Tax Identity Theft & Refund Fraud

It arrives as an email from your tax software, usually within an hour of hitting submit, and it is one sentence long: your federal return was rejected, because a return with your Social Security number has already been filed for this tax year. Nobody reads that sentence calmly. What most people hear inside it is: *someone has my Social Security number. They have been me, to the IRS, and the IRS believed them. My refund — the one with a name on every dollar — went to a criminal. And now I'm the one who looks like the fraud.* If that email is why you opened this lesson, take a breath and hear the three facts this lesson exists to prove to you, because all three are true and all three are documented on the IRS's own pages: you are not in trouble — the IRS deals with millions of suspected-identity-theft returns every year and has an entire specialized unit for exactly your situation; you will get your real refund, in full — a thief filing in your name does not spend your refund entitlement, and the IRS pays yours out once your case resolves, with interest for the wait; and there is a lock for this door — a free, six-digit Identity Protection PIN that makes a fake e-filed return in your name bounce the way yours just did.

This lesson walks the whole arc on a filer you know. Gloria Simmons — 48, a home health aide in Memphis raising her son Malik on $29,000 a year — has spent the last three lessons clawing her way out of the mess a ghost preparer made of her taxes: the CP2000 she answered in the notices lesson, the audit she won in the audits lesson, the payment plan she'll build in the owing-money lesson. In this lesson she does everything right — fires the ghost, books a free VITA appointment, files honestly — and her e-file bounces anyway, because the ghost shop's cut-rate handling of her data caught up with her. You'll watch the theft happen, then watch the recovery: the one-page affidavit, the paper filing, the documented wait, the full refund with interest, and the PIN that ends the story permanently. Alongside her, Nadia — the Columbus filer whose $58,000 foundation return this curriculum has read line by line — locks her own return *before* anything happens, and Denise Carter, a Toledo school-cafeteria manager whose Social Security number surfaces in a data breach, shows the third lane: exposed, but never victimized, because she acted in the window the thief needed.

Tax-related identity theft is a specific, mechanical crime, and understanding the mechanics drains most of its menace. A thief who holds three pieces of information — your name, your date of birth, and your Social Security number — can fill out a federal tax return as you. Not your *real* return: they don't have your W-2, and they don't need it. They invent one. A plausible employer, plausible wages, plausible withholding, and — because refundable credits pay out even when little tax was withheld — very often an invented family and income shaped to claim the Earned Income Tax Credit and the refundable Child Tax Credit. Then they e-file it in your name, early, with the refund pointed at a bank account or prepaid debit card they control. The whole product of the crime is that direct deposit. There is no long con; there is a race.

The race exists because of a timing gap built into the filing season, and you've already met both of its walls in earlier lessons. On one side: e-filing opens in late January, and the IRS's promise to honest filers is speed — most refunds out in under three weeks. On the other side: the *proof* of what you actually earned — the W-2s and 1099s employers and banks file — flows into IRS matching systems over weeks and months, which is exactly why the CP2000 document-match notice you read in the notices lesson arrives a year or more after filing. In the gap between "we pay fast" and "we verify slowly," a fake return with invented wages can sail through, and the Treasury — not you — hands the thief a refund. Congress and the IRS have narrowed the gap from both ends: employers must now file W-2s by January 31, the law holds all EITC and Additional Child Tax Credit refunds until mid-February so early fakes claiming those credits can't be paid before at least some matching runs, and the IRS's filters now suspend millions of suspicious returns a year before a dollar moves. Narrowed — not closed. The fake that beats the filters gets paid, and the real filer finds out the way you're about to watch Gloria find out.

Read the diagram's right edge again, because it contains the sentence that should lower your shoulders: the e-file system accepts exactly one return per Social Security number per year. That rule is why your real return bounced — infuriating, yes. But it's also why the crime is survivable: your rejection is the system *detecting the collision*, and a collision is precisely what the IRS's Identity Theft Victim Assistance unit exists to untangle. The thief didn't withdraw money from an account of yours. They conned the U.S. Treasury with a forged document, the Treasury's loss teams now own chasing that money, and your legal entitlement to your own refund sits untouched on the other side of a process this lesson will walk step by step. What the thief actually stole from *you* is time — months of it, which is real harm and gets honest treatment later in this lesson — but not your refund.

The first question every victim asks is *what did I do wrong?* — and for essentially everyone, the honest answer is nothing. A Social Security number is nine digits you've been required to hand out your whole adult life: to every employer, landlord, bank, clinic, insurer, school, and government office that asked. Your number's security is only as good as the *weakest* of those hundreds of custodians, and the custodians keep failing at industrial scale. Health systems, payroll processors, credit bureaus, retailers, and government contractors have collectively breached the records of most American adults; when Denise Carter's letter arrives later in this lesson telling her a vendor of her health plan exposed her SSN, she will be one of tens of millions that year alone. Add the retail channels — phishing emails and texts that harvest logins, mail theft, and the one that caught Gloria: a ghost preparer. A pop-up shop like the "MaxRefund Express" that ghost-filed her returns holds the crown jewels for this crime — names, birth dates, SSNs for whole families, W-2s, bank details — with none of the data-security obligations a real firm carries. Some ghost shops leak client data through sheer sloppiness; some *are* the fraud ring, filing inflated returns this season and selling the client file to refund thieves for the next. Lesson 41 teaches you to spot them before they have your data.

Hold on to the practical consequence, because it frames everything that follows: you cannot un-expose a Social Security number. Once it has been breached — and statistically, yours very likely has been — no amount of shredding, password hygiene, or vigilance recalls it. That sounds bleak, and it's actually the liberating fact of this lesson: it moves the goal from *secrecy*, which is gone, to *locks* — controls that make the number useless to a thief even when they hold it. A credit freeze makes it useless for opening loans. The IP PIN — this lesson's second half — makes it useless for filing a tax return. The people who come through tax identity theft fastest aren't the ones who guarded their number best; they're the ones who knew which locks existed.

Saturday, February 19, 2028, a library branch in Memphis. Gloria has done this year — tax year 2027 — the way the last two lessons taught her to: no more strip-mall preparer, a folder of real documents, and a free appointment at a VITA site (the volunteer tax-prep program you met in the help stacks, free for households under about $69,000). Her return is the same honest shape this curriculum locked at the audits lesson and re-verified here on tax-year-2026 parameters, her circumstances unchanged: wages $29,000 as a home health aide; Head of Household with Malik, now ten; the $24,150 standard deduction leaving $4,850 of taxable income and $485 of tax; the Child Tax Credit erasing that $485 and paying $1,700 more as its refundable portion; the Earned Income Tax Credit adding $3,610; her $1,100 of paycheck withholding coming back. Refund: $6,410 — first-and-last month on a better apartment closer to Malik's school. (Her exact 2027 dollars will shift a few dollars when that year's inflation adjustments apply; the shape will not.) The volunteer checks her math twice, she signs, the site transmits her e-file at 11:40 a.m. The acknowledgment comes back before she's out of the parking lot: Rejected. IND-515.

Name what this moment costs before moving to procedure, because the procedure only sticks if the fear is answered first. Gloria's first thought is not about reject codes — it's *after everything, now this*, followed by the colder one: *someone out there is holding Malik's and my Social Security numbers.* Both feelings are earned. And here is what the next sections will prove, in order: the bounce means the IRS's one-return-per-SSN wall did its job; her $6,410 is delayed, not gone — the law's own language, from the IRS victim-assistance page, is that the unit *"ensur[es] your tax return is properly processed and if you are due a refund, releasing your refund"*; the thief's payout is the Treasury's problem to claw back, never a debt on her account; and the ghost shop's leak of her data — her likeliest exposure — becomes one more line in the preparer report she files in Lesson 41. What the rejection asks of her today is small, bounded, and free: a triage check, one two-page affidavit, a stamp, and patience she'll spend anyway. Watch the widget's refund breakdown once more before the triage, though — it explains why *she*, and filers like her, sit in this crime's crosshairs.

