Representation before the IRS · Related Issues
Identity Theft
tax year · reviewed 2026-08-18 · I. Ohu
Tax-related identity theft has one central mechanism and one counter-intuitive instruction. The mechanism is the Identity Protection PIN, the only thing that reliably stops a return being filed in a taxpayer’s name. The instruction is that a victim keeps filing and keeps paying while the matter is worked out — freezing everything until the IRS sorts it out is the most damaging advice a representative can give.
The rule
What the IP PIN is. See the figures table (IRS, Get an identity protection PIN). Note the details that matter for filing: it is used only on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS; it must be used on any federal return filed during the year, “including prior year returns”; and a wrong or missing IP PIN “will result in the rejection of your e-filed return or a delay of your paper return until it can be verified.”
How it arrives, and the trap in that. See the figures table. Confirmed victims whom the IRS enrolled receive a CP01A Notice each year; a taxpayer who opted in and obtained the PIN online must retrieve it online each year, because no CP01A will be mailed.
How to get one. Three routes — see the figures table. The online account is the fastest. Anyone under age 18, taxpayer or dependent, must use one of the alternative routes.
Who may ask for it. “Don’t reveal your IP PIN to anyone. It should be known only to your tax professional and only when you are ready to sign and submit your return. The IRS will never ask for your IP PIN. Phone calls, emails or texts asking for your IP PIN are scams.”
Lost or not received. There is a process to view it online or have it reissued by mail. “Do not file a Form 15227 to apply for a new IP PIN” — Form 15227 is the application route, not the replacement route.
Steps for a victim. See the figures table (IRS, Identity theft guide for individuals). The instruction to file returns and pay tax as usual sits in that list alongside reporting the theft and getting an IP PIN.
Form 14039. The Identity Theft Affidavit is filed where the situation calls for it — the IRS says to “check if you should file” it rather than treating it as automatic, and a taxpayer already contacted by the IRS follows the instructions in that letter or notice instead.
Dependent identity theft. Where a dependent has already been claimed on another return, see the figures table for the e-filing rule that now applies. If the return cannot be e-filed, a paper return with supporting documents is filed, processing takes six to eight weeks, and any refund is delayed. Where the IRS audits the claim it will “make a determination, then assess any tax, penalties or interest on the person who made the incorrect claim.”
What the IRS cannot tell you. “Privacy laws: We can’t tell you who claimed your dependent. We can only disclose information for the return’s primary and secondary taxpayers.” That is the confidentiality rule operating (IRC § 6103), and it is not discretionary.
Deceased-person theft. File the final return(s) when due; send the credit bureaus a copy of the death certificate and have a “deceased alert” placed on the reports; watch them; and avoid putting information in an obituary that a thief could use.
Refund deposit limit. See the figures table — a fraud-prevention measure that also catches legitimate arrangements.
Current figures
| Item | Rule | Authority |
|---|---|---|
| The IP PIN | a six-digit number valid for one calendar year, with a new one generated each year; it is used only on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS, must be used on any federal return filed during the year including prior-year returns, and is generally viewable in the online account from mid-January through mid-NovemberTY2026 | IRS, Get an identity protection PIN |
| How it is delivered each year | a confirmed victim enrolled by the IRS receives a CP01A Notice with the new IP PIN each year; a taxpayer who opted in and obtained the IP PIN online must retrieve it online each year, because no CP01A is mailedTY2026 | IRS, Get an identity protection PIN |
| Routes to obtain one | 3 — through the IRS online account (fastest; required for anyone aged 18 or over who can validate identity online); by Form 15227 where adjusted gross income on the last filed return is below $84,000, or $168,000 for married filing jointly, with identity validated by telephone and the IP PIN mailed in about four to six weeks; or by an in-person appointment at a Taxpayer Assistance Center with two forms of identification, with the IP PIN mailed in about three weeksTY2026 | IRS, Get an identity protection PIN |
| Steps for a victim | stop interacting with the thief; update the Online Account password; follow the instructions in the IRS letter or notice; report the theft and follow the recovery steps at IdentityTheft.gov; get an IP PIN; keep records of letters, calls and emails; file returns and pay tax as usual; and check with the state tax agencyTY2026 | IRS, Identity theft guide for individuals |
| Duplicate-dependent e-filing | beginning with 2024 tax returns the IRS accepts e-filed Forms 1040, 1040-NR and 1040-SS even where a dependent has already been claimed on another return, provided the primary taxpayer on the second return includes a valid IP PIN — the dependent needs no IP PIN unless one was previously issuedTY2026 | IRS, Identity theft guide for individuals |
| Refunds per account | 3 refunds electronically deposited into a single financial account or pre-paid debit card; the fourth and subsequent refunds convert to a paper checkTY2026 | IRS, Direct deposit limits |
How it works in practice
Keep filing and keep paying. This is the instruction clients resist and the one that matters most. Suspending filing while a theft is investigated adds failure-to-file and failure-to-pay exposure to a problem the client did not cause. The IRS lists it plainly among the steps to take: “File returns and pay tax as usual.”
