Con Watch: Tax Identity Theft

Identity theft is a multibillion-dollar annual problem for the IRS, but it can become a very personal problem for its victims. Also known as stolen identity refund fraud, tax identity theft occurs when a criminal electronically files an income tax return in your name using your Social Security number along with a counterfeit W-2 that prompts a large, bogus refund for the criminal.  Identity thieves can obtain your personal information from a variety of sources, including data breaches, phishing scams, and the dark web — that part of the internet where criminals buy and sell goods and services, including personal data. Cybercriminals also use artificial intelligence to craft convincing phishing emails and text messages that appear to come from the IRS to trick victims into giving them personal ­information.

If an identity thief has filed a fraudulent tax return with your identifying information before you file your legitimate tax return, the IRS flags the tax return and rejects it as a duplicate filing. At that point, the tax return is referred to the Identity Theft Victim Assistance Unit, where the IRS will begin investigating the legitimacy of the returns.

Now for the bad news — the long wait.

The IRS’s Taxpayer Advocate Service has indicated that victims of ­income tax identity theft were expected to wait an average of 675 days for the IRS to resolve claims in 2024 — an increase of 119 days over the preceding year. With IRS staffing cuts, the problem is likely to be even worse this year.

To avoid fraud, the most important thing to remember is that the IRS will not initiate contact with taxpayers by email, text message, or phone. Never provide personal information in response to an email, text message, or phone call that purports to be from the IRS. Don’t reply, click links, or open attachments. If you have any thoughts that the communication might be legitimate, contact the IRS to confirm whether or not it is a scam at www.irs.gov/help/let-us-help-you.

So how do you protect yourself from income tax identity theft?

File early: First and foremost, file your return as soon as you can. If you file your income tax return before the identity thief does, you should be able to get your refund in a timely manner. However, income tax identity thieves are pretty prompt in filing their phony returns, so you should get a PIN from the IRS to use when filing your tax return.

Get an identity PIN: An Identity Protection PIN (IP PIN) is a unique six-digit number issued by the IRS — known only by you and the IRS — that prevents an identity thief from effectively filing an income tax return using your name and Social Security number. You must use this IP PIN to confirm your identity on your current tax return. It’s valid for one calendar year, and a new number is generated each filing season. The quickest way to get an IP PIN is to request it through your Online IRS account through the “Profile” page. If you don’t have an online IRS account, you should: go to www.irs.gov/payments/online-account-for-­individuals to get started.

The IRS started the Identity Theft Protection PIN program 15 years ago, but initially it was available only to people who were already victims of identity theft and to people living in a few specific states chosen by the IRS to test the program. Now anyone can and should obtain an IP PIN.

Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams.

This article is featured in the March/April 2026 issue of The Saturday Evening Post. Subscribe to the magazine for more art, inspiring stories, fiction, humor, and features from our archives.