The anatomy explains the targeting with no mystery left over: $5,310 of Gloria's $6,410 is refundable credits — money the return itself generates. A thief inventing a return doesn't know or care what Gloria really earns; they invent a story with exactly this payout shape because the EITC and refundable CTC pay real dollars against fake facts. It's the same $5,310 the CP75 audit froze in the audits lesson, and the two events rhyme deliberately: the anti-fraud machinery built to catch *invented* EITC households keeps brushing against *real* ones like hers. One distinction matters between the two, and it sets up everything that follows: the CP75 held only the audited credits while the rest of her refund flowed; an identity-theft collision stalls the entire return — all $6,410 — until a human being untangles which filer is real. That's why this lesson cares so much about doing the next steps promptly and exactly once.

A duplicate-SSN rejection has exactly three possible causes, and two of them are innocent — so the IRS's own first-steps guidance, and every competent VITA volunteer and software help page, runs this triage before anyone touches an affidavit. Innocent cause one: a typo. If any SSN on the return — yours, a spouse's, a dependent's — was entered one digit off, it can collide with a real person's already-filed return. Check every number against the actual Social Security cards, not memory. A typo found here is the best outcome in this lesson: fix it, re-transmit, done in ten minutes. Innocent cause two: a filing tangle inside your own household. The teenager with a part-time job who filed to get their withholding back and didn't check the box saying *someone can claim me as a dependent* — that's the classic. It fires the dependent-flavored cousins of Gloria's reject code: IND-517 when a dependent you claim has already filed as a primary filer, IND-516 when you filed claiming yourself but someone else's return (usually a parent's) lists you as a dependent. The fix is a family conversation plus an amended return for whoever erred — the 1040-X lesson's territory — not an identity-theft case.

Two rules on this map are new since many older guides were written, and both were verified live for this lesson. First, the dependent-collision lane changed: beginning with tax-year-2024 returns, the IRS accepts an e-filed return even if a dependent on it has already been claimed — provided the primary taxpayer includes a valid current-year IP PIN. The parent whose e-file bounces on IND-517 no longer has to spend six weeks in the paper lane; she can get an IP PIN through her IRS Online Account the same day, re-transmit, and let the IRS's duplicate-claim process (a CP87A letter to both claimants, then the documentation contest you saw Gloria win in the audits lesson) sort out who keeps the child. That bypass is for dependent collisions only — hold that thought for one paragraph. Second, a boundary the Form 14039 itself now prints in bold: a parent or guardian misusing a child's information *in a custody-and-claiming fight* — the other parent claiming the kids in a year that wasn't theirs — "is not identity theft." It's a dependents-rules dispute, handled by the tiebreakers from the dependents lesson, and filing an identity-theft affidavit over it just delays everyone. The affidavit is for strangers and fraud, not for exes.

Gloria's triage takes eleven minutes at the VITA desk. Her SSN matches her card digit for digit; so does Malik's. Malik is ten — nobody in her household filed anything. The volunteer, who has seen this before, says the sentence out loud so it lands as fact rather than dread: *"Someone filed a return in your name. That's identity theft, it is not your fault, there's a form for exactly this, and you will still get your refund — it'll just take longer than either of us wants."* Everything that sentence promises, the next five sections deliver.

Here is the whole path before we walk it, because a mapped ordeal is survivable in a way an unmapped one is not. Six moves, in order, then a documented wait with a full refund and a permanent lock at the end. One: confirm it's theft (the triage you just ran). Two: complete Form 14039, the Identity Theft Affidavit — one form, two pages, fifteen minutes by the IRS's own estimate — the next section walks it box by box. Three: file your real return anyway, on paper, on time, with the affidavit attached to the back; the thief doesn't move your deadline, and if you owe, payment is still due. Four: report the theft at IdentityTheft.gov, the FTC's one-stop site, which builds your personal recovery plan for everything beyond taxes. Five: lock the credit side — a free security freeze at each of the three bureaus and free weekly report checks — so the same stolen data can't open loans while the tax case runs. Six: enroll in the IP PIN program so no future season can repeat this one. Then the wait: the IRS's Identity Theft Victim Assistance unit works the case, your refund arrives in full, with interest, and confirmed victims are locked into the IP PIN program automatically, every year, for free.

1. Triage the rejection — SSN typos and household filing tangles first; only a true stranger-collision goes down the theft path.
2. Form 14039, Identity Theft Affidavit — the two-page sworn statement that opens your case (next section, box by box).
3. Paper-file the real return, on time — affidavit stapled behind it, mailed to the address where you normally file; deadlines and any balance due are unmoved by the theft.
4. IdentityTheft.gov — the FTC's recovery hub: an identity-theft report, a personal recovery plan, and the non-tax cleanup (accounts, collectors, records).
5. Freeze your credit, watch your reports — free at all three bureaus, placed within one business day of an online or phone request; free reports weekly at AnnualCreditReport.com.
6. Get your IP PIN — the six-digit lock on all future federal returns; for confirmed victims like Gloria it arrives automatically, and anyone can opt in without waiting to be a victim.

Two disciplines govern the whole path, and they're worth stating before the details swallow them. File everything exactly once. The IRS's victim-assistance page begs, in as many words, *"Do not submit duplicate Forms 14039 … nor contact the IRS about the status of your identity theft claim, this will cause delays"* — a duplicate affidavit doesn't nudge your case forward, it forks it. Keep every artifact: the rejection email, a copy of the signed affidavit, the paper return, the certified-mail receipt, every IRS letter that follows. The notices lesson taught you that the paper trail is the taxpayer's superpower; in an identity-theft case, where a months-long process passes through many hands, it's the difference between a case you can prove and a case you can only describe.

The form at the center of this lesson is, by IRS standards, almost gentle: two pages, six lettered sections, an estimated fifteen minutes, no dollar amounts to compute anywhere on it. Form 14039 is a sworn statement, not a tax form — its whole job is to tell the IRS *someone used my identity; route my account to the specialists*. The current revision (February 2026 — check that you're holding the newest one at IRS.gov, since an old revision carries an outdated mailing address) even opens by trying to talk most readers OUT of filing it: it is for victims only, never filed twice for the same incident, and — a gate this lesson will keep repeating — never filed at all if the IRS has already written to *you* about suspected identity theft, because responding to that letter does the same job. Gloria's situation — a duplicate-SSN e-file rejection, no IRS letter — is the textbook case the form exists for. Read her completed affidavit whole, then walk it section by section.

Section A — what's the situation? Four checkboxes that route the form. Box 1, Gloria's, is the ordinary case: *I am submitting this Form 14039 for myself.* Box 2 is for people responding to an IRS notice that *told* them to file one — they write the notice number on the line and mail the affidavit to that notice's address instead of the usual one. Box 3 files on behalf of a dependent child or relative — with the carve-out you met in triage printed right on it: a parent or guardian misusing a dependent's identity in a tax-claiming fight *"is not identity theft."* Box 4 covers filing for another person, living or deceased — and yes, thieves file returns in dead people's names in numbers large enough that the form has a whole machinery (Section F) for surviving spouses and estate representatives. Section B — how are you impacted? Three boxes that name the three crimes this lesson covers: Box 1, someone fraudulently *filed a return* with your information (with a sub-box if your spouse is hit too — one affidavit can cover both); Box 2, you or your dependent were fraudulently claimed *as a dependent* on someone's return; Box 3, your SSN was used *for employment* — the wages-you-never-earned variant that gets its own section later. Beneath them sits the form's most useful sentence for the anxious: if your situation is none of these — a stolen wallet, a breach letter, a phishing scare, but no tax filing touched — do not file this form; report at IdentityTheft.gov and get an IP PIN instead. A breach alone makes you Denise, not Gloria, and Denise's lane comes later in this lesson.

