Charles Trautman, EA · Since 1969

IP PINs and tax identity theft

A six-digit number from the IRS that keeps anyone else from filing a return in your name.

Tax identity theft is quiet. Someone files a return with your Social Security number in February, takes the refund, and is gone before you sit down with your own paperwork in March. The IRS has a free fix that works, and most people still haven’t used it. Here is how the theft happens, what the Identity Protection PIN does, how to get one, and what to do if it’s already too late for this year.

Current as of October 2026 · Figures are for tax year 2026

What it looks like The IP PIN IRS letters vs. scams If it already happened Colorado Questions

What tax identity theft looks like

You almost never find out from the thief. You find out from a rejection.

The usual first sign is an e-file rejection. We transmit your return, and within minutes the IRS sends it back with a code saying a return has already been filed under your Social Security number. Your return is fine; someone else’s got there first. The second version is just as common: your return is rejected because one of your dependents has already been claimed on somebody else’s return. Sometimes that is an ex-spouse or a relative who was supposed to ask first. Sometimes it is a stranger who bought the child’s number.

Other signs arrive by mail: an IRS letter about a return you didn’t file, a refund you didn’t ask for, or wages from an employer you never worked for. The thief’s return is usually simple and filed early, with a made-up W-2 and a refund sent to a prepaid card. You will still get your refund, but it can take months, and in the meantime you file on paper.

The Identity Protection PIN

Six digits, free, and it works the same way a second key works on a door.

An IP PIN is a six-digit number the IRS assigns to you. Any return filed under your Social Security number must then include it, electronically or on paper, or it is rejected on the spot. The thief doesn’t have your PIN, so the thief’s return bounces instead of yours.

The program used to be limited to confirmed victims. Today anyone can opt in, for continuing years or a single year, and you can get PINs for your spouse and each dependent. Children’s numbers are prime targets, because no one checks them for years. There are three ways to get one.

Three ways to get an IP PIN
Method	Who it’s for	How long it takes
IRS Online Account at IRS.gov/account	Anyone who can pass the online identity check (ID.me)	Minutes; the PIN appears on screen
Form 15227, by mail or fax	Adjusted gross income under about $84,000; the IRS calls you to verify	Several weeks; the PIN is mailed, usually for the next filing season
In person at a Taxpayer Assistance Center	Anyone who can’t use the first two; bring two forms of ID; appointment required	A few weeks for the PIN to arrive by mail

The online account is the fastest and the only method that lets you look up a lost PIN yourself. We recommend it for everyone who can manage the sign-up.

It changes every January

The IRS issues a new PIN each January, by mail (notice CP01A) or in your online account. Last year’s number will not work on this year’s return.

Your preparer needs it

We cannot e-file without it, and the IRS will not give it to us. Bring the CP01A notice or a screenshot from your account with your other tax papers.

If you lose it

Sign in to your online account and retrieve it. If you can’t, the IRS can mail a replacement, which takes a few weeks; late in the season that may mean filing on paper.

Give it to no one else

The IRS never calls, texts or emails to ask for your IP PIN. Anyone who does is a thief. Your preparer and your tax software are the only places it belongs.

Behind the scenes

Every return we e-file goes out with an identity check attached: the IP PIN if you have one, last year’s adjusted gross income, a driver’s license number, and the dependents’ numbers and birth dates. When a return comes back rejected, the code tells us whether the problem is a typo, a dependent claimed elsewhere, or a return already on file. We read that code before we call you, so the first thing you hear is what happened and what we’re doing about it. Call 303-734-1040 if a rejection lands on you.

IRS identity letters, and how to tell them from scams

The IRS does sometimes stop a return and ask you to prove you’re you. So do thieves. Here is the difference.

Letter 5071C or 4883C

The IRS received a return with your number, something looked off, and it will not process the return until you confirm you filed it. Letter 5071C sends you to an online verification tool; 4883C asks you to call a specific IRS number. Both come by U.S. mail, with a letter number in the corner.

What to do: respond promptly. If you filed the return, verify it and the refund proceeds. If you didn’t, say so; the IRS pulls the bad return and marks your account. Either way, bring us the letter first.

What a scam looks like

A phone call, text or email claiming to be the IRS. Threats of arrest. A demand to pay today by gift card or wire. A link to “claim your refund.” A request for your IP PIN or bank login. The IRS begins by mail and does none of these things.

Rule of thumb: if it’s urgent and it wants a number from you, it’s not the IRS. The current list of schemes is in our page on the Dirty Dozen tax scams.

When you’re not sure

Don’t call the number on a suspicious letter and don’t click anything. Look the letter number up at IRS.gov, or bring it in. Most letters are real; the scammers mostly use the phone.

If it already happened

Your return was rejected because a return is already on file. The refund is slow but it is not lost.

File on paper

A rejected return still has to be filed by the deadline. We print it, you sign it, and it goes in by mail. Keep the certified-mail receipt.

Form 14039

The Identity Theft Affidavit tells the IRS someone used your number. File it with the paper return unless the IRS has already written to you about the problem; in that case, answer the letter instead. Once the case is resolved, the IRS enrolls you in the IP PIN program automatically.

A dependent claimed by someone else

If the other filer is a relative, the IRS will eventually ask both of you to prove the child lived with you; school and medical records settle it. If it’s a stranger, get the child an IP PIN now. Who can claim a dependent.

Beyond the tax return

Report it at IdentityTheft.gov, freeze your credit, and check your Social Security earnings record for wages that aren’t yours. Expect the IRS side to take months.

Behind the scenes

Before we attach a Form 14039, we check whether the “duplicate” is really theft. Often a rejected dependent turns out to be the other parent, a grandparent, or the child filing their own return and claiming themselves by mistake. Those get fixed with an amended return and a phone call, not an affidavit, and the IRS case an affidavit opens is one you don’t want unless you need it.

The Colorado side

The state runs its own checks, and they catch real returns too.

The Colorado Department of Revenue verifies identity on its own, separately from the IRS. A state refund can be held while the department sends a letter asking you to confirm you filed. These letters are real and common, and answering promptly is the only way to release the refund. As with the IRS, Colorado does not phone or text to demand a number or a payment.

There is no state IP PIN. Protecting the federal return protects the state one in practice, because a Colorado return is built from the federal return. Bring us any Colorado letter along with the IRS ones. Colorado income tax basics.

Common questions

Should I get an IP PIN if nothing has happened to me?

Yes. It costs nothing and closes the door before anyone tries it. The one obligation it creates is remembering to bring the new number each year.

Do my spouse and kids each need their own?

Each PIN covers one Social Security number. A joint return with PINs for both spouses needs both; a child with a PIN needs it on whichever return claims them. Enrolling the children is the step most families skip.

My refund is held up by a 5071C letter. How long?

Once you verify, the IRS says to allow up to nine weeks for the return to finish processing. If you can’t verify online, the phone route takes longer. It is slow, but the refund does come.

Rejected, flagged, or just want the door locked?

We set up IP PINs with clients, read the rejection codes, and handle the IRS and Colorado letters that follow. In person in Lone Tree or remotely, year round.

Start Here 303-734-1040

Sources and where to check

This page is general information, current as of October 2026, and is not advice about your situation. Tax law changes every year. Confirm anything that matters to you with us or at the sources below.