Tax Identity Theft

Tax identity theft occurs when someone uses your national identifier — typically a Social Security Number (SSN) in the US — to file a fraudulent tax return in your name and divert the resulting refund to their own account. Because most tax authorities process refunds on a first-come, first-served basis and do not verify employment income in real time, a fraudulent return submitted before your genuine one is often processed and paid out before anyone realises.

In the US, the IRS receives millions of fraudulent returns each year. The UK's HMRC is also targeted, as are tax authorities in Canada, Australia, and across the European Union. The fraud is especially prevalent at the start of the filing season, when criminals race to submit before legitimate filers — a tactic known as 'early filing fraud'.

The harm extends beyond the lost refund: your legitimate return is rejected, you face delays receiving money you may have been counting on, and the resolution process — which involves proving your identity to the tax authority and waiting for a manual review — can take anywhere from several months to over a year.

Criminals obtain SSNs and associated personal details through data breaches, phishing campaigns, and dark-web purchases. They compile basic employment information either from the same breaches or by fabricating plausible wage data. Most tax authorities require only an identifier, date of birth, and claimed income figure to process a return — no payslip or employment verification is required at the point of filing.

The fraudster submits the return early in the tax season, requesting a direct deposit to a prepaid debit card or money transfer service they control. The tax authority, seeing a matching identifier, processes the refund. When the genuine taxpayer files their own correct return weeks or months later, the system flags it as a duplicate of a return already processed — and the legitimate filer receives a notice asking them to contact the fraud unit.

Resolution requires the genuine filer to prove their identity, submit a paper return, and wait for a manual review. In complex cases, or where the taxpayer cannot quickly produce the required documentation, this process can stretch to twelve to eighteen months.

Tax systems are designed to process returns quickly and minimise friction for filers. This speed is exploited by fraudsters who submit before legitimate taxpayers. The first-come, first-served refund model means a fraudulent return processed in January cannot easily be clawed back once the money has moved to a prepaid card. The resolution process is deliberately thorough — requiring strong identity proofing — which protects against false disputes but also makes legitimate recovery slow.

Your electronic return has been rejected. Our records show a return with the same Social Security Number has already been processed for tax year [Year].

IRS Notice: we received a tax return for [Year] using your Social Security Number. If you did not file a return, complete Form 14039 and send it to [Address].

Congratulations — your [Tax Refund Service] refund of [Amount] has been deposited to account ending [Number]. Contact us if you have questions.

HMRC: we have received a Self Assessment return for National Insurance number [NIN] for the year ending [Date]. If you did not file this return, contact us immediately.

Your [Tax Preparer] account has been accessed from an unrecognised device. If this was not you, change your password immediately.

File your tax return as early as possible each year to reduce the window for fraud. In the US, proactively request an IRS Identity Protection PIN, which is now available to all taxpayers and adds a six-digit code that must be included on any return filed with your SSN. Review your IRS online account (irs.gov) for transcripts showing returns filed and refunds issued. If you receive a letter from the IRS or HMRC about a return you did not file, do not ignore it — respond immediately.