Lock your SSN by creating an E-Verify account so others can’t use it.

“Never click on any links or open attachments in unexpected emails, and report any suspicious content directly to the IRS,” Edwards advised. “If you think you may owe the IRS, view your balance online or contact the IRS directly to confirm.”

With tax identity theft on the rise in the U.S., it’s critical that you arm yourself with the best preventive measures to avoid it.

Steps to take if you're a victim

If you believe you may be the victim of tax identity theft, take these steps immediately to minimize the damage.

1. Respond to your IRS notice

Be sure to carefully review any notice you receive from the IRS and follow the enclosed instructions.

You may be required to verify your identity via the online IRS verification tool, by phone or in person at an IRS Taxpayer Assistance Center. In most cases, the IRS won’t process your return until you respond to the notice.

After you submit your affidavit, the IRS will assign your case to the IRS Identity Theft Victim Assistance team for case assessment. A resolution letter can be sent within 120 days, though current increased case volumes have extended the average to 493 days.

You should also take this opportunity to update the password to your online account.

Bednowitz recommended requesting an identity protection (IP) PIN for extra protection, calling it “one of the most effective ways to protect yourself.”

2. File your taxes

Do not neglect your taxes. Be sure to file and pay your taxes on time to avoid any additional tax liability or debt.

Even if a duplicate return was filed in your name, the IRS still requires you to file and pay taxes as usual. However, you may be required to mail a paper form if your access to the e-filing system has been revoked.

Additionally, be sure to contact your state tax department to notify them of your case and ask about any additional required steps.

3. Make an official report

When you file your tax return, complete Form 14039 (Identity Theft Affidavit) to officially report tax identity theft.

“Send it to the IRS at the earliest opportunity,” urged Geoff Knight, founder and CEO of FileTax.com, an IRS-approved e-file provider. “You must lodge your reply to any letters that you get about the fraudulent return sent to you by the IRS.”

The IRS will then assign your case to the Identity Theft Victim Assistance unit for further investigation.

“The IRS has dedicated departments that assist in identifying victims of identity theft,” explained Knight, “and they will assist you in clearing the situation and receiving any refund that is due to you.”

There are a few caveats:

• If you received an IRS letter only reporting suspicious activity, Form 14039 is not required.
• If you received an EIN you didn’t request, you will need to submit Form 14039-B (Business Identity Theft Affidavit) instead. You can also call the IRS at 800-908-4490.

4. File with the FTC

You must also file an official Identity Theft Report with the Federal Trade Commission (FTC).

After you file your report, the FTC will advise on next steps. It will also share your case with over 2,800 law enforcement partners to help prevent future fraud.

5. Notify your lender

It’s also critical that you contact the lender or financial institutions for all affected accounts. Be sure to immediately report any accounts, loans or transactions that you do not recognize.

Your lender or financial institution will then advise you on next steps, which will likely include closure of the account.

6. Contact the credit bureaus

It’s also critical that you report your case of tax identity theft to the three major credit bureaus: Experian, Equifax and TransUnion.

You can request that a fraud alert be placed on your credit file to help prevent further damage.

Credit Bureau Contacts: Identity Theft Reporting

You should also consider getting professional help restoring your credit.

“Tax-related or not, it’s crucial that individuals continually monitor their personal accounts for any suspicious activity,” said Edwards. “If you see accounts you don’t recognize on your credit report or spot unfamiliar transactions, you might consider taking steps to report and develop a recovery plan for identity theft.”

» COMPARE: Best credit monitoring services