Tax Identity Theft, Stolen Tax Refunds, and Fraudulent Income Filings¶

Few financial shocks are more alarming than trying to e-file your annual tax return and receiving an immediate electronic rejection code stating that a tax return has already been filed under your Social Security Number (SSN) or National Insurance Number, or opening a letter from the tax agency demanding thousands of dollars in back taxes and penalties for wages at a company where you have never worked. Tax-related identity theft generally falls into two categories: Tax Refund Fraud (where criminals use a stolen SSN early in the filing season to file a fabricated return and route a large fraudulent refund to their own prepaid card or bank account) and Employment / Income Identity Theft (where someone uses your SSN to get hired by an employer or open a gig-economy delivery account, causing W-2s or 1099s in your name to be reported to the government).

When a thief files a fraudulent return in your name, you do not lose your legal right to your true tax refund, nor are you legally liable for taxes on income earned by an impostor. However, because tax computers automatically block duplicate electronic filings and match employer W-2/1099 submissions against your SSN by algorithm, you must switch immediately to a specialized paper-filing and identity-verification workflow. By submitting IRS Form 14039 (Identity Theft Affidavit) alongside a paper tax return, locking your tax profile permanently with a 6-digit Identity Protection PIN (IP PIN), and cross-checking your Social Security Administration (SSA) Earnings Record to purge false employer wages, you can recover your full refund and erase fraudulent tax assessments.

Etsa sena hona joale¶

1. Make sure everyone is safe and never pay a caller threatening immediate arrest over taxes. If anyone is in physical danger, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or see dinomoro tsa tshohanyetso). Remember that legitimate tax agencies (the IRS, CRA, HMRC, and ATO) never call, text, or email taxpayers demanding immediate payment via gift cards, cryptocurrency, or wire transfer under threat of police or immigration arrest.
2. Feela tlaleho ea lekhetho ka poso hammoho le IRS Form 14039 (Identity Theft Affidavit). Haeba tlaleho ea hau ea lekhetho ea elektroniki e hanoa ka Reject Code IND-031-04 (SSN ea mantlha e se e sebelisitsoe tlalehong e felisitsoeng) kapa IND-517-01 (selemo sa motšehetsi se notletsoe. SSN e tla sala e le sistimi e setseng e batloang), Hatisa tlaleho ea hau ea lekhetho e felletseng, e nepahetseng pampiring, e saene ka enke, u kenye foromo e tlatsitsoeng IRS Form 14039 (Identity Theft Affidavit) le likopi tsa W-2s/1099s ea hau, 'me u romele pakete setsing se tloaelehileng sa IRS sa ho tlatsa lipampiri bakeng sa naha ea heno hore u se ke oa fetoa ke nako ea ho qetela ea la 15 Mmesa.
3. Arabela hang-hang lengolo lefe kapa lefe la netefatso la boitsebiso ba IRS (5071C, 4883C, 5747C, kapa 6331C). Haeba lisefe tsa bomenemene tsa IRS li ka tšoara tlaleho e belaetsang pele u lefa lesholu, li tla u romella lengolo la Lenaneo la Tšireletso ea Mokhethoa (1C4C7, 50 kapa 8C4C, 50). 6331C). Latela litaelo tse tobileng tse lengolong nakong ea matsatsi a 30 (ebang u netefatse inthaneteng ho IRS.gov/VerifyReturn kapa u letsetsa mohala oa mohala o inehetseng oa Lenaneo la Tšireletso ea Mokhethoa o hatisitsoeng tsebisong) 'me u bolele ka ho hlaka: "HA KEA kenya tlaleho ea lekhetho e boletsoeng lengolong lena."
4. Ingolise hang-hang lenaneong la IRS Identity Protection PIN (IP PIN). E-ea ho IRS.gov/IPPIN 'me u fumane PIN ea linomoro tse 6 Identity Protection PIN. Hang ha o ngolisitsoe, ha ho tlaleho ea lekhetho ea elektroniki kapa ea pampiri e ka sebetsoang tlas'a SSN ea hau ntle le khoutu ea lekunutu ea linomoro tse 6, e nchafatsoang ka Pherekhong e 'ngoe le e 'ngoe.
5. Emisa lifaele tsa hau tsa mekitlane liofising tse tharo tse kholo 'me u fane ka tlaleho ea FTC IdentityTheft.gov. Kaha masholu a boitsebiso ba lekhetho a se a ntse a e-na le lebitso la hao le felletseng, letsatsi la tsoalo le Nomoro ea Tšireletso ea Sechaba, hangata a leka ho bula likarete tsa mokoloto, liak'haonte tsa banka kapa likalimo tsa letsatsi la ho lefa. Beha Security Freeze mahala Equifax, Experian, le TransUnion (hammoho le ChexSystems bakeng sa liakhaonto tsa banka) le ho hlahisa FTC Identity Theft Report e molaong IdentityTheft.gov.
6. Hula IRS "Moputso le Moputso oa Moputso" le Setatemente sa Meputso ea Ts'ireletso ea Sechaba. Kena inthaneteng IRS Individual Account le account eaka ea Ts'ireletso ea Sechaba (SSA.gov)** ho hlahloba W-2, 1099-NEC, 1099-K, le 1099-MISC tse tlalehiloeng ka tlas'a sethala sefe kapa sefe se sa tsejoeng hanghang.

