Nearly half a million Americans became victims of tax-related identity theft in 2024, according to a report from a taxpayer watchdog group. They waited an average of two years to receive their rightful tax return.
The delays were even worse than in 2023, when cases reported to the IRS Identity Theft Victim Assistance unit took almost 19 months to resolve, according to the Taxpayer Advocate Service.
Since the advent of e-filing, identity thieves have used sophisticated phishing schemes and large-scale data breaches to get sensitive information like Social Security numbers. Thieves then file falsified tax returns and claim refunds before the legitimate taxpayer has a chance to file.
“Before electronic filing, identity theft didn’t happen so often,” Christopher Amundson, president and founder of Accounting Solutions in North Park, said. ”When the IRS began allowing electronic filing, it turned into a problem, especially since they were doing quick turnarounds on refunds.”
This filing season, identity theft is projected to take an even larger toll on Americans, experts say.
The IRS has issued numerous alerts urging taxpayers to be vigilant for warning signs of identity theft. These signs include having a tax return rejected, receiving alerts about password resets or getting fraudulent log-in verification notices.
Having sensitive information leaked as part of a mass data breach could also put a person at risk for identity fraud, according to Andre Zagmout, founder of Zagmout & Company CPAs in the Loop.
“In this day and age in this digital world, our information is everywhere,” Zagmout said. “It’s unfortunate what’s going on. I just feel like it’s becoming quite prevalent.”
Protecting yourself against ID theft
While it’s not always possible to prevent identity theft, a few extra precautions can help you avoid becoming a victim.
Safeguard personal information
Avoid sharing personal information online. Never share sensitive information such as passwords and credit card numbers on unverified websites or unencrypted platforms. And don’t share sensitive information via phone or email unless absolutely necessary.
“Be very wary of any online form that asks for your Social Security number,” Ebe Osaigbovo, a certified public accountant and founder of SWM Planning in Forest Park, said.
The IRS will only contact taxpayers by mail. Unless you’ve given the IRS permission, any emails, calls or text messages claiming to be from the IRS are most likely fraudsters.
“The IRS does not call anybody, and nobody will knock on your door,” Zagmout said.
If using a tax preparation service, ask what kind of safeguards they have for their clients’ personal information.
“Sometimes tax preparers’ databases are hacked,” Osaigbovo said. “That’s why I have multiple layers of digital security for my clients and for my company.”
Use strong passwords
Ensure that online accounts are protected with complex, unique passwords that have a mix of uppercase and lowercase letters, numbers and special characters. Consider changing passwords on a regular basis.
Pay attention to data breaches
“Whenever you hear [about] a hack or a cyberattack online, a lot of people just dismiss it,” Zagmout said. “But people should pay attention to those headlines because if you attended a theater and their payment system was hacked, for example, the hackers may have access to your credit card information. We’ve heard in the news multiple times that hospitals were hacked. So we’re talking about Social Security numbers, health records.”
If a person’s information was part of a data breach or cyberattack, they should freeze their credit immediately and visit the federal government website IdentityTheft.gov to create an action plan to protect themselves.
File taxes early
Filing taxes as early as possible reduces the window of opportunity for criminals to submit fraudulent returns with your stolen information.
“Basically, it’s a race to see who’s going to file the return first: Will it be you or the fraudster?” Zagmout said.
Create an IRS account
A taxpayer’s information and their filing history are listed on their online IRS account, allowing them to monitor any activity and act quickly if fraud occurs.
“Not only do taxpayers have easy access to their tax information that can help at tax time, but securing their online account also blocks identity thieves from trying to access this information,” said Danny Werfel, former IRS commissioner who stepped down early from his post on Jan. 20.
“This is an important area for taxpayers to keep an eye on because we continue to see identity thieves trying to trick people into giving access to this valuable account.”
Obtain an identity protection PIN
The IRS offers an identity protection PIN to eligible taxpayers. The six-digit number must be used when filing a federal tax return and is valid for one calendar year, with a new pin assigned annually.
Without the pin, fraudsters can’t file and claim their victim’s refund. Zagmout said an IP PIN can give peace of mind, especially for taxpayers who may have to wait on 1099s or tax forms from investment accounts before filing.
“What I recommend to everyone — and this is a part of my spiel whenever I talk to a new client — is for them to obtain an identity protection PIN or IP PIN from the IRS,” Zagmout said.
You can request an IP PIN through your IRS.gov account.
What to do if you’re a victim of identity theft
If you suspect you’re a victim of tax-related identity theft, file an IRS Identity Theft Affidavit (Form 14039). The form is separate from the Federal Trade Commission affidavit, which is used for reporting any type of identity theft.
The IRS said victims should still file their returns and pay any taxes as usual.
Here’s what else to do:
- Victims might want to place a freeze on credit reports and closely monitor financial accounts for any suspicious activity. If credit cards or other accounts have been affected by identity thieves, consider filing a police report, Zagmout said.
- In-person appointments for help with identity theft can be made at a local IRS Taxpayer Assistance Center, Osaigbovo said.
- If a person is getting calls or emails asking for personal information, they should immediately stop interacting with the fraudster, according to the IRS. Don’t give them money or any personal or financial information. Don’t click links, open attachments; or go to websites with odd-looking URLs.
- Keep records of letters, phone calls and emails.
- Update passwords and follow the recovery steps on IdentityTheft.gov.
- If victims receive a letter from the IRS regarding their return, verify it’s an official letter before following the instructions. “The IRS will send a letter or notice when we suspect identity theft on a tax return. Sometimes, getting your mail is a taxpayer’s first sign they could be affected by identity theft,” IRS spokesperson Adolfo Flores said. The IRS will contact taxpayers to attempt to verify income, withholding or employment if tax-related identity theft is suspected.
- Victims may consider hiring an accountant or another expert representative to help them through the process. “[Victims] need to find a competent accountant to actually get them through this because trying to do it yourself is tortuous,” Amundson said. “You’re going to need help on this, it’s not an easy process.”
While the IRS will assist taxpayers who become victims of identity fraud, be prepared to wait awhile for the case to be resolved.
“Most of the time, if not all of the time, folks do get their money back. But again, it may take a year to get the refund back,” Zagmout said.