The narrative box closes Section B: *provide an explanation of the identity theft issue, how it impacts your tax account, when you became aware of it, and relevant dates.* Write it like an incident report, not a memoir — Gloria's reads, in full: *"On February 19, 2028, my e-filed 2027 federal return was rejected with code IND-515 because a return using my SSN had already been filed and accepted for 2027. I did not file that return and did not authorize anyone to file it. I have received no IRS letters about it. My correct 2027 return is attached to this affidavit."* Four sentences; every fact load-bearing; nothing volunteered beyond the facts — the same discipline the audits lesson taught for document requests. Section C is contact information, with two details worth noticing: the address fields ask for both your current address *and* the one on your last filed return if different (the unit has to connect you to the account the thief muddied), and a phone-and-best-time row exists because the IRS may actually call about this form — one of the few contexts where a real IRS phone call happens, and even then, remembering the notices lesson: a caller who *demands payment* is never the IRS. Section D anchors the tax-account picture: the last year you filed (2026, for Gloria) and up to eight boxes for the years you believe were hit (2027, one box, the rest blank — "Unknown" is an accepted answer when you can't tell).

Section E is the signature under penalty of perjury — *"Under penalty of perjury, I declare that, to the best of my knowledge and belief, the information entered on this Form 14039 is true, correct, complete, and made in good faith"* — the same oath you sign on every 1040, and the reason this two-page form carries legal weight: sworn affidavits are what let the IRS treat one of the two colliding returns as presumptively real. It also means the form is for good-faith belief, not certainty — *"I know or suspect"* is the standard printed on Box 1, so you don't need to have caught the thief to sign honestly. Section F stays blank for Gloria; it exists for the Box 3 and Box 4 filers — parents signing for minors, POA holders, conservators, and the survivors filing for a deceased person, each with its own documentation checklist printed right on the form. And the submission panel offers three channels with one commanding rule for Gloria's situation: the form *can* be submitted online at the IRS's portal (the form's stated preferred method for standalone filings — though the online route takes no attachments) or faxed toll-free, but when a misused SSN has blocked your e-file, the affidavit attaches to the back of your paper return and the whole package mails together to the address where you normally file. One envelope, one case file, no orphaned documents. The standalone mail address (currently the IRS's Fresno intake) and fax number are printed on page 2 — and they are for the affidavit alone, never for mailing a tax return by itself.

Move three surprises people: the theft does not excuse you from filing, and it does not move your deadline. Your real return is still due in mid-April (with the usual extension available — though remember from the payments lesson that an extension moves the *filing* deadline, never the *payment* deadline). A rejected e-file is legally not a filed return, so Gloria's return goes in the only door still open for her year: paper. The mechanics, each verified against the current IRS and Taxpayer Advocate instructions: print the complete return; sign it in ink (unsigned paper returns bounce months later — the single most common paper-filing error); staple Form 14039 behind it; mail the package to the IRS address where you normally file for your state — the address table in your form instructions or software, *not* the affidavit's standalone Fresno address, which the form itself warns is never for tax returns. Send it certified mail with a return receipt, the few dollars that buy you a government-stamped proof-of-filing date. If you owe rather than expect a refund, pay by the April deadline exactly as the payments lesson taught — IRS Direct Pay against the same SSN works regardless of the thief — because interest and late-payment penalties don't pause for an identity-theft case.

Timing has one gotcha worth engraving: act promptly even though your April deadline looks far away. The Taxpayer Advocate's checklist says to get the paper package in within ten days of the rejection, and for anyone whose rejection arrives *near or after* the deadline, the IRS's own rule is that a timely paper return must be postmarked by the later of the due date or ten calendar days after the rejection notice — with a cover explanation, a copy of the rejection, and (in the Advocate's format) *"REJECTED ELECTRONIC RETURN — [date]"* written in red at the top of page 1. Gloria, bouncing in February, is nowhere near the cliff — but she mails on February 22 anyway, because every week the real return waits is a week added to the back of a queue you'll size honestly in a moment. Then: expect silence at first. Paper returns take six to eight weeks of ordinary processing before the identity-theft collision even surfaces to a human; *Where's My Refund* will show nothing useful for a paper return in a duplicate-SSN case, and that's expected, not alarming.

The person who filed a fake tax return with Gloria's data is holding *everything needed to open a credit card* with it too — so the tax filing is one front in what has to be treated, for a few hours, as a whole-identity event. The federal government's one-stop shop for that wider front is the FTC's IdentityTheft.gov, and it earns its place as the recovery path's fourth move. Answer its guided interview and it produces two things: an official FTC Identity Theft Report — the document that unlocks statutory rights with banks, collectors, and credit bureaus, and serves in most situations where anyone asks for "a police report" — and a personal recovery plan, a checklist tailored to what you report, with pre-filled dispute letters for each step. It can even complete and transmit your Form 14039 to the IRS as part of the interview, as the last section noted. A paper police report is generally *not* required for the tax case — the affidavit or the FTC report carries it — though filing one still makes sense if you know who the thief is, if a bank demands one, or for the seven-year extended fraud alert below.

Do the state while you're at it — the lesson's recurring reminder that the federal return is never the whole story. State tax agencies run their own refund systems and their own fraud screens (Ohio, for instance, has mailed identity-verification quiz letters to filers like Nadia for years), and the IRS's own victim checklist ends with *check with your state tax agency*. Gloria's is the easy case: Tennessee taxes no wage income, so there is no state return in her name to steal and no state filing to protect — one of the few times the no-income-tax states from the state-tax lesson pay off in a trouble arc. A Columbus filer like Nadia, or any reader in the forty-plus states with income taxes, adds one step: notify your state's revenue department of the federal theft (most have an identity-theft page mirroring the IRS's), and expect its own verification letter before any state refund moves.

Move five locks the doors the thief hasn't tried yet. A security freeze (credit freeze) blocks lenders from pulling your credit file, which stops nearly all new-account fraud cold — no report, no loan. Since a 2018 federal law it is free at all three nationwide bureaus, it never touches your credit score, and the law puts speed on your side: a freeze requested online or by phone must be in place within one business day, and when you need credit yourself, a lift takes effect online almost immediately and within about an hour by phone. The catch is only that you do it three times — Equifax, Experian, and TransUnion each maintain their own file, and freezing one does nothing at the others (each bureau's freeze page and phone line handles it in minutes). Pair the freeze with free credit-report checks weekly at AnnualCreditReport.com — the one official source, permanently weekly since the pandemic years — reading each report for accounts and inquiries you don't recognize. A fraud alert is the lighter tool: free, one year, renewable, placed with *one* bureau which must tell the other two, it tells lenders to verify identity before opening credit — and identity-theft victims holding an FTC or police report can extend it to seven years. Reasonable people layer both; the freeze is the lock, the alert is the doorbell camera.

Gloria does the full credit pass on the same Tuesday she mails the return: three freezes (about half an hour, most of it account creation), the IdentityTheft.gov report from the last section, a calendar reminder to pull one bureau's free report every few weeks in rotation. Her reports come back clean — for many tax-fraud victims they do, because the data that files a fake return gets used for exactly that and sold onward — and *clean today* is precisely what the freeze is for: it makes tomorrow's attempt fail. Everything on the credit side is now locked, free, and reversible in an hour when she next needs a loan. What remains is the one thing only the IRS can do: untangle the two returns wearing her name.

When a Form 14039 lands — stapled to a paper return, submitted through the portal, or relayed by the FTC — the case routes to a unit built for exactly this: Identity Theft Victim Assistance (IDTVA), staffed, in the IRS's words, by employees *"with specialized identity theft training."* Its work order on your case, quoted from the victim-assistance page nearly verbatim because every line answers a fear: assess whether the theft touches one tax year or several (thieves who file once often filed the year before, too); address every issue the fraudulent return created on the account; ensure your return is processed properly and, *"if you are due a refund, releasing your refund"*; remove the fraudulent return from your records — as if it had never been filed, which is the formal answer to *will I owe tax on what the thief claimed?* (no, never — it doesn't merely get outweighed, it gets deleted); and finally mark the account with an identity-theft indicator, the permanent flag that heightens screening on everything filed under your SSN from then on. That last step triggers the endgame you'll reach in two sections: confirmed victims are enrolled in the IP PIN program automatically, every year, for good.