Bosholu ba boitsebiso ba lekhetho le sefate sa qeto ea ho tlatsa ka bolotsana¶

flowchart TD
    Root["Tax Identity Theft or Fraudulent Tax Notice"]
    Scenario{"How did you discover the tax fraud?"}
    EfileReject["E-File Rejected (Code IND-031-04 / IND-517-01):<br/>Another return was already filed<br/>using your SSN or your child's SSN"]
    TPPNotice["Received IRS Letter 5071C / 4883C / 5747C:<br/>IRS froze a suspicious return<br/>and asks if you filed it"]
    FakeIncome["Received IRS CP2000 / Audit Notice:<br/>IRS demands tax on W-2 or 1099 wages<br/>from an employer you never worked for"]
    StolenCheck["IRS 'Where's My Refund' says Paid:<br/>Your real refund was rerouted or<br/>your paper Treasury check was stolen"]

    PrintPaper["1. Print complete original Form 1040 on paper<br/>2. Complete & attach IRS Form 14039 (ID Theft Affidavit)<br/>3. Mail via USPS Certified Mail to IRS filing center"]
    GetIPPIN["Enroll in IRS 6-Digit IP PIN at IRS.gov/IPPIN<br/>and freeze credit at Equifax, Experian, TransUnion"]

    CallTPP["1. Log into IRS.gov/VerifyReturn or call the<br/>Taxpayer Protection Program number on letter<br/>2. Confirm you did NOT file the suspicious return<br/>3. IRS blocks fake return without needing Form 14039"]

    DisputeCP2000["1. DO NOT sign agreement to pay the CP2000 tax<br/>2. Reply within 30 days attaching Form 14039,<br/>Disputed Income Statement, and W-2/1099 fraud notice<br/>3. Request SSA Earnings Record correction (Form SSA-7008)"]

    RefundTrace["1. File IRS Form 3911 (Taxpayer Statement Regarding Refund)<br/>2. If preparer rerouted direct deposit, file<br/>Form 14157 + Form 14157-A (Preparer Misconduct)<br/>3. Complete Bureau of the Fiscal Service Check Forgery Packet"]

    Root --> Scenario
    Scenario -->|E-File Rejected| EfileReject
    Scenario -->|Verification Letter| TPPNotice
    Scenario -->|Fake W-2 or 1099| FakeIncome
    Scenario -->|Refund Stolen| StolenCheck

