Last reviewed: 1 October 2026
Home › Credit help › Tax identity theft and the IRS IP PIN
Tax identity theft and the IRS Identity Protection PIN: what credit monitoring will not catch
For U.S. federal tax returns, the FTC says credit monitoring will not alert you if someone uses your Social Security number to file a tax return and collect your refund.[1] The IRS's own free tool for that risk is the Identity Protection PIN (IP PIN): a six-digit number, known only to you and the IRS, that prevents someone else from filing a return using your Social Security number (SSN) or individual taxpayer identification number (ITIN).[2] Anyone with an SSN or ITIN who can verify their identity is eligible.[2]
Why a credit freeze or monitoring does not cover this
A tax return is filed with the IRS, not with a lender, so it does not appear as a new credit account. The FTC lists "file a tax return and collect your refund" among the things credit monitoring and most identity monitoring will not alert you to.[1] See is paid identity theft protection worth it? for the full comparison.
What an IP PIN is
- A six-digit number known only to you and the IRS. It helps the IRS verify your identity when you file an electronic or paper return.[2]
- You may get one as a proactive step even if you are not required to file a return.[2]
- Parents and legal guardians can request one for a dependent.[2]
How to get one
| Route | What the IRS says |
|---|---|
| IRS online account | The fastest way. Request it in the IP PIN section of your profile page; if you do not have an account, you must register and validate your identity. Anyone under 18, or requesting for a dependent under 18, must use an alternative option.[2] |
| Form 15227 (if you cannot set up an online account) | Available if your adjusted gross income on your last filed return is below $84,000 (individual) or $168,000 (married filing jointly). You need a valid SSN or ITIN and access to a telephone; the IRS calls to validate your identity, and the PIN is mailed, usually within four to six weeks.[2] |
| In person | If you cannot verify online or by Form 15227, or are not eligible for that form, you can make an appointment at a Taxpayer Assistance Center. Bring one government-issued photo ID and one additional form of identification. The PIN is mailed, usually within three weeks.[2] |
Alternative routes take longer than the online account, according to the IRS.[2] Eligibility limits and processing times are the IRS's and can change; check the IRS page before relying on them.
Using it
- An IP PIN is valid for one calendar year, and a new one is generated each year.[2]
- If you opted in online, you retrieve it online each year; it is generally viewable in your online account from mid-January through mid-November. If the IRS enrolled you because you were a confirmed victim of tax-related identity theft, it mails a CP01A notice with the new PIN each year.[2]
- It must be used on any federal return filed during the year, including prior-year returns, and is entered on Forms 1040, 1040-NR, 1040-PR, 1040-SR, and 1040-SS.[2]
- An incorrect or missing IP PIN means an e-filed return is rejected, or a paper return is delayed until it can be verified.[2]
- Share it only with your tax professional, and only when you are ready to sign and submit your return. The IRS says it will never ask for your IP PIN, and calls, emails, or texts asking for it are scams.[2]
- The IRS also describes a one-time enrollment option, under which you are opted out of the program at the end of the calendar year. See the IRS page for how it works and whether it suits you.[2]
If you think a return was filed using your information
The IRS's Identity Theft Affidavit, Form 14039, is for victims of identity theft in specific situations. Section B lists them:[3]
- you know or suspect someone used your information to fraudulently file a federal tax return;
- you or a dependent was fraudulently or incorrectly claimed as a dependent; or
- your SSN or ITIN was fraudulently used for employment purposes.
The form says that if your situation is not one of these, you should not file it; you can report the identity theft to the FTC at IdentityTheft.gov instead. It also says not to file another Form 14039 for the same incident, and that a dependent's identity misused by a parent or guardian in filing taxes is not identity theft for this purpose.[3] The form can be mailed, faxed, or completed online, and the IRS explains its process for victims at IRS.gov/victimassistance.[3] If you received an IRS notice or letter, the form has a box for the notice number.[3]
What to do next, step by step
- Decide whether to request an IP PIN, and use the online account route if you can.[2]
- If you receive an IRS notice about a return you did not file, read it and respond using the instructions on it.[3]
- If a situation in Section B applies, consider Form 14039; otherwise report at IdentityTheft.gov.[3]
- For the credit side of identity theft, see credit freezes, locks, and fraud alerts and blocking identity theft items.
What this page does not cover
It covers federal tax identity theft only. It does not cover medical or benefits identity theft, state tax returns, or how the IRS resolves an individual case. It is general information, not tax or legal advice; a tax professional or the IRS can address your situation.
When we will update this page
We revisit it when the IRS changes the IP PIN program, its eligibility or enrollment routes, or Form 14039. IRS page last reviewed 4 August 2026; read 1 October 2026.
What you can do next
- Find a company — see which specific US companies we checked and what we could verify.
- How we check — the rules and sources behind each result.
- More credit help guides
- Report an error on this page or in a result.