IP PINs: How this IRS security tool could help protect you from identity theft

Ever try to file a tax return online with the IRS only to find your efforts blocked, with the IRS saying that someone with your same Social Security number and name already filed? You might be the victim of tax-related identity theft.

In this type of identity theft, someone uses your stolen personal information, including your Social Security number, to file a tax return in your name. The goal of these criminals? To claim your tax refund.

You can reduce the odds of this happening to you, though. The IRS offers taxpayers a tool to help prevent tax-related identity theft: an Identity Protection Personal Identification Number, better known as an IP PIN. 

What is an IP PIN?

Starting in 2021, the IRS made IP PINs available for all taxpayers. In the past, only taxpayers who had previously been victims of identity theft were eligible for this tool.

IP PINs are designed to make it more difficult for thieves to file false tax returns in the names of other taxpayers. These PINs are unique six-digit numbers. When you file your return with an IP PIN, it provides the IRS with additional information to verify your identity.

Identity thieves, then, would need to know not just your Social Security number, but your IP PIN, too, to file a return in your name.

Each taxpayer’s IP PIN lasts for a year. The following year, taxpayers will have to sign up for a new IP PIN that they will use when filing that year’s income tax returns.

How to get your IP PIN

The easiest way to get an IP PIN is to log onto the Get an IPN tool offered by the IRS. To get a PIN, you will have to verify your identity. This means that you'll have to register an online account with IRS.gov, a process that the IRS says takes about 15 minutes.

To register, you'll need to provide your email address, Social Security Number or Individual Tax Identification Number, tax filing status, mailing address, and one financial account number linked to your name.

That financial account number can be the last eight digits of your credit card, as long as it's not an American Express, debit, or corporate card; the account number listed on your student loan statement; the account number on your mortgage or home equity loan; account number of your Home Equity Line of Credit; or the account number of your auto loan.

You will also need to provide a mobile phone number linked to your name so that the IRS can send you an activation code. If you can't provide this, the IRS will send your activation code to you by mail.

If you are a confirmed victim of identity theft, the IRS will mail you a CP01A Notice with a new IP PIN each year. This process will be automatic.

Your IP PIN will be valid for one calendar year, so you'll need to obtain a new one each year if you want to remain in the program. The IRS says that its Get an IP PIN online tool is usually unavailable from the middle of November through the middle of January each year for maintenance.

How to request an IP PIN offline

If you can't register for an IP PIN online, you can ask for one through the mail, though there are limits. If your income is $72,000 or less, you can file IRS Form 15227, Application for an Identity Protection Personal Identification Number.

To do this, you'll need a Social Security number or Individual Taxpayer Identification Number, an adjusted gross income of $72,000 or less and access to a telephone.

You can also make an appointment for an in-person meeting at your nearest Taxpayer Assistance Center. You'll need one picture identification document and another identification document to prove your identity.

The IRS will, after verifying your identity, send you your IP PIN through the mail within three weeks.

What to do if you are a victim of tax-related identity theft

As the IRS says, tax-related identity theft occurs when an individual uses your personal information — including your Social Security number — to file a tax return in your name. The fraudsters behind this scam hope to snag whatever refund you had coming.

If you suspect that you have been the victim of tax-related identity theft, you should continue to pay your taxes and file your tax return. You might have to file a paper return even if you’d prefer to file electronically.

But how do you know if you’ve been victimized by this form of identity theft? First, you won’t be able to file your tax returns electronically. That’s because someone else has already filed a return in your name using your information. When you try to file, you’ll get a message from the IRS that your name and Social Security number have already been used to file a return.

Other signs you have been a victim of tax-related identity theft

There are other signs, though. You might get a letter from the IRS asking about a suspicious tax return that you did not file or you might receive a tax transcript in the mail that you did not request.

You might also receive a notice from the IRS saying that an online account has been created in your name even if you never created such an account or a message that your existing online account with the agency has been accessed or disabled.

If you get any of these notices, respond to them immediately. Call the number provided on the notice. Ignoring these notices won’t make the problem go away. Calling the IRS quickly, though, could mitigate any damage from the identity theft.

If you try to e-file your tax return and it is rejected because of a duplicate filing, complete IRS Form 14039, Identity Theft Affidavit. Fill out the form at IRS.gov, print it, attach the form to your paper tax return and mail that and your return to the IRS according to the instructions on the form.

You can also request a copy of your fraudulent tax return from the IRS. For more information about this, visit the IRS’ page on dealing with fraudulent returns. You should also visit IdentityTheft.gov to learn more about the steps you should take to protect yourself and your finances from identity thieves.