    EfileReject --> PrintPaper
    PrintPaper --> GetIPPIN

    TPPNotice --> CallTPP
    CallTPP --> GetIPPIN

    FakeIncome --> DisputeCP2000
    DisputeCP2000 --> GetIPPIN

    StolenCheck --> RefundTrace

Ho khetholla Litsebiso tsa Bosholu ba Boitsebiso ba IRS le E-File Reject Codes¶

Litsebiso tse fapaneng tsa IRS le likhoutu tsa ho hana tsa elektroniki li hloka likarabo tse fapaneng ka ho felletseng. Ho romella Foromo ea 14039 ha IRS e hlile e u kopa ho letsetsa mohala oa Ts'ireletso ea Lekhetho la Lekhetho ho tla liehisa puseletso ea hau ka likhoeli. Sheba khoutu ea hau hantle ka tlase:

Scenario 1: Someone already filed a tax return using your SSN (Stolen Refund)¶

When an identity thief files a fake return under your SSN before you file, the IRS Identity Theft Victim Assistance (IDTVA) organization must manually investigate the duplicate filing, strip the fraudulent return off your account, and release your legitimate refund.

Step 1: Assemble and mail your Paper Return + Form 14039 Packet¶

Because the IRS e-file system physically cannot accept two electronic returns under the same primary SSN in the same tax year, you must file by paper mail:

1. Prepare your complete, accurate Form 1040: Include all schedules, credits, and direct deposit routing/account numbers for your legitimate bank account. Sign and date the return in blue or black ink.
2. Complete IRS Form 14039 (Identity Theft Affidavit):
3. Section A: Check Box 1 ("I am submitting this Form 14039 for myself").
4. Section B: Check Box 1 ("Someone used my information to file taxes") and enter the specific tax year(s) affected.
5. Section C & D: Enter your current contact details, exact address used on your last legitimate tax return, and sign under penalty of perjury.
6. Attach legible copies of all W-2s, 1099s, and Identity Documents: While Form 14039 no longer requires attaching a driver's license or Social Security card in every routine e-file reject case, attaching clear copies of all real Form W-2 and Form 1099 wage statements proves your legitimate income and speeds up IDTVA verification.
7. Mail to the standard IRS paper filing address for your state (NOT the Form 14039 standalone address): Look up the Where to File Paper Tax Returns address for your state on IRS.gov and send the entire packet (Form 1040 + Form 14039 attached to the back) via USPS Certified Mail with Return Receipt Requested. (Only mail Form 14039 to the standalone Fresno/Ogden IDTVA address or submit it online at IRS.gov if you are not enclosing a paper tax return.)

Step 2: What to do if your dependent or child's SSN was claimed by someone else¶

If your e-file was rejected because your child's SSN was already claimed on another tax return (either by a stranger who stole the child's SSN or by a separated co-parent who lacked the legal right to claim the child under IRS tie-breaker rules):

1. Mail your paper Form 1040 claiming your child: Do not delete your child from your tax return just to make the e-file go through; doing so forfeits thousands of dollars in Child Tax Credit (CTC), Earned Income Tax Credit (EITC), and Head of Household filing status, and forces you into a much slower amended-return queue.
2. Distinguish Stranger Identity Theft vs. Co-Parent Dispute:
3. If a stranger stole your child's SSN: Attach Form 14039 completed on behalf of your dependent child (check Box 2 in Section A: "I am submitting for my dependent child"), and apply for an IP PIN for your dependent so no one can ever e-file with their SSN again.
4. If an ex-spouse or other parent wrongfully claimed the child: That is a Custodial Tax Law Dispute, not stranger identity theft (do not file Form 14039 against a known co-parent). Instead, attach a cover letter and IRS Form 886-H-DEP / 886-H-EIC residency proof (school enrollment records, pediatrician medical records, health insurance statements, or court custody orders) proving the child lived in your home for more than half the year (183+ nights). The IRS will audit both parents' returns, disallow the non-custodial parent's improper claim under IRC Section 152©(4), and pay your refund.

Step 3: Realistic IDTVA timeline and calling the Taxpayer Advocate Service (TAS)¶

Currently, the IRS Identity Theft Victim Assistance (IDTVA) unit takes 120 to 360+ days (4 to 12 months) to resolve a paper duplicate-filing identity theft case, scrub the thief's fraudulent return, and issue your legitimate refund.