What you'll actually *see* of this is letters — so here is the paper trail decoded in advance, the way the notices lesson taught you to prefer. An acknowledgment may arrive as notice CP01S — *"We received your identity theft claim. We'll send any refund you may be due after we finish working on your claim"* — though under current IRS practice it's sent mainly when a case will take a while (which, candidly, is most refund cases), so silence after mailing is normal, not a lost envelope. Case resolved, two more: CP01 — *"We verified your identity theft claim. We placed an indicator on your tax account"* — the you're-done notice, and often a closing letter (Letter 4674C) detailing what was fixed; a cousin, CP01C, exists for the adjacent case where the IRS verified your claim but found no tax fraud had actually landed. During the case: exactly one thing is asked of you — respond promptly if the unit writes with questions. Otherwise the IRS's instruction is the anti-instinct one from the recovery map: don't file duplicate affidavits, don't call for status — both, in the agency's own words, *"will cause delays."* For a status pulse there's a self-serve gauge: the IRS's *Processing status for tax forms* page publishes which month's Form 14039 intake the unit is currently working, and your IRS Online Account plus the identity-theft line (800-908-4490, weekdays 7 a.m.–7 p.m. local — the unit long known as the Identity Protection Specialized Unit) exist for the questions that can't wait.

Now the part of this lesson that owes you the truth more than it owes you comfort, because families budget around refunds and a false promise here does real damage. How long until the refund? The IRS's stated goal is *"generally within 120 days."* Its own victim-assistance page admits — in the same sentence — that backlogged inventories have pushed the average to 611 days. The National Taxpayer Advocate's latest report to Congress (January 2026) puts the average for cases resolved in fiscal 2025 at 21 months, calls the delay *"unconscionably long — nearly two years,"* notes roughly 316,000 cases still in inventory, and reports the detail that should make policymakers wince: about two-thirds of resolved victim cases belong to lower-income taxpayers — EITC-shaped refunds, Gloria's demographic, the households least able to float a missing $6,000 (the average held-up refund in these cases: just over $6,000; hers is $6,410). One genuinely hopeful number hides inside the averages: the horror figures are driven by an aged backlog, and the Advocate has reported that newly received cases were resolving in roughly 100 days once the unit began triaging fresh intake ahead of the pile. Plan like a realist, in months not weeks; let anything faster be the good surprise.

Two facts make the wait financially survivable rather than merely endurable. First, the money grows. When the IRS holds a legitimate refund past its 45-day administrative window, the overpayment-interest rules from the amending lesson kick in: interest accrues from the return's due date at the federal short-term rate plus three points, compounded daily — 7% for most of 2026, the last verified rate. Gloria's nine-month resolution earns her about $270 on top of the $6,410 (a 21-month case would have earned roughly $750) — and, small honesty from the amending lesson worth repeating, refund interest is itself taxable income the year received; a 1099-INT follows. Nobody would choose the trade, but the meter runs in the victim's favor, automatically, no request needed. Second, hardship has an exit ramp. If the wait crosses from painful into can't-pay-rent — an eviction notice, a utility shutoff, a medical need — that is precisely the Taxpayer Advocate Service trigger from every help stack in this arc: an independent organization inside the IRS with authority to force movement on a case causing economic harm. Form 911 or 877-777-4778, free, and identity-theft refund delays are among their steadiest casework. Gloria tapes the number inside a kitchen cabinet and — this time — never needs it: her CP01 lands November 20, 2028, the deposit follows, and the arc's cruelest lesson closes with the system paying her rent money back, with rent on it.

Gloria's case began with *her* discovery — her e-file bounced off the thief's. Flip the timing and you get the other doorway into this crime, one that now handles millions of returns a year: the IRS's own screens flag a suspicious filing before processing it, freeze it unpaid, and mail the *address on file* a letter that says, in effect, *prove this was you*. In fiscal 2025 those filters suspended about 2.9 million returns as suspected identity theft. If a return you actually filed trips the filter, the letter is a speed bump; if a return you *never* filed trips it, the letter is the luckiest way to learn — the fake got caught with the money still in the Treasury. Either way, the letters follow a family pattern worth recognizing on sight: the classic Letter 5071C and its successors (the IRS began reissuing the series as CP5071 notices in 2025) offer online verification; 4883C verifies by phone only; 5747C — the highest-risk tier — requires an in-person visit to a Taxpayer Assistance Center with photo ID and a second identity document; 5447C serves foreign addresses. Every one of them says a 1040-series return was received under your SSN and that processing is stopped until you respond.

The response is the easiest procedure in this lesson, with one commanding rule attached: verify — do not file Form 14039. The verification letters and the affidavit are two entrances to the same building, and using both for one incident jams the door. The current IRS guide says it in headline type — *"Most people don't need to file this form"* — and the CP5071 page completes the rule: verify your return, and no affidavit is needed *unless the IRS asks*. Online verification (for the letter types that allow it) runs through the Identity and Tax Return Verification Service at irs.gov/verifyreturn — sign in with the same ID.me identity-proofing you'll meet in the IP PIN sections, keep the letter and a copy of the return in reach, answer its questions. If you filed the return: say so, and processing resumes — allow up to nine weeks, a delay that stings but ends with the ordinary refund. If you did not file it: the interview has a button for exactly that — *I didn't file this return* — and clicking it is the whole report; the IRS purges the fake and the identity-theft machinery from the last three sections takes the case from there, no affidavit required. If you ignore the letter: nothing processes — the flagged return is never posted, no refund ever issues, and (a Taxpayer Advocate research finding worth repeating to any friend who shrugs at IRS mail) legitimate filers have permanently lost refunds by treating a verification letter as junk. It's the notices lesson's first law wearing its identity-theft uniform: dated IRS mail always gets a response.

Everything so far has been cure. Here is the prevention, and it is genuinely good news: the tax system's one true consumer-side lock, free, voluntary, and — since 2021 — open to everyone with an SSN or ITIN who can verify their identity, not just confirmed victims. The Identity Protection PIN (IP PIN) is a six-digit number known only to you and the IRS. Once you're enrolled, any federal 1040-family return filed under your SSN must carry the current year's PIN or it doesn't go through: an e-filed return without or with a wrong IP PIN is rejected outright (the thief's experience — they hold your SSN but not your PIN, so their fake bounces exactly the way your real return bounced in this lesson's opening), and a paper return without it is held for extra identity screening rather than processed normally (so the paper lane can't be used to stroll around the lock, only to limp through it slowly). The PIN is not a password you choose and not permanent: a new one is generated every year, which is most of its strength — a PIN skimmed this season is worthless next season.

The usage rules fit in one breath and prevent every common stumble. The current year's PIN goes on every federal 1040-family return you file during that calendar year — including a late or prior-year return and an amended 1040-X filed that year, all of which carry the *current* calendar year's PIN, never an old one. It goes only on federal 1040-family returns: never on a state return, and never on the Form 4868 extension. On a joint return, each spouse who has an IP PIN enters their own in their own labeled box. And it does not speed anything up — an IP PIN return is an ordinary return with a lock on it, not a fast lane. The one behavioral price of enrollment: guard it like the key it is, and *plan to fetch the new one each January*, which is the next section's walkthrough.