The IP PIN is annual, not permanent. A new one is generated each calendar year. There is no fixed number of years after which it stops — a taxpayer in the programme gets a new PIN every year for as long as they remain in it. The one-time enrollment option is the exception: it opts the taxpayer out at the end of the calendar year.
The delivery difference is where clients get stranded. A confirmed victim enrolled by the IRS gets a CP01A Notice each year and may reasonably wait for it. A taxpayer who opted in voluntarily online gets nothing in the post and must retrieve the number. Every filing season produces clients in the second category waiting for a letter that will never come. Ask which they are.
Prior-year returns need the current year’s PIN. The IP PIN in force is used on any federal return filed during the year, including a late 2022 return filed in 2026. Practitioners who look for “the 2022 IP PIN” are looking for the wrong number.
Mid-November matters. The IP PIN is generally viewable online from mid-January to mid-November. A client filing a late return in December who has not retrieved the number is outside the window, and that has to be planned around.
Nobody legitimate asks for it, including you — until signing. The IRS never asks for an IP PIN. Ask for it only when the return is ready to sign and submit, and tell the client why: a practitioner who collects it early is training the client to hand it over on request.
Form 15227 has an income ceiling and is not a replacement mechanism. It is the alternative application route for taxpayers below the adjusted gross income limits who cannot establish an online account, and the IRS says expressly not to use it to replace a lost IP PIN.
Under 18 cannot use the online route. A taxpayer or dependent under 18 must use Form 15227 or an in-person appointment. This comes up on dependent identity theft, where the affected person is a child by definition.
The duplicate-dependent rule changed and the old advice is now wrong. From 2024 returns, a second return claiming an already-claimed dependent can still be e-filed if the primary taxpayer includes a valid IP PIN. Rejection followed by paper filing and a six-to-eight-week wait is no longer the only path, and the difference to a client awaiting a refund is substantial.
Section 6103 limits what you can find out, and clients need telling. The IRS cannot say who claimed the dependent; it may disclose only as to the return’s primary and secondary taxpayers. Say so before the client builds a plan around learning the other claimant’s name.
The client who stopped filing
A client discovers in March that a return was filed in his name claiming a refund. His neighbour tells him not to file anything until the IRS resolves it. He follows that advice for two years.
Analysis. Bad advice, and the representative should have reversed it immediately. The IRS's own list of steps for a victim includes "file returns and pay tax as usual." Two years of non-filing adds failure-to-file and failure-to-pay penalties and interest to a problem the client did not create, and none of it is excused by the theft. The correct sequence was to report the theft, obtain an IP PIN, follow any IRS letter, keep records — and keep filing.
The IP PIN that never arrived
A client who opted into the IP PIN programme two years ago telephones in February to say her IP PIN letter has not come and she cannot file. She is certain she received one last year.
Analysis. She did — from her online account, not the post. Where a taxpayer opted in and obtained an IP PIN online, no CP01A Notice is mailed and the number must be retrieved online each calendar year. Only taxpayers the IRS enrolled as confirmed victims receive the CP01A. The answer is to log into the online account, where the current IP PIN appears on the profile tab; the answer is not a Form 15227, which the IRS says expressly is not the route to a replacement.
The child's return and the online account
A client's 15-year-old son had his identity used on someone else's return. The client tries to obtain an IP PIN for him through the online account and cannot.
Analysis. Expected. A taxpayer or dependent under age 18 must use one of the alternative enrollment options — Form 15227, subject to the adjusted gross income limits, or an in-person appointment at a Taxpayer Assistance Center. For the in-person route the parent brings picture identification plus a second form for themselves, and two forms for the dependent, such as a birth certificate and social security card. Neither alternative is fast; start now rather than in filing season.
The dependent already claimed
A client's 2025 return is rejected because her daughter has already been claimed on someone else's return. The client has a valid IP PIN. The prior-year practitioner tells her she must now paper-file and wait.