How to expedite your refund in 2 to 4 weeks if you face severe financial hardship: If waiting 6 to 12 months for your tax refund will cause you to face eviction, mortgage foreclosure, utility shutoff, auto repossession, or inability to afford food or medical care, do not wait in the general IDTVA queue. Call the independent Taxpayer Advocate Service (TAS) at 1-877-777-4778 or fax IRS Form 911 (Request for Taxpayer Advocate Service Assistance) to your local state Taxpayer Advocate office, attaching your eviction notice or utility shutoff bill. TAS has statutory authority to issue an Operations Assistance Request (OAR) directing the IDTVA unit to manually expedite your identity theft adjustment and release your refund on an emergency basis.

Scenario 2: False W-2s or 1099s filed in your name (Employment & Gig Identity Theft)¶

In Employment Identity Theft, someone uses your Social Security Number (or creates a fake LLC/merchant account using your SSN) to work at a restaurant, construction site, warehouse, or gig-economy platform (such as Uber, DoorDash, Instacart, Lyft, or online marketplaces issuing Form 1099-NEC or Form 1099-K). You usually discover this 12 to 18 months later when the IRS sends you a Notice CP2000 proposing thousands of dollars in unpaid income tax, self-employment tax, and accuracy penalties on wages you never earned.

Step 1: Respond to the IRS CP2000 or Audit Notice within 30 days¶

Never ignore a Notice CP2000, if you fail to respond within 30 days (60 days if outside the US), the IRS automatically issues a Statutory Notice of Deficiency (90-Day Letter) and assesses the tax against you by default, leading to tax liens and wage garnishments (see tax audit, back taxes, and wage garnishment defense). Take these exact steps:

1. Check the "I do NOT agree" box on the CP2000 Response Form: Never sign the consent to tax increase.
2. Complete IRS Form 14039 (Check Box 2 in Section B): Check Box 2 ("Someone used my information for employment"), listing the exact name, Employer Identification Number (EIN), and dollar amount of the fraudulent employer or 1099 payer.
3. Contact the Employer or Gig Platform's Payroll/Compliance Department in writing: Send a certified letter to the company that issued the fake W-2 or 1099 demanding that they investigate the identity theft and issue a Corrected Wage Statement (Form W-2c reducing wages to 0.00 USD, or a Corrected Form 1099-NEC/1099-K checked "CORRECTED" with 0.00 USD). Even if the employer refuses or ignores you, attach a copy of your certified letter to the employer inside your CP2000 response packet.
4. Fana ka Bopaki ba Bolulo ba Hao ba Sebele le Mosebetsi: Hokela likopi tsa li-W-2 tsa hau tsa 'nete, likoloto tsa ts'ebeliso, kapa lengolo la netefatso ea mohiri le pakang hore selemong sa lekhetho seo ho buuoang ka sona u ne u lula le ho sebetsa City A ha mosebetsi oa bolotsana oa W-2/1099 o ntse o le Motseng oa B (kapa hore o ne o tlohetse mosebetsi / o holofetse).

Mohlala oa Lengolo la ho hanyetsa Moputso oa Bomenemene W-2 / 1099 (CP2000 Karabo)¶

Attach this signed statement to your CP2000 Response Form and Form 14039:

Subject: Formal Protest of Proposed Tax Assessment Due to Employment Identity Theft: Notice CP2000, Tax Year [Insert Year], SSN ending in [Last 4 Digits]

To the Internal Revenue Service Automated Underreporter (AUR) & IDTVA Units:

I am writing in timely response to Notice CP2000 dated [Insert Date] proposing additional tax of [Insert Dollar Amount] for Tax Year [Insert Year]. I do not agree with the proposed changes.