Enrollment has three doors, sized to three real situations — and this section walks a named filer through each of the two big ones, because "go get an IP PIN" is exactly the kind of instruction this curriculum refuses to leave abstract. Door one — the online account, instant. In October 2026, Nadia — no theft, no scare, just a filer who reads about Gloria-shaped stories and prefers locks — signs into her IRS Individual Online Account (the same account the notices lesson used to verify balances). Identity-proofing runs through ID.me: a government photo ID, an SSN, a selfie match or a live video-chat agent for anyone who declines the biometric lane. In her account's Profile tab, IP PIN section, she meets a choice added in recent seasons: continuous enrollment (in the program this year and every year until she says otherwise) or one-time enrollment (this calendar year only, auto-lapsing in December — built for people who want the lock for a single risky season). She picks continuous, and her six digits render on screen. Total elapsed time, most of it ID.me: about fifteen minutes. That's the whole ceremony — no letter, no wait, and one obligation she calendars immediately: online enrollees are NOT mailed the new PIN each year; they sign back in each January and retrieve it.

Door two — Form 15227, the paper application. Denise Carter — 55, single, a school-cafeteria manager in Toledo earning about $38,000, whose breach story anchors a later section — tries Nadia's door first and stalls where a meaningful minority of real people do: the identity-proofing wants documents and a device workflow that don't fit her life (her only government ID is a worn license the selfie-match keeps refusing, and she isn't about to video-chat from the cafeteria office). The system has a designed alternative rather than a dead end: Form 15227, *Application for an Identity Protection Personal Identification Number* — a single page, bilingual, with an income gate sized for exactly her situation: adjusted gross income on the last filed return below $84,000 (single) or $168,000 (married filing jointly), as posted in mid-2026 — the threshold moves with inflation, so check the current form. She mails it (fax works too), and the verification comes to her instead: the IRS calls the phone number she wrote on the form to confirm her identity — a scheduled, expected call, the known exception to phone-paranoia, and even then verifiable by calling the identity line back at 800-908-4490. Her PIN arrives by U.S. mail in about four to six weeks, and here's the structural difference from Nadia's door: 15227 enrollees are on the mail track — every January thereafter, a CP01A notice delivers the new PIN to her mailbox automatically. Door three — the walk-in — covers whoever the first two can't: over the income ceiling *and* unable to pass online proofing. Book a Taxpayer Assistance Center appointment (844-545-5640), bring a photo ID and a second identity document, verify face to face; the PIN mails in about three weeks, then annual CP01A. Under-18s can't use the online tool at all — a parent or guardian applies for a minor through Form 15227 or a TAC visit, which is how Gloria will eventually cover Malik.

An IP PIN asks one recurring chore of you, and knowing its calendar prevents every springtime panic. The program breathes on an annual cycle: each PIN is valid for one calendar year, the online system goes dark for maintenance from around mid-November, and new PINs issue in early-to-mid January — mailed as CP01A notices to the mail track (confirmed victims and 15227/TAC enrollees), retrieved online by everyone who enrolled through the account. So the rhythm is: January, fetch or receive the new six digits; file everything that year with them; November, the enrollment window closes for the season; repeat. Lost the PIN in April? Don't re-apply and don't guess from last year's — retrieve the current PIN in your Online Account (Profile page), or call 800-908-4490 and, after phone verification, the IRS re-mails it to your address of record within 21 days — with two exceptions the retrieval page prints in fine print: post-2019 *online* enrollees can't get mail reissue at all (online in, online out), and after October 14 phone reissue closes for anyone who hasn't filed that year (file the paper return without the PIN at that point and accept the slower screening). A minor dependent's PIN can't be retrieved online at all — that's a call.

Three pieces of fine print round out ownership. Opting out exists, with an asymmetry that tells you who the program is really for: a voluntary enrollee who's never been a confirmed victim can leave — through the Online Account's IP PIN section or the 800 number, allow up to 72 hours — and one-time enrollees lapse automatically each December. Confirmed victims cannot opt out: Gloria's enrollment is permanent, the CP01A comes every December-January for good, and that permanence is the point — her SSN is known-circulated, so her door stays locked. Dependents' PINs have an e-file/paper asymmetry worth pinning: if a dependent has an IP PIN, an *e-filed* return claiming them must include it (on the 1040, the child-care Form 2441, and Schedule EIC — miss it and the e-file rejects), while *paper* returns don't carry dependents' PINs at all. And the wrong-PIN failure mode is gentle: mistype it and the e-file bounces with a fixable reject (the IND-180/181 family — re-enter and retransmit); no penalty, no flag, no drama. Nadia's first January retrieval, late January 2027, takes ninety seconds with her morning coffee; her locked TY2026 foundation return — the $58,000 of wages, the $706 refund you can reconcile from the withholding lesson — e-files that afternoon with six extra digits in one box, and is accepted before dinner. That non-event is the entire product.

The widget's bottom row earns its place at every kitchen table: the tax world is lousy with things called PIN, and conflating them is the most common IP PIN confusion in practice. The five-digit self-select PIN is just your e-signature — you invent it at filing, it proves nothing about identity theft. The third-party designee PIN from the notices lesson merely lets a helper discuss your return with the IRS. The six-digit IP PIN — IRS-issued, annual, secret — is the only one that locks the door. When software asks *"Do you have an Identity Protection PIN?"* it means the six-digit one, it's asking because the IRS's records say one exists for your SSN, and answering it correctly is the whole job.

Five weeks after her case closes, the endgame notice arrives — and unlike every other envelope in Gloria's trouble arc, this one is good news wearing the same beige uniform. Late December 2028: notice CP01A, the annual IP PIN letter, sent because her resolved case auto-enrolled her on the mail track. It will come every December-or-January for the rest of her filing life, each one carrying the fresh six digits for the season ahead. Read it whole the way the notices lesson taught — number, year, date, ask — then keep it somewhere that survives until filing day.

Field by field, because each block answers a question Gloria actually has. The top-right block — notice number CP01A, tax year 2028, date December 28, 2028 — decodes on sight now: this is about the return she'll file *in early 2029* for tax year 2028; the PIN inside is a calendar-2029 key, good for anything 1040-shaped she files during 2029 and dead on January 1, 2030, when its successor takes over. The PIN block is the whole cargo — six digits, top of the first column, the one number on the page worth protecting. Where does it live until April? Not on the refrigerator: with the tax documents, photographed once into someplace private, treated — the IRS's own comparison — like a password. The what-to-do rows repeat the placement she'll use at her next VITA appointment: paper, the six boxes right of her signature; software, the IP PIN prompt (the VITA volunteer will ask; sites see CP01A holders every February). And the never-ask row restates the scam-proofing sentence this lesson has now planted three times, because the CP01A itself is a phishing target — the January text reading "your IP PIN needs verification, tap here" is aimed precisely at people known to be holding this notice. Hers goes in the folder with the birth certificates. In February 2029 she e-files her TY2028 return with the PIN in the box, and it is accepted in under an hour — the first time in this curriculum's whole trouble arc that a Gloria filing is a complete non-event. That is what the lock buys: boring.

There's a second species of tax identity theft, quieter and stranger than refund fraud: employment-related identity theft — someone uses your SSN not to file a return but to *hold a job*. Usually it's someone who can't pass employment verification under their own number; sometimes it's a synthetic identity built on a child's clean SSN. Their employer, doing everything right, files a W-2 for the wages — and that W-2 lands on your IRS wage record, where the underreporter machinery from the notices lesson will eventually compare it against a return that (correctly) never mentioned it. You typically find out one of five ways, each of which the IRS lists: a CP01E notice ("someone may have used your SSN to get employment"); a CP2000 proposing tax on wages you don't recognize; a CP2057 (the softer "you may need to amend" cousin); a W-2 or 1099 from an employer you never heard of arriving in your mail; or a Social Security statement whose earnings history shows jobs you never held. The instinctive fear — *am I about to owe tax on a stranger's paychecks?* — has a clean answer: no, and the fix is mostly paperwork, but the paperwork matters more than it looks, because one side of it protects this year's taxes and the other protects your retirement.

