Protect Yourself From Tax Identity Theft. Here's What I Did.

Identity theft | Taxes | Fraud | Security | September 3, 2025 

This Week's Quote:  "If you have good thoughts, they will shine out of your face like sunbeams, and you will always look lovely."
          - Unknown

Key Points  

• Tax identity theft is a growing problem, with fraudsters using stolen personal information to file fake tax returns and claim refunds.

• The IRS encourages taxpayers to apply for an Identity Protection Personal Identification Number (IP PIN) to prevent fraudulent refunds and false positives.

• To obtain an IP PIN, taxpayers must verify their identities through ID.me, a private company that uses biometric data and other information for verification.

For years, I dreaded the possibility that a tax identity theft would complicate my life and delay my tax refund. Now I’ve finally taken steps to avoid it, and you may want to as well. 

Tax ID theft happens like this: A fraudster uses a real person’s information, such as date of birth and Social Security number, to file a fake tax return in that person’s name. The fake return claims a made-up refund that typically goes to the fraudster’s account.

Then, when the real taxpayer files the actual return, the Internal Revenue Service’s computers reject it because they already processed a return with that name and ID—so the real filer has to resolve the problem. Victims must file affidavits, prove their identity, submit paper returns and wait for refunds if they’re getting them. It’s a total pain.  

The resolution process is long and getting longer. At the end of fiscal year 2024, the IRS had 470,000 open cases in which it was assisting tax ID theft victims, according to a report from National Taxpayer Advocate Erin Collins, who runs an independent arm inside the IRS to assist taxpayers. From 2020 to 2024, the average time to finish these cases rose from about four months to more than 22 months.  

Meanwhile, the world isn’t getting safer for taxpayers’ personal data. Even some children claimed as dependents by their parents have been victims of tax ID theft, causing IRS computers to reject the parents’ returns. 
 
“There are more ways than ever to get personal information or access it on the dark web. People should assume their data is out there for anyone who wants it,” says Brian Krebs, the cybersecurity specialist who publishes Krebs on Security. 

To forestall fraudulent refunds, the IRS encourages taxpayers to apply for a six-digit IP PIN, which stands for Identity Protection Personal Identification Number. For taxpayers who have them, the IRS’s computers reject returns without the proper number to prevent fraud. Note: This number is different from the five-digit PIN many taxpayers use to e-file. 

IP PINs can also protect against so-called false positives. These occur when the IRS’s computers hold up a return because of red flags for tax ID theft that turn out to be incorrect. In 2023, the agency had about 1.3 million false positives. They are easier to fix than true tax ID theft but still take time for the taxpayer to resolve.    

IP PINs expire late in the calendar year, and taxpayers can automatically receive a new one each year in their online IRS account. They can even be obtained on behalf of minors and other dependents. 

According to the IRS, more than 10 million taxpayers have received IP PINs. But that’s a small fraction of the more than 200 million Americans eligible for them.  

Here’s the rub: To get an IP PIN, taxpayers must prove their identities. For this, the IRS uses ID.me, an outside vendor the agency turned to after its own verification systems didn’t work out. Based in McLean, Va., ID.me began as a way to help military veterans gain access to benefits. It now provides online verification and login services to 20 federal and 46 state agencies. Verified users go through ID.me’s portal to access their online IRS accounts and get an IP PIN.  

Did I really want to turn over my personal information to a private company? Privacy advocates warn about the use of biometric data, which the company collects when it compares an applicant’s photo ID such as a passport to an online or selfie image for verification. (ID.me says it does this to meet government guidelines.) I’m not a digital native, so I was also worried about ID.me’s process. It included that scary word “upload.”  

But I decided to give it a try. The other ways of getting verified take far longer, so ID.me is often the easiest way to protect against tax ID theft. Tax preparers I know don’t worry about it. 

“I’ve been banging garbage-can lids about IP PINs for years, and both I and my clients use ID.me. It’s a lot better than getting a false tax return submitted in your name,” says Andy Mattson, a CPA at Moss Adams with high-net-worth clients in Silicon Valley. 
 
In the end, I needn’t have worried about ID.me’s process. The uploads were foolproof, so they only took me two tries.

Then I was guided by an ID.me staffer who almost concealed her irritation when I had trouble with both my computer camera and microphone. She switched the verification to my cellphone, and we were done in a minute or two. Even with my missteps, the process took well under half an hour during tax season. 

ID.me verified me using my name, date of birth, address, phone number and photos I sent of my driver’s license. The final step was to ask the IRS for my IP PIN through my online account, and it quickly appeared there. Soon we’ll get one for my husband to protect our tax return fully.    

What about my data’s security, or ID.me’s use of my information? The company’s answers to these questions provided reassurance, although no system is hack-proof.  

According to an ID.me spokesman, images like selfies used for biometric verification are deleted 24 hours later. 

Other information is retained while the user’s IRS account is open and for up to three years after it’s closed. ID.me says this is to comply with industry best practices. In addition, ID.me can’t profit from the personal information of someone being verified for government agencies like the IRS.

Perhaps most important, ID.me doesn’t have access to the IRS records of the taxpayers it verifies. It also allows users to close their ID.me accounts with no impact on their IRS records.  

For families waking up to the fact that children or elderly members could be vulnerable to tax ID theft, there’s more. Currently ID.me doesn’t verify people under 18, so parents who need IP PINs for minors must go directly to the IRS. But people who might have trouble with ID.me’s process, such as the elderly, can have someone assist them.

And yes, there’s a place for IP PINs on the tax return for each spouse and for children. The IRS says to put children’s IP PINs on Forms 1040 and 2441 and Schedule EIC, if applicable. Spokespeople for both Intuit, the maker of TurboTax, and H&R Block say their online programs allow filers to input dependents’ IP PINs so the return can be accepted.

Credit goes to Laura Saunders, The Wall Street Journal, February 28, 2025

Thank you for all of your questions, comments and suggestions for future topics. As always, they are much appreciated. We also welcome and appreciate anyone who wishes to write a Tax Tip of the Week for our consideration. We may be reached in our Dayton office at 937-436-3133 or in our Xenia office at 937-372-3504. Or, visit our website.
 
This Week’s Author, Belinda Stickle