How you find out
Most people discover tax identity theft one of three ways: their e-filed return rejects because a return already exists under their SSN, an IRS letter arrives about a return or refund they never filed, or a 5071C identity verification letter shows up asking them to confirm a suspicious filing. Each of those is the same underlying event seen from a different angle: someone used your number.
What to do immediately
File Form 14039 Identity Theft Affidavit. Continue filing your return via paper with the affidavit attached. Report to FTC at IdentityTheft.gov and place a fraud alert with credit bureaus. Your real return still counts as filed on time when mailed by the deadline, even though processing will be slow.
The 5071C letter is a different animal
A 5071C means the IRS caught a suspicious return before processing it and wants you to verify your identity online or by phone before anything moves. If the flagged return is yours, verification releases it. If it isn't, saying so starts the identity theft process without needing to chase a refund that already went out the door. Respond promptly either way; the return sits frozen until you do.
The IP PIN, your lock on the account
An Identity Protection PIN is a six-digit code, issued annually, that must accompany any e-filed return under your SSN; without it, fraudulent returns bounce. Confirmed identity theft victims are enrolled automatically, and anyone can opt in voluntarily through the IRS online account. Once you're in the program, guard the annual PIN like a password; your preparer needs it every filing season.
The timeline
IRS identity theft resolution takes 180+ days currently. Your legitimate refund arrives when processing completes. Future-year filings with IP PIN usually proceed normally. Request an IP PIN for all future years as part of the cleanup, and keep copies of every letter in the case file; duplicate requests for documents you already sent are common.
Common questions
- How does tax identity theft happen?
- Usually a compromised SSN from a data breach. Someone files early using your info to claim a fraudulent refund.
- What is a 5071C letter?
- An identity verification request. The IRS flagged a return under your SSN as suspicious and won't process it until you verify online or by phone. It's the system working, not a penalty.
- Will I still get my refund?
- Yes. Once the IRS confirms which return is genuinely yours, your refund is released with the case. The wait is the penalty; the money itself isn't lost.
- Should my spouse get an IP PIN too?
- Yes. Each taxpayer enrolls separately, and a joint return is only as protected as the least-protected SSN on it.
Related
Related tax topics
Responding to an IRS CP2000 Notice
A CP2000 is an automated IRS underreporter inquiry: third-party income doesn't match your return. You have 30 days to respond. How to agree or dispute.
Responding to an IRS CP14 Balance-Due Notice
The CP14 is the first balance-due letter after filing. Pay within 21 days, dispute the amount, or set up an installment agreement before collection escalates.
Responding to an IRS CP501 Reminder
The CP501 is a first reminder that your balance is still due, with interest and penalties accruing. Ignore it and CP503, then CP504 (intent to levy) come next.
Responding to an IRS CP503 Second Reminder
CP503 is the IRS's second reminder of unpaid tax. CP504, the intent to levy, comes next. An installment agreement set up now avoids the intent-to-levy stage.