Tax Identity Theft: How Criminals File Your Returns
Tax identity theft occurs when criminals use your Social Security number and personal information to file a fraudulent tax return with the IRS, typically claiming an inflated refund that gets deposited into an account they control. This crime has become increasingly sophisticated, with the IRS reporting over 1.3 million confirmed cases in 2023, resulting in nearly $5 billion in fraudulent claims. Victims often don't discover the theft until they attempt to file their own legitimate return and receive a notice of a duplicate filing. The crime is particularly dangerous because your tax information is updated annually, creating a recurring vulnerability, and resolution can take 6-12 months of back-and-forth with the IRS and creditors, even after the fraud is detected.
Common Tactics
- • Purchasing stolen Social Security numbers, dates of birth, and addresses from dark web markets or data breach collections, often bundled with W-2 information obtained from company database breaches.
- • Filing returns early in the tax season (January-February) before legitimate taxpayers typically file, increasing the chance the fraudulent return processes first and refunds are issued.
- • Claiming false deductions, inflated charitable contributions, and fabricated business expenses to maximize refund amounts, sometimes requesting $8,000-$15,000 in fraudulent returns per identity.
- • Using stolen email addresses to intercept IRS correspondence and password-reset links, maintaining control of the victim's tax account for extended periods.
- • Redirecting refunds to prepaid debit cards, money mule accounts, or cryptocurrency wallets that are emptied within hours before law enforcement can intervene.
- • Operating organized rings that file 100+ fraudulent returns daily using lists of stolen identities, with specialists handling account setup, filing, and money movement.
How to Identify
- You receive an IRS notice indicating a tax return was already filed under your name when you haven't filed yet, particularly notices of duplicate filings or rejected returns.
- The IRS sends you a CP01H notice or letter stating they received a tax return for your SSN that doesn't match the one you're preparing to submit.
- Your employer's W-2 information appears on a fraudulent return you didn't file, visible when you request tax transcripts from the IRS website.
- You receive unexpected refund notifications or correspondence about a tax return you have no knowledge of filing.
- Your email account shows login attempts from unfamiliar locations, especially around tax season, or you notice tax-related documents missing from your email.
- The IRS delays your legitimate refund or rejects it with messages about mismatched Social Security numbers or duplicate filings already being processed.
How to Protect Yourself
- File your tax return as early as possible in the tax season to establish your legitimate filing before criminals can submit a fraudulent one under your name.
- Request an Identity Protection PIN (IP PIN) from the IRS annually by visiting IRS.gov/IPPIN, which creates a unique 6-digit code scammers must provide to file returns in your name.
- Place a fraud alert or credit freeze with all three major credit bureaus (Equifax, Experian, TransUnion) to prevent criminals from opening accounts using your stolen information.
- Enable two-factor authentication on your IRS.gov account and email accounts, using authenticator apps rather than SMS when possible to block SIM-swap attacks.
- Monitor your credit report quarterly using free services like AnnualCreditReport.com and watch for suspicious W-2s or accounts you didn't open.
- Register with the IRS's Get Transcript service to receive alerts whenever someone requests your tax transcripts, signaling potential fraudulent activity.
Real-World Examples
A software engineer discovers in February that someone filed a 2023 tax return claiming a $12,000 refund using his SSN and employer's W-2 information. The fraudster had obtained his information from a LinkedIn data breach and filed before he could. He spends 8 months with the IRS providing documentation, obtaining a new SSN, and resolving tax liens placed on his credit report by creditors confused about his identity.
A retiree receives an IRS notice that her tax return was rejected because one was already processed. Investigation reveals criminals used her information from a Medicare provider hack to claim false business deductions worth $9,500. She files a police report and works with an IRS victim advocate for 10 months while creditors contact her about fraudulent accounts opened using her newly leaked information.
A parent discovers their child's Social Security number was used to file a fraudulent return when applying for student loans. The refund was never received due to offset for government student loans, but the filing damages the child's tax history before adulthood. The family must file Form 14039 Identity Theft Affidavit and maintain documentation for years as the IRS investigates.