How to Protect Your Identity When Filing Taxes Online (2026 US Guide)

The raw material for this crime is a Social Security number paired with a name, date of birth, and address — data that has been exposed repeatedly through large corporate and government breaches over the past decade. Criminals don't need to hack the IRS; they need only enough personal information to pass the agency's basic identity checks on a fraudulent e-filed return, and they often buy that data in bulk on criminal marketplaces.

Because the IRS processes returns largely on a first-filed basis and refunds can be issued before every cross-check is complete, a fraudulent return filed in late January can be processed and paid out weeks before the real taxpayer, who typically files closer to the April deadline, ever submits their own return. The victim's first sign of trouble is usually an e-file rejection notice stating that a return with their Social Security number has already been filed.

The FBI's Internet Crime Complaint Center (IC3) publishes an annual Internet Crime Report that tracks broader identity theft and impersonation losses reported to the Bureau, and tax season reliably produces a spike in phishing and impersonation complaints tied to refunds, stimulus-style payments, and 'problem with your return' lures.

The IP PIN program began as a remedy offered only to confirmed identity theft victims, but the IRS has since opened it to any taxpayer who can verify their identity, either online through the IRS's identity-verification portal or in person at a Taxpayer Assistance Center. Once enrolled, you receive a new six-digit PIN each filing season, and any return — paper or electronic — filed under your Social Security number without the correct current-year PIN is rejected outright.

The tradeoff is operational discipline: lose track of your IP PIN and you cannot e-file until you retrieve it, which for some taxpayers means a paper filing with extended processing delays. The IRS provides an online 'Get an IP PIN' retrieval tool, so keeping access to the email address and phone number tied to your IRS online account matters as much as the PIN itself.

Because the IP PIN is tied to the calendar year and must be re-entered on every subsequent return, it also protects against a criminal who obtains your data mid-year and waits for the next filing season — the PIN changes annually, so old compromised numbers stop working.

• Enroll through the IRS 'Get an IP PIN' online tool, which requires identity verification similar to other IRS.gov account setups.
• Write down or securely store the PIN each year — the IRS will not re-send a lost PIN by email.
• Confirm your tax software or preparer has a field for the IP PIN; omitting it does not disable the protection, but entering it incorrectly can cause a rejection.
• If you are a confirmed identity theft victim, the IRS may issue you an IP PIN automatically after your case is resolved.

If your e-filed return is rejected because a return has already been filed under your Social Security number, or you receive an IRS notice referencing a return, wages, or a refund you did not file or claim, Form 14039 is the starting point. It can be submitted online through the IRS's Identity Theft Affidavit portal or mailed with a paper return if you must file that way while the case is pending.

Filing the affidavit does not itself produce a fast refund — identity theft cases can take many months for the IRS Identity Theft Victim Assistance unit to resolve, because the agency has to determine which return is legitimate, unwind any fraudulent refund already issued, and process your real return separately. Patience and a paper trail — confirmation numbers, mailing receipts, notice copies — matter more than speed here.

Once your case is resolved, the IRS typically issues you an IP PIN for future years automatically, closing the loop so the same Social Security number cannot easily be reused by the same criminal group.

Free File is only secure if you reach it the right way: through the official list on IRS.gov, which links directly to each participating company's authorized Free File landing page. Search ads and unsolicited emails that claim to offer 'IRS Free File' can lead to lookalike sites designed purely to harvest Social Security numbers and bank routing details.

Commercial tax software companies are themselves attractive targets, and the industry has periodically tightened login requirements — including multi-factor authentication — in response to account takeover attempts where criminals reuse stolen passwords to log into an existing tax software account, view prior-year returns, and refile with updated bank details for the refund.

Whichever software you use, the account is a financial account in every meaningful sense: it holds your Social Security number, dependents' Social Security numbers, income history, and bank account and routing numbers. Treat the login credentials with the same care as your bank's.

Filing season reliably produces a wave of emails and texts claiming a refund is 'pending verification,' a return has an 'error,' or a payment is 'overdue,' each with a link to a page that asks for a Social Security number, date of birth, and banking details. The IRS's own guidance is unambiguous: initial contact about a tax matter comes by postal mail, not email or text, and legitimate IRS employees do not threaten immediate arrest or demand a specific payment method over the phone.