Specifically, the proposed adjustment is based on a fraudulent [Form W-2 / Form 1099-NEC / Form 1099-K] issued by [Name of Unknown Employer or Payer, EIN: XX-XXXXXXX] reporting [Insert Dollar Amount] in alleged income under my Social Security Number.

I declare under penalty of perjury that I have never been employed by, performed services for, or received any compensation from [Name of Unknown Payer], nor have I ever lived or worked in [City/State where fraudulent work occurred]. I am the victim of Employment Identity Theft.

Enclosed in support of this protest please find: 1. Completed and signed IRS Form 14039 (Identity Theft Affidavit) reporting employment-related identity theft under Section B, Box 2; 2. Copy of my FTC Identity Theft Report (#[Insert Number]) and local police report; 3. Kopi ea kopo ea ka e ngotsoeng e rometsoe ho [Lebitso la Molefi ea sa Tsejoeng] ho kopa ho ntšoa ha foromo e lokisitsoeng [Foromo W-2c / Foromo e Lokisitsoeng 1099] ho fokotsa chelete e tlalehiloeng tlas'a SSN ea ka ho 0.00 USD; le 4. Bopaki ba bolulo ba ka ba sebele le mosebetsi oa ka oa nako e tletseng [Toropo ea Hao ea Sebele] nakong ea Selemo sa Lekhetho [Selemo sa Kena].

Please refer this account to the Identity Theft Victim Assistance (IDTVA) unit, remove the fraudulent [W-2 / 1099] income from my Tax Year [Insert Year] account module, and issue a closing notice confirming 0.00 USD in additional tax liability.

Ka boikokobetso, [Tshaeno ea Hao, Lebitso le Hatisitsoeng, Aterese, le Nomoro ea Mohala]

Step 2: Purge fake wages from your Social Security Administration (SSA) Record¶

Clearing the fraudulent W-2 with the IRS is only half the battle. When an impostor works under your SSN, their employer reports those wages to the Social Security Administration (SSA), which can accidentally disqualify you from Social Security Disability (SSDI), SSI, Medicare premium subsidies, or unemployment benefits because state and federal computers think you are actively working.

1. Create or log into your my Social Security account at SSA.gov: Review your year-by-year Earnings Record.
2. File Form SSA-7008 (Request for Correction of Earnings Record): Call the Social Security Administration at 1-800-772-1213 or visit your local SSA field office with your ID, your real W-2s for that year, and your IRS Form 14039 / FTC Identity Theft Report. Ask the SSA representative to initiate an Earnings Discrepancy Investigation and remove ("scramble" or disavow) the impostor's wages from your Social Security earnings record.

Scenario 3: Stolen refund checks and ghost tax preparer fraud¶

What if you filed your own legitimate tax return, the IRS Where's My Refund tracker says your refund was sent/paid, and you never received the money? Immediately check how your return was filed:

1. If a paper US Treasury Refund Check was stolen from your mailbox and cashed: File IRS Form 3911 (Taxpayer Statement Regarding Refund) immediately (or call the IRS Refund Hotline at 1-800-829-1954 to initiate an electronic Refund Trace). If the check was not cashed, the IRS cancels the stop-payment check and issues a replacement. If a thief forged your signature and cashed the Treasury check, the Bureau of the Fiscal Service (BFS) will mail you a Check Forgery Claim Packet (Form FMS-1130) along with a photocopy of the cashed check; return the signed forgery affidavit and handwriting samples so BFS can recoup the funds from the cashing bank and reissue your refund.
2. If an unscrupulous or "Ghost" Tax Preparer altered your direct deposit routing number: Look at Line 35b and 35d of the PDF copy of your tax return. If a tax preparer changed the bank routing and account numbers on the return transmitted to the IRS so your refund went into the preparer's account (or inflated fake deductions and pocketed part of the refund), the IRS treats this as Return Preparer Misconduct. File IRS Form 14157 (Complaint: Tax Return Preparer) AND IRS Form 14157-A (Tax Return Preparer Fraud or Misconduct Affidavit), attaching a police report naming the preparer, a copy of the return they gave you versus the IRS Return Transcript, and proof of your real bank account. Under Internal Revenue Manual rules, the IRS will make you whole and issue your true refund once preparer misconduct is verified.

