Editor's note: Darrin T. Mish was admitted to The Florida Bar in October 1993 and founded his firm in 1996. Any length of practice mentioned in this video reflects when it was recorded (published May 3, 2026).
If someone filed a tax return using your Social Security number, or you found out a refund was claimed in your name, that's a serious problem, but it's not something that you fix by panicking. What you need to do in that situation is have a clear process. So in this video, I'm going to walk you through what tax-related identity fraud usually looks like, what you need to do first, and how to protect yourself while the IRS gets the case sorted out.
Let's get into it. Most people don't go looking for this problem. The problem finds them. Usually it shows up as a letter from the IRS, something like a 5071C or a 4883C, telling you that a return was filed in your name and that they need you to verify your identity before they process it. Or you go to e-file your own return and the IRS rejects it because according to their records, you already filed.
Or you log into your IRS transcript and see wages from an employer you've never heard of. Some people find out because a refund they were expecting never arrives. Others get a CP2000 notice saying they underreported income that they never earn. And the first reaction is always the same. People panic. They assume their refund is gone. They assume their credit is already destroyed. They assume the IRS thinks they did something wrong.
I want you to take a breath because none of these things are true just because this showed up. What's true is that somebody used your information and now you have some work to do. And here's the part most people miss. What happened to you is an attacks problem. It's an identity theft problem that happens to have tax consequences. Somebody got ahold of your Social Security number, your name, probably your date of birth, and they used it to file a tax return and steal a refund.
That's the visible piece. The invisible piece is that whoever has that information doesn't stop at tax refunds. The same data that got used here can be used to open credit cards, apply for loans, file fake unemployment claims, or run up medical bills. So when you're thinking about what to do, you don't think of it as I need to straighten out this tax return. Think of it as someone has my identity and the tax return is the first place it showed up.
That's a very different problem and it's why the response has to go wider than just the IRS. The first thing to do is to stop improvising. These cases have a process and if you follow it, you'll get where you need to go. If you start guessing, you can make things harder. Start by filing form 14039 with the IRS. That's the identity theft affidavit. It tells the IRS officially that you're a victim and that the return they have on file wasn't filed by you.
Print it, fill it out, attach it to a paper copy of your real return, if you still need a file, and mail it in. While you're doing that, start documenting everything. Every IRS letter you received, every date, every phone call, every email, every screen you saw in your transcript. If you tried the e-file and it got rejected, save the rejection notice. If you called the IRS, write down who you spoke to, what their ID number was, and what they said.
Documentation is what wins these cases. The IRS isn't going to take your word for anything. They're going to want paper, so start the paper trail today, not next week. The IRS is the first call, but they're not the only call. There are four places you need to notify. First, the IRS, file the 14039, and if you have an active IRS letter, respond to the specific contact point on that letter.
There's also the identity protection specialized unit you can reach directly if you need to talk to a live person. Second, the Federal Trade Commission. Go to the identitytheft.gov and file a report. That creates a federal record of the theft and generates a recovery plan that other agencies recognize. Third, the three credit bureaus. Equifax, Experian, TransUnion. Put a fraud alert on your credit, or better yet, a full credit freeze.
A freeze is stronger. It stops new credit from being opened in your name until you lift it yourself. Fourth, your bank and any financial institution where you have an account, let them know what happened so they can watch for unusual activity. If you want to file a local police report on top of that, you can. Some states require it. Most don't, but it doesn't hurt to have one in the file.
Treating this as a one-time tax issue is one of the biggest mistakes I see, because whoever has your information isn't going to just use it once and stop. So beyond the IRS paperwork, here's what needs to happen. Put that credit freeze on all three bureaus. Not a fraud alert, a freeze. Change passwords on every financial account you have, starting with the ones that share any piece of information with your tax return.
Turn on two-factor authentication everywhere you can. Check your Social Security earnings record. If there's income on there from employers you don't recognize, that's a separate problem that Social Security needs to know about. Check your medical records for services you didn't receive. Watch your state unemployment account for claims you didn't file. This is a real pattern, especially in the last few years. And the last thing is, get an IP pin from the IRS.
That's an identity protection pin. It's a six-digit number the IRS issues you that you have to include on every future return. If someone tries to file in your name without it, the return gets rejected automatically. It's the single best protection you can put into place going forward. Once everything is filed and the IRS has your 14039, the case goes into their identity theft processing queue. I'll give you the honest timeline.
These cases usually take about 180 days, sometimes longer, occasionally faster. The IRS is not that fast on this kind of work. Then there's not much you can do to speed it up once it's in the queue. While it's sitting there, the IRS is pulling the fraudulent return, verifying your real return, adjusting your account, and adding an identity theft indicator to your file. When the case is resolved, you'll get a notice confirming it.
Your legitimate refund if you were owed one gets released. Your IP pin gets issued, and your account carries the identity theft marker going forward, which actually makes it harder to target you in the future. So the message during this phase is patience. It's frustrating, I know. But the system does work if you feed it the right paperwork at the start. Here's why I see people shoot themselves in the foot.
Don't ignore an IRS letter ever. I don't care how intimidating it looks or how convinced you are that it's a mistake. The clock is running from the date on the letter, and if you don't respond, the IRS proceeds as if the information they have is correct. Don't just refile your return and hope it sorts itself out. If a fraudulent return is already in the system, the IRS can't accept a second one without the 14039 telling them what happened.
You have to follow the process. Don't call the IRS without your documentation in front of you. You'll get transferred, you'll be on hold, and when somebody finally answers, you'll need to be ready to give them the dates, notice numbers, and specifics. If you're not ready, you'll waste the call. Don't give any additional information to anyone who reaches out to you claiming to be from the IRS. The real IRS contacts you by mail first, not by phone, not by email, not by text.
If somebody's calling you and pressuring you for more data, that's the scammer calling back for round two. And don't assume a refund you never received is just lost in the mail. If your return says you're owed money and no money showed up, something happened to it and you need to find out what. You can handle a straightforward case on your own. File the 14039, make the calls, raise your credit, be patient.
A lot of people get through it without ever needing a professional. But here's when this stops being a do -it-yourself project. When multiple years are affected, not just one, that usually means that the thief had your information for a while and the cleanup gets complicated fast. When the IRS starts trying to collect on a balance that came from the fraudulent return, if you're getting notices about a debt you don't owe, lean paperwork or levy warnings, that's not a case you want to fight alone.
When it's business identity theft, where somebody used your EIN instead of, or in addition to your social security number, those cases have a different process than the stakes are usually higher. When the IRS response isn't moving, if it's been more than six months and you're getting nowhere, sometimes you just need somebody who knows how to push the right buttons inside the taxpayer advocate's office or the identity theft victim assistance unit.
After 32 years of doing this, I can tell you the cases that go sideways are almost always the one where somebody tried to handle it casually and lost control of the timeline. If you're in any of the situations I just described, don't wait. If this has happened to you, the biggest mistake is usually waiting too long or assuming it will sort itself out. These cases are fixable, but the details matter.
If you want somebody to look at your situation and help you figure out the right next step, you can book a call using the link in the description and take a look at your case together. So if you're dealing with tax-related identity theft, the most important thing is this. Don't ignore it and don't guess your way through it. Take the right steps early, document everything, and give the IRS what they need to actually fix the problem.
Now, a completely different situation, but one that causes a lot of stress is when somebody hasn't filed their taxes for years. If that's something that you're dealing with, watch this next video where I walk through exactly what happens when you fall behind on filing and how to start getting back on track. See you there.