The FTC and the Treasury Inspector General for Tax Administration (TIGTA) both track impersonation scams that use IRS branding, fake badge numbers, and spoofed caller ID to pressure victims into paying fake 'tax debts.' If you receive a suspicious email claiming to be from the IRS, forward it to phishing@irs.gov without clicking any links, and report phone scams to TIGTA.

A useful rule of thumb: any tax-related message that creates urgency ('act within 24 hours'), demands an unusual payment method, or asks you to confirm a Social Security number by email is fraudulent by definition, because none of those are things the real IRS does.

• Forward suspicious IRS-branded emails to phishing@irs.gov, then delete them.
• Never click a link in an unsolicited text or email claiming to be about your refund or a tax notice.
• Verify any phone call claiming to be from the IRS by calling the agency's published number directly, not one given to you by the caller.
• Report phone impersonation scams to the Treasury Inspector General for Tax Administration.

A paid preparer is, by necessity, entrusted with your full Social Security number, your dependents' Social Security numbers, income documents, and often direct deposit information — making a dishonest or careless preparer one of the most damaging points of failure in the entire filing process. Every legitimate paid preparer must sign your return and include their PTIN.

The IRS publishes a searchable directory of federal tax return preparers with credentials and select qualifications, which can confirm a preparer holds an active PTIN and, where relevant, is an enrolled agent, CPA, or attorney. A preparer who refuses to sign the return, asks you to sign a blank return, or bases their fee on a percentage of your refund are all recognized red flags the IRS itself warns about.

Ask how the preparer secures client data year-round — encrypted storage, not emailed spreadsheets of Social Security numbers — since many smaller preparation shops have been the entry point for identity theft rings precisely because their client files were an easy, undefended target.

Password reset flows are the quiet backdoor into most account takeovers. If a criminal compromises the primary email account linked to your tax software, they can typically trigger a 'forgot password' email, take over the tax account itself, and view or refile using data already stored there — all without ever guessing your original tax software password.

That makes the email account, not just the tax software login, part of your tax security perimeter. Use a unique password for that inbox (never reused from another site), enable multi-factor authentication on the email provider, and remove any old, forgotten recovery phone numbers or backup emails you no longer control.

This is also the account where you should expect to receive real notices from your tax software provider and, in limited cases, from the IRS about your online account — so it needs to be an inbox you check reliably during filing season, not one you've abandoned.

The Cybersecurity and Infrastructure Security Agency (CISA) and the FTC both recommend MFA as a baseline defense, and tax software providers have increasingly required it in response to prior-year account takeover incidents where stolen login credentials from unrelated breaches were reused against tax accounts.

An authenticator app or a hardware security key is a stronger second factor than SMS text codes, since SIM-swapping attacks can intercept text-based codes; where the option exists, prefer an app-based or hardware token over SMS for tax and financial logins.

Setting up the IRS's own online account — used to view transcripts, payment history, and IP PIN status — also requires identity verification and supports MFA, and having that account under your control before a criminal tries to create one in your name is itself a form of prevention.

• Enable MFA on your email provider first, since it protects every account that uses that email for recovery.
• Enable MFA on your tax software account and your bank account.
• Prefer an authenticator app or hardware key over SMS codes where the service offers a choice.
• Create your own IRS Online Account proactively rather than leaving that identity slot open for a criminal to claim first.

Tax season generates a predictable wave of lead-generation marketing: 'estimate your refund' calculators, mortgage and insurance quote widgets bundled into tax content, and downloadable tax-prep checklists that exist mainly to capture an email address for a nurture sequence. None of that correspondence is a business record you need to retrieve later, and none of it should require a durable, recoverable inbox — a disposable address contains the resulting spam without giving up your real identity to a marketing database.

The tax software account itself is the opposite case. It is a financial account containing your Social Security number and bank details, it is subject to a genuine recovery need (you must be able to reset the password and retrieve prior-year returns for years afterward), and it is the exact kind of account regulators like the FTC warn against pairing with an inbox you can't reliably access. A lost or unmonitored recovery email on a tax account can mean losing access to prior-year returns entirely, or worse, missing the one email that would have alerted you to a fraudulent login.