Locking down your tax identity permanently (IP PIN and Global Equivalents)¶

• United States (IRS 6-Digit IP PIN for Every Family Member): Any person with an SSN or ITIN, including spouses and minor children/dependents, can voluntarily opt into the Identity Protection PIN (IP PIN) program at IRS.gov/IPPIN (or by filing Form 15227 if your adjusted gross income is below 85,000 USD single / 175,000 USD married, or via an in-person appointment at a Taxpayer Assistance Center). Once active, the IRS generates a new 6-digit PIN every January that must be entered on any return listing your SSN as primary, secondary, or dependent.
• Canada (Canada Revenue Agency / CRA): If your Social Insurance Number (SIN) is compromised or a fraudulent T1 return/Direct Deposit change was submitted on your CRA My Account, call the CRA Individual Tax Enquiries line (1-800-959-8281) immediately and ask to be transferred to the CRA Identity Protection Services (IPS) unit. CRA will place a mandatory Multi-Factor Security / Identity Theft Indicator on your SIN, freeze unauthorized direct deposit changes, and assign a specialized IPS case officer. Also report the SIN compromise to Service Canada (1-866-274-6627) and the Canadian Anti-Fraud Centre (CAFC).
• United Kingdom (HM Revenue and Customs / HMRC): If someone hijacks your Government Gateway / Personal Tax Account to claim a fraudulent Self Assessment repayment or PAYE tax rebate, call the HMRC Income Tax Helpline (0300 200 3300) and report the cyber incident via HMRC's online Security Issue / Identity Theft Report form. HMRC's specialist Identity Protection Team will lock your National Insurance Number against unauthorized digital filings, cancel fraudulent repayment mandates, and restore your true PAYE tax code.
• Australia (Australian Taxation Office / ATO): If your Tax File Number (TFN) or myGov account has been compromised or a fraudulent income tax return/BAS has been lodged, call the ATO Client Identity Support Centre (1800 467 033) immediately. The ATO will place a strict Security Lock on your TFN (requiring phone authentication before any future tax return or bank account update can be processed) and refer you to IDCARE (1800 595 160), Australia and New Zealand's national identity and cyber support service.

Lipotso tse botsoang khafetsa¶

Mehloli e hlahlobiloe¶

• Internal Revenue Service (IRS, United States): Publication 5027 (Identity Theft Information for Taxpayers), Form 14039 (Identity Theft Affidavit Instructions), Taxpayer Protection Program (Letters 5071C, 4883C, 5747C, 6331C), Get an Identity Protection PIN (IP PIN), and Form 14157 / 14157-A (Return Preparer Misconduct).
• Taxpayer Advocate Service (TAS, United States): Identity Theft Victim Assistance (IDTVA) Roadmap, Notice CP2000 Employment Identity Theft Disputes, and Expedited Hardship Relief via Form 911.
• Federal Trade Commission (FTC, United States): IdentityTheft.gov Tax Identity Theft Recovery Steps and Federal Credit Freeze Protections.
• Social Security Administration (SSA, United States): Publication No. 05-10064 (Identity Theft and Your Social Security Number) and Form SSA-7008 (Request for Correction of Earnings Record).
• Canada Revenue Agency (CRA, Canada): Identity Protection Services (IPS) Protocols and Protecting Your CRA Account from Unauthorised Filings.
• HM Revenue and Customs (HMRC, United Kingdom): Reporting Tax Identity Theft, Hijacked Government Gateway Accounts, and Unauthorised Self Assessment Repayments.
• Australian Taxation Office (ATO, Australia): Client Identity Support Centre (1800 467 033) Protocols for Compromised Tax File Numbers (TFNs).

Litataiso tse amanang¶

• Tax audit, back taxes, and wage garnishment defense
• Sudden job loss
• Mathata a tšohanyetso a lichelete
• Debt collector harassment