Walk the two fixes in the order the flow shows. The IRS side is a response discipline, not a filing. If a CP2000 proposes tax on the phantom wages, you answer it exactly the way the notices lesson taught — *disagree*, with the reason stated plainly: this income is not mine and I believe my SSN was used for employment by someone else. The CP2000 anticipates you: buried in its explanation pages is a "Misidentified income" paragraph inviting precisely that response, and in identity-theft cases the IRS asks you to enclose a photo ID copy plus a signed Form 14039 *or* a police report. What you never do is amend your return to include income you didn't earn — the IRS's employment-theft page says so in exactly those words, because amending adopts the thief's wages as yours. If you found it yourself (that stray W-2) with no IRS letter in play, Form 14039 checking Section B Box 3 opens the case; if the CP01E arrived first, read its FAQ carefully — the IRS has *already* marked your account with the identity-theft indicator, and it says in plain terms that no Form 14039 is needed. The SSA side is the one people skip, and shouldn't. Those phantom wages also sit in Social Security's earnings ledger — the record your retirement and disability benefits are computed from — and corrections there are Social Security's job, not the IRS's: contact the SSA (a *my Social Security* account at ssa.gov/myaccount shows the ledger; 800-772-1213 works the fix) with your W-2s or pay stubs to prove what's genuinely yours. The law's ordinary correction window is about three years, but identity-theft-shaped errors — employer-report mistakes, conforming the record to your actual tax filings — fall under exceptions that stay open, so old phantom wages are still fixable. Prevention rounds it out: the IP PIN guards the *filing* side (an employment thief who also tries refund fraud hits the lock), and for the *hiring* side, E-Verify's free Self Lock lets you freeze new-employment verification under your SSN the way a credit freeze blocks new loans.

Now the third lane — the one most readers of this lesson are actually in. Denise Carter, 55, single, runs the cafeteria at a Toledo elementary school on about $38,000 a year. In September 2026 she gets the letter tens of millions of Americans get every year: a vendor that processes claims for her health plan was breached, and among the exposed fields sits the one that matters — *Social Security number*. No fake return has been filed. Nothing has been stolen from her but certainty. The letter offers the standard consolation prize — a year of free credit monitoring — and Denise's first instinct is the universally human one: a flash of panic, then the temptation to file the letter somewhere dark and think about it never. What this section is for: the window between exposure and use belongs to her, most breached data is never used against any given person, and ninety minutes of free locks convert "exposed" from a dread into a footnote.

Her ninety minutes, in the order that pays best. The freezes first — all three bureaus, free, done from the kitchen table, the new-credit door locked within a business day. The IP PIN second — her tax-side lock, through the Form 15227 mail track you watched her use two sections ago, chosen *now*, in September, precisely so the four-to-six-week processing and the November enrollment blackout can't collide with filing season. (Answer to the question she asks the enrolling agent: no, you do not wait to be a victim; the program has been open to everyone since 2021, and *exposed* is exactly who it's for.) The monitoring third: she accepts the breach company's free year — free monitoring is fine as a smoke detector — while declining the upsell tier, because everything the paid tier locks, the freezes she just placed already lock for free; then she calendars the free weekly report checks at AnnualCreditReport.com and the annual two-document check from the last section. And the tax habit fourth: file reasonably early each season. Filing early genuinely shrinks the thief's window — a return already accepted under your SSN makes the fake bounce instead of yours — but this lesson refuses to teach it as the defense, because it's a footrace you can lose through no fault (W-2s legally arrive as late as January 31; the EITC/ACTC refund hold means the mid-February wall exists anyway; life happens). Early filing is a good habit. The IP PIN is the lock. Denise now has both, plus a folder with the breach letter in it, and the story's ending is the whole point: nothing ever happens. That's what winning this one looks like.

Zoom out once before the defenses close, because the history carries two facts worth owning. First: this crime has been beaten before. In the mid-2010s, tax refund fraud ran wild enough that stolen-identity filings were a headline industry — and then in 2015 the IRS, the state tax agencies, and the tax-software and financial industries formed the Security Summit and rebuilt the pipes: shared fraud signals between software companies and the IRS, earlier W-2 deadlines, the mid-February EITC/ACTC refund hold from the payments lesson, device and behavior analytics inside the filing systems, and eventually the everyone-eligible IP PIN. The published results of that first campaign: between 2015 and 2019, taxpayers reporting identity-theft victimization fell about 80% — from roughly 677,000 to 137,000 a year — while confirmed fraudulent returns stopped in processing fell by two-thirds and billions in bad refunds were blocked. Your rejection story is real, but it happens against a defense that has already crushed this crime's golden age — and the filters now suspend close to three million suspicious returns a season before a dollar moves.

Second — and this curriculum states it rather than whispers it, exactly as the audits lesson did with its EITC-audit numbers: the leftover pain is not evenly distributed. The National Taxpayer Advocate's figures put roughly two-thirds of resolved victim-assistance cases with lower-income taxpayers — households at or under 250% of the poverty line, EITC-shaped refunds, the exact anatomy the refund-anatomy widget dissected. That's partly the crime's economics (refundable credits are what invented returns can mint) and partly a hard truth about whose months-long refund delay becomes a housing emergency versus an annoyance. The Advocate's *unconscionable* label, the 90-day resolution target she presses on Congress, and the unit's ~100-day track on fresh cases are all, in effect, the system arguing with itself about Gloria. Know both facts at once, the way this arc keeps asking you to: the machine has real, published victories against this crime — and the people still standing in its longest line look a lot like the person this lesson chose to walk through it.

This lesson's danger fixture has a twist worthy of its subject: the scams to watch for here impersonate the defenses you just learned. Identity thieves need one thing — your data — and the most efficient way to harvest it is to dress up as the IRS, as your tax software, as an "IP PIN verification service," as a helpful stranger offering to set up your IRS account. The IRS's annual Dirty Dozen scam list for 2026 (published March 5, 2026) is bracketed by exactly these plays, and four of its twelve entries are this lesson's territory: phishing and smishing — fake-IRS emails, texts, and DMs "using alarming language and QR codes that direct taxpayers to fake IRS websites to 'verify' accounts, enter personal information, or claim refunds"; AI-enabled phone impersonation — robocalls with computer-generated voices and spoofed caller ID doing the old arrest-threat script with new production values; IRS Online Account "help" — strangers who offer to set up your account and walk away with the keys to everything the account protects; and ghost preparers, the data leak that started Gloria's whole arc. Read the tells, then the one rule that defeats all of them.

Notice what every tell shares: urgency plus a channel the IRS doesn't open with. The current IRS contact rules — refreshed on its help pages in mid-2026 and worth quoting because the wording recently changed — are: *"We normally contact you the first time by mail delivered by the U.S. Postal Service"*; email and text only if you opted in (real IRS email addresses end in irs.gov); *"a social media direct message is never from us"*; and on the phone, *"we never call to demand payment now, threaten arrest or inform you of a refund."* Layer the IP PIN rule on top — the IRS never asks for your IP PIN, period — and every scam in this section dies at the doorstep, because each one has to violate at least one of those lines to work. When a message seems even possibly real, the verification move is always the same and never involves the message itself: type irs.gov yourself, sign into your Online Account, look the claimed notice number up, or call the IRS's published line. And the reporting channels aren't just civic housekeeping — the IRS's filters learn from forwarded phish, which means every report is a brick in the wall between the next Gloria and her thief. Report even the attempts that didn't fool you for a second; *especially* those.

Maybe you didn't read this lesson in time. The rejection came last month, or last year — or the IRS letter about a return you never filed sat unopened because you couldn't face it — or you clicked the link, gave the caller the number, paid the "verification fee," and have been carrying it around like a stone ever since. Set two things down first, in either order. The shame: these operations are engineered by professionals who script for smart, careful people under stress — the same weeks you were working doubles and parenting solo. Falling for a machine built to make people fall is not a character flaw, and the ghost preparer who leaked Gloria's data fooled a woman who has since out-argued the IRS twice on the merits. The dread of being late: there is no expiration on any move this lesson taught. The affidavit has no deadline. The freezes work the day you place them. The IP PIN program enrolls you this January or any January. Even a years-old theft you never reported — discovered now on a transcript or an SSA statement — opens with the same Form 14039, the same channels, today.