The same logic applies to your preparer relationship and your IRS online account: both require durable, monitored correspondence with real identity verification behind them, which is precisely what a disposable inbox is not designed to provide.

Tax identity theft and broader identity theft frequently travel together: the same breached Social Security number that fuels a fraudulent tax return is often used to attempt new credit card or loan applications. Freezing your credit with all three bureaus separately (a freeze with one bureau does not cover the others) closes that second door at no cost, under protections established following the Economic Growth, Regulation, and Consumer Protection Act.

A freeze does not affect your tax filing or refund, and it can be temporarily lifted whenever you need to apply for legitimate credit. Pair it with the free weekly credit reports available from all three bureaus through AnnualCreditReport.com, the site authorized under federal law, and review them for accounts you don't recognize.

The Consumer Financial Protection Bureau (CFPB) and FTC both publish guidance distinguishing a credit freeze (blocks new account openings) from a fraud alert (requires lenders to verify identity before extending credit) — a freeze is the stronger of the two and is generally recommended once you suspect any identity exposure.

• Freeze your credit at Equifax, Experian, and TransUnion individually — each requires its own request.
• Freezes are free and do not affect your ability to file taxes or receive a refund.
• Pull your free credit reports through AnnualCreditReport.com and check for unfamiliar accounts.
• Lift the freeze temporarily, at a specific bureau, whenever you legitimately apply for credit.

If you discover tax-related identity theft, IdentityTheft.gov should be used alongside — not instead of — Form 14039. The FTC's process addresses the broader identity theft picture (credit accounts, benefits fraud, and other misuse of your Social Security number), while Form 14039 addresses the tax-specific fraudulent return.

The site walks victims through reporting the theft, creating a recovery plan tailored to what was stolen, and generating documentation that many banks, credit bureaus, and other institutions will accept as proof when you dispute fraudulent activity elsewhere.

Because tax identity theft is frequently just one symptom of a broader data compromise, treating the FTC's recovery plan as the master checklist — with the IRS-specific steps folded in — keeps you from missing follow-on fraud in your bank, benefits, or employment records.

A fraudulent federal return is often accompanied by a fraudulent state return, since the same stolen Social Security number and address work in both systems. Victims sometimes focus entirely on the IRS process and miss that their state revenue department needs its own notification and its own version of an identity theft affidavit.

The IRS coordinates with state tax agencies and the tax preparation industry through the Security Summit, a public-private partnership formed to share fraud indicators and strengthen safeguards across both federal and state filing systems — a reminder that the fraud economy behind this crime doesn't respect the federal-state line, and neither should your response.

If you're a victim, contact your state's department of revenue or taxation directly (most publish a dedicated identity theft or fraud reporting line) in addition to the federal steps, and ask specifically whether a state-level PIN or additional verification step is available, since several states have adopted programs modeled on the IRS's IP PIN.

Most tax identity theft is opportunistic rather than targeted: criminals exploit whichever taxpayers have the weakest defenses at scale, which means a handful of basic steps taken before you file remove you from the easiest-to-hit group entirely.

Treat this as a once-a-year ritual alongside gathering your W-2s and 1099s, not a one-time setup — PINs rotate annually, preparers change, and recovery emails go stale.

• Enroll in or reconfirm your IRS Identity Protection PIN before you start your return.
• Verify any paid preparer's PTIN in the IRS's public preparer directory.
• Enable multi-factor authentication on your email, tax software, bank, and IRS Online Account.
• Confirm the recovery email and phone number on your tax software account are current and monitored.
• File early in the season if you're able to, since an early legitimate filing blocks a later fraudulent one.
• Freeze your credit with Equifax, Experian, and TransUnion if you haven't already, and check your free credit reports.
• Use a disposable email address for refund calculators and tax-adjacent marketing signups, never for your tax software login.
• Save phishing@irs.gov and the TIGTA scam-reporting number so you can report impersonation attempts immediately.