Analysis. Out of date. Beginning with 2024 tax returns the IRS accepts e-filed Forms 1040, 1040-NR and 1040-SS even where a dependent has already been claimed, provided the primary taxpayer on the second return includes a valid IP PIN — and the dependent needs no IP PIN unless one was previously issued to her. The client can e-file. Paper filing would have cost six to eight weeks of processing before the IRS even looked at the duplicate claim.
A victim keeps filing and keeps paying. Suspending compliance adds penalties the theft does not excuse.
An IP PIN is valid for one calendar year and is reissued annually — there is no fixed number of years after which it stops.
Opting in online means no CP01A Notice. Only IRS-enrolled confirmed victims get the letter; everyone else retrieves the number online each year.
The IRS will never ask for an IP PIN. Any call, email or text asking for one is a scam — and a representative should ask only at signature.
How this has changed
The duplicate-dependent e-file rule is new from 2024 returns. Previously a second return claiming an already-claimed dependent was rejected and had to be paper-filed. Now it will be accepted electronically where the primary taxpayer includes a valid IP PIN. Any guidance describing rejection-then-paper as the only route is describing the pre-2024 position.
The IP PIN programme is now open to everyone, not only confirmed victims. It began as a remedy for confirmed victims and is now available to any taxpayer who can verify identity. That expansion is why the two delivery routes exist and diverge — CP01A for IRS-enrolled victims, online retrieval for voluntary opt-ins.
The recovery route now runs through IdentityTheft.gov. The current step list says to “report identity theft” and “follow recovery steps on IdentityTheft.gov” — the Federal Trade Commission’s site — rather than naming a separate FTC complaint as a discrete step. Older material listing “file a complaint with the FTC” alongside contacting credit bureaus describes the same substance through a superseded interface.
Read the review dates. The IP PIN page relied on here was last reviewed 4 August 2026 and the identity theft guide 4 June 2026. Both are administrative pages that change without notice — the Form 15227 income thresholds in particular are adjusted, so verify them rather than carrying them forward.
Exam focus
Know that an IP PIN is a six-digit number valid for one calendar year, reissued annually, with no fixed end after a set number of years.
Know the delivery split: a CP01A Notice each year for confirmed victims the IRS enrolled; online retrieval each year for voluntary opt-ins, who get no letter.
Know the three routes to obtain one, that Form 15227 carries an adjusted gross income ceiling and is not the replacement route, and that anyone under 18 must use an alternative to the online account.
Know that a victim continues to file and pay as usual, and that Form 14039 is filed where the situation calls for it rather than automatically.
Know that the IRS will never ask for an IP PIN.
Know that IRC § 6103 prevents the IRS from telling a taxpayer who claimed their dependent — disclosure is limited to the return’s primary and secondary taxpayers.
Check yourself
1. How long is an IP PIN valid? (A) For the taxpayer’s lifetime (B) One calendar year, with a new one issued annually (C) Three years (D) Until the taxpayer opts out Answer: B. A new IP PIN is generated each year for the account; there is no fixed number of years after which issuance stops.
2. Which is NOT a recommended step for someone who suspects tax-related identity theft? (A) Responding to any IRS notice received (B) Reporting the theft and following the recovery steps at IdentityTheft.gov (C) Holding off on filing and paying until the matter is resolved (D) Obtaining an IP PIN Answer: C. The IRS lists “file returns and pay tax as usual” among the steps; suspending compliance adds penalties the theft does not excuse.
3. A taxpayer who opted into the IP PIN programme online has not received a letter with this year’s number. What should the representative do? (A) File Form 15227 for a replacement (B) Have the taxpayer retrieve the IP PIN from the IRS online account (C) File without an IP PIN (D) Wait for the CP01A Notice Answer: B. No CP01A is mailed to voluntary opt-ins, and the IRS says expressly not to use Form 15227 to apply for a new IP PIN.
4. A client with a valid IP PIN finds her dependent has already been claimed on another return for 2025. Can she e-file? (A) No — she must paper-file with supporting documents (B) Yes, because the primary taxpayer’s return includes a valid IP PIN (C) Only if the dependent also has an IP PIN (D) Only after the IRS resolves the duplicate claim Answer: B. From 2024 returns onward, and the dependent needs an IP PIN only if one was previously issued.
5. Can the IRS tell a taxpayer who wrongly claimed their dependent? (A) Yes, on written request (B) Yes, after the duplicate claim is resolved (C) No — disclosure is limited to the return’s primary and secondary taxpayers (D) Yes, if a police report is filed Answer: C. IRC § 6103 governs, and the IRS states the limit expressly.
Change log
- Initial publication from the IRS identity protection PIN page (last reviewed 4 August 2026) and identity theft guide (last reviewed 4 June 2026), and IRC § 6103.