What you can still do now, in the order that helps most: if a rejection or a suspicious letter is sitting unanswered, answer it this week — verify at irs.gov/verifyreturn if the IRS wrote to you, or paper-file with the affidavit if your e-file bounced; every week of silence is a week added to a queue you now know is long. If your real return was never filed at all because the bounce scared you off — file it now; late is fixable (the penalty machinery from the next lesson is built for coming back), but unfiled compounds. If you gave a scammer information, run Denise's list tonight: freezes, IP PIN, IdentityTheft.gov, and the report channels from the Scam Watch. If money already went out the door to a fake "IRS," report to TIGTA and ReportFraud.ftc.gov and your bank — clawbacks are rare but real, and the report protects the next target either way. And if the wait is breaking something that can't wait — rent, heat, a prescription — that is what the Taxpayer Advocate Service is *for*: Form 911, 877-777-4778, free, no income test. None of this is starting over. All of it counts from wherever you are. And the person who reports the scam that got them is, for the next victim, the whole early-warning system — the most useful person in this entire lesson.

The identity-theft recourse ladder, from first move to last resort — with the honest caveats about wait times attached, because this lesson doesn't sell a helpline it wouldn't call.

1. IdentityTheft.gov — the master plan. The FTC's one-stop site: the official identity-theft report, a personalized recovery checklist, pre-filled dispute letters, and the option to complete and transmit Form 14039 to the IRS from inside the interview. Start here for anything wider than taxes alone; it's the map the rest of this ladder hangs off.
2. Form 14039 + your paper return — the tax-case opener. The affidavit (online portal, mail, or fax — one channel only), stapled behind your real return when a duplicate-SSN rejection forced you to paper. This is the move that puts your case in the specialist queue; everything after it is follow-through.
3. The IRS identity-theft line: 800-908-4490 (weekdays 7 a.m.–7 p.m. your local time) — the unit historically known as the Identity Protection Specialized Unit, for lost IP PINs, case questions that can't wait, and verify-this-is-real calls. Honest caveat, carried from every help stack in this arc: IRS phone service is seasonal and thin — in recent filing seasons only a minority of calls to some lines connected — so lead with the self-serve rungs (your Online Account; the Processing status for tax forms page shows which month's affidavits the unit is working) and treat the phone as the exception channel.
4. The IP PIN program — the permanent lock. Not really a rung so much as the door you install on the way out: automatic for confirmed victims, open to everyone else at your IRS Online Account, via Form 15227 (under the income ceiling), or at a Taxpayer Assistance Center (844-545-5640).
5. The Taxpayer Advocate Service — when the wait becomes hardship. Independent, free, inside the IRS with authority to move stuck cases: Form 911 or 877-777-4778, for economic harm (eviction, shutoff, medical need) or a case going in circles. Identity-theft refund delays are among TAS's steadiest casework — this is the rung built for month nine of a wait you can't afford.
6. A Low Income Taxpayer Clinic — if a dispute grows out of it. Free or nominal-fee representation (income up to 250% of the poverty line) for when an identity-theft case entangles with an audit, a collection action, or a notice fight — the same clinics that would have carried Gloria's CP75. Directory via the Taxpayer Advocate's site. VITA, honest as ever about scope: free preparation, not case representation — it's where Gloria files, not where cases get argued.
7. The credit bureaus — the parallel track. Freezes and disputes at Equifax, Experian, and TransUnion individually (free, by law); fraud alerts placed at any one bureau propagate to all three; free reports weekly at AnnualCreditReport.com. For the lending-world half of the crime, these — not the IRS — are the authority.

Eleven questions that arrive with nearly every stolen-refund story, answered plainly — each pointing back to the section where the full story lives.

• "Will I actually get my refund?" Yes — in full. The thief's take came out of the Treasury, not your entitlement; the victim-assistance unit's own work order includes processing your real return and "releasing your refund," and the fraudulent return is removed from your records entirely. The honest cost is time, not money — and the wait accrues interest in your favor.
• "Do I have to pay back what the thief got?" No. Their refund was never yours and never becomes your debt. You'll never see a bill for it, and if anyone contacts you demanding repayment of a "fraudulent refund" — that's an impersonation scam wearing this lesson's vocabulary; report it to TIGTA.
• "How long will this really take?" Plan in months. The IRS's goal is 120 days; its own page admits the average has run about 20 months through the backlog, and the Taxpayer Advocate's latest figure is 21 months — while newly received cases have been resolving in roughly 100 days. Budget like a realist, keep the TAS number for genuine hardship, and let a fast resolution be the good surprise.
• "Should I call to check on my case?" Mostly no — the IRS asks victims not to submit duplicate affidavits or call for status, in as many words, because both cause delays. The self-serve pulse: the Processing status for tax forms page (which month's affidavits are being worked) and your Online Account. Call 800-908-4490 for questions that genuinely can't wait; call TAS when waiting is causing harm.
• "The IRS texted me to verify my IP PIN — is that real?" Never. Verbatim from the IRS: it will never ask for your IP PIN, and calls, emails, or texts asking for it are scams. The IRS's first contact is paper mail; it emails or texts only people who opted in; a DM is never the IRS. Forward the text to 7726 and to phishing@irs.gov (subject "Text") and delete it with a clear conscience.
• "Should everyone get an IP PIN — even with no theft?" For most people, yes — it's the only lock on the tax side, it's free, and enrollment takes minutes online. The honest costs: a small annual chore (online enrollees must retrieve the new PIN each January — no reminder letter), the filing-season friction if you lose it, and for the commitment-averse there's one-time enrollment that lapses automatically each December. Exposed-but-not-victimized readers — the Denise lane — are exactly who the 2021 all-comers expansion was built for.
• "I lost my IP PIN and it's April — now what?" Retrieve the current one in your IRS Online Account (Profile → IP PIN), or call 800-908-4490 for a phone-verified re-mail within 21 days — noting the two hard exceptions: post-2019 online enrollees retrieve online only, and after October 14 phone reissue closes for non-filers. Never guess, and never reuse last year's — a wrong PIN just bounces the e-file (a fixable reject, no penalty).
• "I froze my credit — so I'm safe from this, right?" No — that's this lesson's most expensive misunderstanding. A freeze guards the lending world; the IRS never pulls credit before accepting a return, so a freeze is invisible to a refund thief. The tax side has exactly one lock, the IP PIN. Run both: freeze for loans, PIN for filings.
• "Someone claimed my child — is that identity theft?" It depends who. A stranger or fraudster using your child's SSN: yes — Form 14039 on the child's behalf, and since tax-year-2024 returns you can even beat the collision by e-filing with your own IP PIN and letting the IRS's duplicate-claim process run. The other parent in a custody tangle: no — the form itself says a parent or guardian misusing a dependent's info on taxes "is not identity theft"; that's the dependents lesson's tiebreakers, and both of you will get the IRS's who-gets-the-child letters instead.
• "Do I need a police report?" Usually not for the IRS — Form 14039 or the FTC's IdentityTheft.gov report carries the tax case (in exam contexts the IRS accepts a police report as an alternative to the affidavit). File one anyway if you know the thief, if a bank or insurer demands it, or to arm the seven-year extended fraud alert. Don't let a precinct visit delay the affidavit or the paper return by a single day.
• "Does this touch my state refund too?" It can — states run their own refund systems, their own fraud screens (Ohio's verification quiz letters, for instance), and their own recovery processes; the IRS's own victim checklist ends with "check with your state tax agency." No-income-tax states like Gloria's Tennessee have no state return to steal — one small mercy in her arc. Everyone else: one call or web form to your state revenue department after the federal steps.

