How to Protect Your Tax Refund from Thieves

Tax season is no one’s idea of a fun time, but it can get downright painful if you become a victim of tax-related identity theft. This happens when criminals use your personal information to file a fraudulent tax return under your name and Social Security number in order to have a refund sent to their account. 

Once rampant, the Internal Revenue Service has taken successful action to detect and prevent tax identity fraud since 2015, but it still happens. Battling fraud from identity theft continues to be a major challenge for the IRS, according to a July 2020 report from the Treasury Inspector General for Tax Administration.

Here’s what you can do to help prevent thieves from stealing your identity and filing a fraudulent return.

How to Know if You’ve Been a Victim of Tax-Related Identity Theft

Most people find out they have been pawns in this scheme when they try to file their return electronically and it’s rejected because a return has already been filed under their Social Security number. You may also get a notice from the IRS asking about a suspicious tax return.   

If you get a suspicious tax return notice from the IRS, it means a return filed in your name was flagged by processing filters and set aside for review. The IRS will hold your return and send you one of four letters. Depending on which notice you receive, it will instruct you to verify your identity online, by phone, or in person at an IRS Taxpayer Assistance Center. It may also ask you to confirm you submitted the return in question. In 2019, 63 percent of returns flagged for potential identity theft were verified and released, according to a report from the National Taxpayer Advocate, the arm of the IRS that represents taxpayers. Most returns are released shortly after taxpayers verify their identities, but the IRS warns that refunds could be delayed for up to nine weeks.

If someone has filed a return under your Social Security number, you can get a copy of the return by filing form 4506-F. If the fake return includes an address, don’t attempt to confront the thief.

How Thieves Get Your Data

Thieves usually get the information they need to file a tax return in your name or commit other identity crimes by infiltrating company or government websites (called data breaches) or purchasing it on anonymous websites known as the dark web. They can also trick people into divulging personal information by sending texts or emails that appear to come from your bank, employer, a government agency, company you’ve done business with, or even the IRS. Scammers have also duped human resource personnel into divulging employees’ personal and wage data.

Smart Tip: AAA Members get identity protection free with Membership.

How to Prevent Tax-Related Identity Fraud

You can stop an identity thief from opening new credit accounts in your name by freezing your credit reports at the three major credit bureaus, but this won’t prevent a crook from using stolen data to file a tax return in your name. Instead, take the following steps to guard your identity and thwart fraudulent filings.

1. Protect your personal information.

• Never respond to phone calls, texts, or emails asking for personal information unless you initiated them. Don’t click on any texts or open any attachments in these emails. The IRS will only initiate contact with you by mail.
• Take steps to protect your privacy online and avoid common scams.
• If you pay someone to do your taxes, make sure the person has a Tax Preparer Identification Number.

2. File early.

If possible, file your return early in tax season to beat any potential crooks to the finish line or to catch a fraudulent filing sooner.

3. Use a personal identification number to file.

Originally, the IRS only issued identity protection personal identification numbers to confirmed identity theft victims, but in January 2021, the IRS announced it would begin issuing IP PINs to anyone who has a Social Security or Individual Taxpayer Identification Number and can verify their identity. To apply online, go to IRS.gov/IPPIN. 

Once you opt into this program and pass a rigorous identification process, the IRS will mail you a new six-digit IP PIN every year that must be used on that year’s return or the IRS will reject an e-filed return and delay a paper-filed one. There is no way to opt out, although the IRS says it is working on one.

If you lose or forget your PIN and you don’t have an account set up, getting a replacement can be a big hassle, says Brian Krebs, author of the website Krebs on Security, but he still recommends getting one. “My personal philosophy is, if you give a piece of data to a company, eventually they will lose it, be relieved of it, sell it—somehow it will get out. There’s not a lot you can do to protect yourself [from data breaches].”

Velasquez also says IP PINs are worth the trouble, but they might not stop thieves from filing a state-tax return in your name, even if you live in a state with no income tax. Thieves could potentially file a tax return under your Social Security number in multiple states that do have an income tax to get themselves a refund.

What to do if You’re a Victim of Tax Identity Fraud

If you are a victim of any type of identity theft, you should:

• File a complaint with the FTC at identitytheft.gov;
• file a police report;
• freeze your credit reports at Experian, Equifax and TransUnion.

Not all data breaches expose Social Security numbers. But if your number is compromised and you know or suspect you are a victim of tax-related identity theft, take these additional steps:

• Respond immediately to any IRS notice; call the number provided. If you previously contacted the IRS and did not have a resolution, call its specialty fraud unit at 1-800-908-4490.
• If you e-file your return and it’s rejected because a return has already been filed under your Social Security number, complete IRS Form 14039, Identity Theft Affidavit, and mail it with a paper version of your tax return. The IRS will investigate the fraud, clear the account, and process your paper return. You should also complete this form if an IRS letter tells you to.
• Check with your state income tax agency for instructions on how to report actual or potential tax-related identity theft.

How to Get Your Refund if Yours Has Been Stolen

If a return has already been filed in your name, you won’t be able to file your own electronically or get a refund, if one is due, until the problem has been remediated with the IRS, says Eva Velasquez, CEO of the nonprofit Identity Theft Resource Center, which provides free one-on-one help to identity theft victims. 

“Generally speaking, most people are made whole, but the resolution times are wildly inconsistent,” Velasquez says. While some people may be able to get the issue resolved in weeks or months, it can take more than a year in some cases. “We have talked to people who are distraught because they haven’t resolved this from last year and [they] can’t e-file this year’s return,” she says. To reduce the impact of a potential extended wait for a refund, Velasquez advises taxpayers to structure their withholding to closely match their tax due rather than using refunds as forced savings.