IRS-Branded Tax Identity Theft Scam
Criminals use phishing to collect enough personal data to file fraudulent federal tax returns in victims' names, claiming refunds before the legitimate taxpayer files. The IRS has specific procedures to deal with tax identity theft, including the Identity Protection PIN programme.
Part of: Tax Identity Theft
Last reviewed: 7 June 2026
Tax identity theft occurs when a criminal uses a stolen Social Security number and personal details to file a fraudulent federal income tax return, claiming a refund before the legitimate taxpayer submits their own return. Victims typically discover the theft when their own return is rejected as a duplicate — often during the most stressful part of filing season.
The data needed to commit tax identity theft is gathered through IRS-branded phishing campaigns: emails, texts, and calls that ask for SSN, date of birth, income details, and employer information under the guise of 'pre-filing verification' or 'refund eligibility checks.'
The IRS has a dedicated process for handling tax identity theft and has developed the Identity Protection PIN (IP PIN) programme as a proactive safeguard. Understanding both the theft mechanism and the protection tools allows taxpayers to significantly reduce their risk.
How this scam works on the IRS brand
Phishing emails claim the recipient must verify their tax information before filing to 'prevent processing delays.' The form collects SSN, full name, date of birth, address, and sometimes W-2 information. This data bundle is sufficient to file a fraudulent return.
Other campaigns involve data broker breaches that supply SSNs, combined with IRS-branded automated calls telling victims that 'a discrepancy was found on your tax record' and directing them to a callback number staffed by fraudsters.
Victims discover the theft when they file their genuine return and receive an IRS rejection notice stating a return was already filed using their SSN. At this point the IRS has specific resolution steps: filing Form 14039 (Identity Theft Affidavit) and following the IRS Identity Theft Central process.
Common red flags
- Email or call asking for SSN and income details as 'pre-filing verification'
- Your legitimate tax return is rejected as a duplicate by the IRS
- IRS sends a notice about income from an employer you never worked for
- You receive a tax transcript you did not request
- IRS records show more income than you actually earned
- Phishing message asks for W-2 details before filing deadline
- Any page reached via an unsolicited link requesting SSN and DOB
How to protect yourself
- Apply for an IRS Identity Protection PIN at irs.gov/identity-theft-central — it prevents anyone else filing with your SSN
- File your tax return as early as possible each year to pre-empt fraudulent filings
- Never share SSN, DOB, or W-2 data in response to unsolicited emails, texts, or calls
- Monitor your IRS Online Account at irs.gov for unexpected activity
- Place a credit freeze at all three bureaus to limit collateral identity fraud
How to report it
- File IRS Form 14039 (Identity Theft Affidavit) at irs.gov
- Report to identitytheft.gov for a personalised recovery plan
- Report phishing to [email protected]
- Report to the FTC at reportfraud.ftc.gov
- Contact the SSA to review your earnings record for discrepancies at ssa.gov
Frequently asked questions
What is an IRS IP PIN and how does it protect me?
An Identity Protection PIN is a six-digit number assigned to you by the IRS. Any return filed with your SSN must include this PIN — without it, the IRS rejects the return. This makes it extremely difficult for a fraudster to file in your name.
My real return was rejected as a duplicate. What next?
File a paper return along with IRS Form 14039 (Identity Theft Affidavit). Contact the IRS Identity Protection Specialized Unit and follow the guidance at irs.gov/identity-theft-central.
How quickly can tax identity theft be resolved?
Resolution can take many months and sometimes longer than a year. Filing the identity theft affidavit promptly and requesting an IP PIN for future years are the most important early steps.