You've walked the whole territory: the bounce, the affidavit, the paper lane, the wait, the letters, the lock, the phantom wages, the breach letter, the scams wearing IRS costumes. Now run the drill you'd actually run at the kitchen table. The planner below holds this lesson's three front doors — *my e-file was rejected*, *the IRS wrote to me about a return I didn't file*, and *nothing's happened, lock my doors* — and builds the ordered, dated to-do list for whichever you pick, with Gloria's, the verification-letter, and Denise's paths pre-loaded. Then flip to the phishing self-check and test six messages against the contact rules the Scam Watch taught. It computes nothing about you and stores nothing anywhere; it's a rehearsal space.

As you flip the planner's doors, watch the pattern that makes this whole lesson portable: every path starts with *slow down and identify which situation you're actually in* (triage before affidavits; letter type before response; exposure before panic), every path runs on documents with numbers you can look up rather than on anyone's say-so, and every path ends at the same two-part lock — the freeze for the lending world, the IP PIN for the tax world. When some February a rejection email lands on someone you love, you won't remember every notice number in this lesson. You'll remember the drill: triage, affidavit-with-the-paper-return, report, freeze, PIN, and never give six digits to anyone who calls asking. That's the skill. You now have it.

Every term this lesson introduced, in one place — the vocabulary of tax identity theft and its defenses.

• Tax-related identity theft — someone using your stolen SSN (or ITIN) inside the tax system: filing a fraudulent refund return in your name, claiming you or your dependent on their return, or working under your number.
• Refund fraud — the filing variant: an invented early-season return under a stolen identity, shaped to mint a refund (usually refundable credits) into an account the thief controls. The Treasury's loss — never the victim's debt.
• Reject code IND-515 — the e-file business rule that bounces a return because the primary SSN already appears on an accepted return for the year; the classic first symptom. Cousins: IND-516/517 (dependent tangles), IND-510 (spouse), R0000-902 (generic duplicate TIN).
• A rejected e-file is not a filed return — the legal status that keeps your deadline running; the paper return must still go in on time (or by the 10-calendar-day grace after a late-season rejection).
• Form 14039 (Identity Theft Affidavit) — the two-page sworn statement (about 15 minutes) that opens an identity-theft case: situation checkboxes, impact checkboxes, a facts-only narrative, and a penalty-of-perjury signature. Filed once, one channel only — and not at all if the IRS already wrote to you.
• Penalty of perjury — the legal oath under which the affidavit (like the 1040 itself) is signed: good-faith truth, criminal exposure for deliberate lies — the weight that lets a two-page form arbitrate between two colliding returns.
• IDTVA (Identity Theft Victim Assistance) — the specialized IRS unit that works victim cases: verifies the real filer, removes the fraudulent return, releases the refund, and marks the account. Reached in writing via the affidavit; by phone at 800-908-4490 (the line long known as the Identity Protection Specialized Unit).
• Identity-theft indicator — the permanent marker IDTVA places on a resolved account, heightening screening on everything filed under that SSN and triggering automatic annual IP PIN enrollment.
• CP01S / CP01 / CP01C / Letter 4674C — the case paper trail: the acknowledgment ("we received your claim"), the resolution ("we verified your identity theft claim"), the verified-but-no-tax-fraud variant, and the detailed closing letter.
• CP01E — the employment-variant notice: someone may have used your SSN to get a job; the indicator is already placed, no affidavit needed. Its to-do list is the SSA earnings check, credit monitoring, and an IP PIN.
• CP01A — the annual IP PIN delivery notice, mailed each December–January to confirmed victims and mail-track enrollees, with the new six-digit PIN at the top of the first column. Online enrollees get no CP01A — they retrieve theirs online each January.
• IP PIN (Identity Protection PIN) — the six-digit, annually regenerated number that must accompany every federal 1040-family return filed under your SSN once you're enrolled: a wrong or missing PIN bounces an e-file and slows a paper return. Free, voluntary since 2021 for anyone with an SSN or ITIN, automatic for confirmed victims. Never used on state returns or extensions.
• Get an IP PIN / IRS Online Account — the instant enrollment door: ID.me identity-proofing, then Profile → IP PIN, with a choice of continuous or one-time enrollment; also where a current PIN is retrieved each January or after a loss.
• ID.me — the identity-proofing service in front of IRS online tools: government photo ID plus SSN, verified by selfie-match or a live video agent.
• Form 15227 — the paper/phone IP PIN application for filers under the income ceiling ($84,000 single / $168,000 MFJ on the last filed return, as posted mid-2026): the IRS calls to verify, the PIN mails in 4–6 weeks, and delivery goes mail-track (annual CP01A) thereafter.
• Taxpayer Assistance Center (TAC) — the IRS's walk-in offices (appointments: 844-545-5640): the in-person enrollment and identity-verification door, used with a photo ID plus a second identity document.
• Identity-verification letters (CP5071 series / 5071C / 4883C / 5747C / 5447C / 6330C-6331C) — the IRS-caught-it-first doorway: a suspicious return is frozen unprocessed until you verify — online at irs.gov/verifyreturn, by phone, or in person, per your letter type. Verify instead of filing an affidavit; "I didn't file this" is itself the report.
• irs.gov/verifyreturn (Identity and Tax Return Verification Service) — the online verification tool behind the CP5071-series letters; after verifying, processing resumes (allow up to nine weeks).
• Employment-related identity theft — someone working under your SSN, landing their W-2 on your IRS record and their wages on your Social Security ledger; fixed by disputing the income (never amending it in), Form 14039 Box 3 when self-discovered, and an SSA earnings-record correction.
• Wage & Income transcript — the IRS's list of every W-2/1099 filed under your SSN (Online Account; current plus nine prior years; new-season data from early February) — the annual five-minute check that surfaces phantom employers.
• SSA earnings record — Social Security's year-by-year wage ledger (ssa.gov/myaccount), the base for future benefits; phantom wages there are corrected through the SSA (800-772-1213), with correction windows that stay open for employer-report errors.
• E-Verify Self Lock — the free DHS tool that freezes new-hire employment verification under your SSN — the employment-side sibling of a credit freeze.
• IdentityTheft.gov — the FTC's one-stop identity-theft site: the official FTC Identity Theft Report, a personalized recovery plan with pre-filled letters, and an interview that can complete and transmit Form 14039 to the IRS.
• Credit freeze (security freeze) — the free-by-law lock on your credit file at each bureau separately (placed within one business day online or by phone; lifted online almost instantly): stops new-account fraud cold — and does nothing against tax refund fraud, which is the IP PIN's job.
• Fraud alert — the lighter credit-side tool: free, one bureau notifies all three, one year (renewable) telling lenders to verify identity first — extendable to seven years for documented identity-theft victims.
• AnnualCreditReport.com — the single official free-reports source, now weekly for all three bureaus; the monitoring half of the credit defense.
• PATH Act refund hold — the law from the payments lesson holding all EITC/ACTC refunds until mid-February ("By law, we can't issue EITC or ACTC refunds before mid-February… includ[ing] your entire refund") — partly an anti-fraud wall giving document matching a head start on invented credit claims.
• Security Summit — the 2015 IRS–states–industry partnership that broke refund fraud's golden age (victim reports down ~80% by 2019) and still runs the defenses: shared fraud signals, the annual Dirty Dozen list, and the IP PIN's expansion.
• Overpayment interest — the meter that runs in your favor on a long-held refund: federal short-term rate plus three points, compounded daily from the return's due date (past the IRS's 45-day administrative window) — paid automatically with the released refund, and itself taxable.
• phishing@irs.gov / 7726 / TIGTA (800-366-4484) / IRS.gov/SubmitATip — the reporting quartet: fake IRS emails and texts to the mailbox; texts also to your carrier's 7726; impersonation calls to the Treasury's inspector general; and everything tax-fraud-shaped to the IRS's new consolidated tip portal.