Someone Filed Taxes in Your Name. Here’s What’s Happening, What to Do, and How Long It Takes.

Your e-filed return came back rejected because someone already filed under your Social Security number. Or you got a letter from the IRS asking you to verify a return you didn’t file. Or your tax software notified you that someone tried to file using your information.

You’re now dealing with one of the more confusing problems in the identity theft category. Most recovery guides treat it as a flat checklist: file Form 14039, contact the FTC, freeze your credit, done. That advice is wrong for a meaningful share of the people reading it, because the right response forks based on a question most articles skip: who detected the problem first?

I spent over 20 years building identity protection products. Here’s the honest picture of what’s actually happening when this fraud occurs, what to do based on your specific situation, and the recovery timeline the IRS quietly publishes on its own dashboards but most articles don’t quote.

First, Figure Out What Kind of Tax Fraud You’re Dealing With

“Tax identity theft” actually covers several distinct fraud types, and the right response depends on which one you’re dealing with.

Refund fraud, also called return filing fraud. Someone filed a federal tax return using your Social Security number, usually to claim a fraudulent refund. This is the scenario most people picture when they hear “tax identity theft,” and it’s what this article primarily covers.

Employment-related identity theft. Someone used your SSN to get a job. The employer reports wages to the IRS under your number, but no fraudulent return was necessarily filed. This typically surfaces as IRS notices about wages from employers you don’t recognize, unexpected entries on your Social Security earnings record, or notices that someone has claimed unemployment benefits in your name. Recovery requires both an SSA correction and an IRS submission to clean up the tax account.

Business tax identity theft. Someone used your business name or Employer Identification Number (EIN) to file a fraudulent business return, claim refundable business credits, or file false W-2s. Different form, different process. Brief section at the end of this article.

For refund fraud specifically, you also need to know who detected the problem. The IRS uses what it describes as hundreds of processing filters to flag suspicious returns and frequently catches refund fraud before any money goes out the door. When the agency catches it first, you’ll get a specific kind of letter, and the right response is to follow the letter, not to file a separate affidavit.

If you discovered the problem yourself, through a rejected e-file or some other signal, the path is different.

The most common ways tax identity theft gets detected:

• A rejected e-file because your SSN was already used on another return
• An IRS verification letter, specifically the 5071C, 4883C, 5747C, or 5447C
• An unexpected tax transcript arriving in the mail
• IRS notices showing wages or unemployment income from employers you don’t recognize
• A balance-due notice or collection notice for a tax year you didn’t file
• An EIN assignment letter for a business you never registered

The next two sections cover the two most common scenarios: the IRS contacted you, and you discovered it yourself.

If the IRS Sent You a Verification Letter, Follow the Letter First

This is the part most recovery guides get wrong. If you received a specific IRS verification letter, the IRS already has the suspicious return in hand and has paused processing while it figures out which filing is legitimate. Your job is to verify your identity through the process the letter specifies, not to file a separate identity theft affidavit.

The IRS explicitly says that Form 14039, the Identity Theft Affidavit, generally should not be filed in this situation unless the agency specifically tells you to. Filing one anyway can create duplicates that slow your case down further.

The verification letter you received determines exactly how to verify:

Letter 5071C or CP5071 series. You can verify online through the IRS Identity and Tax Return Verification Service if the notice allows it, or by phone using the number on the notice itself.

Letter 4883C. You must verify by phone. The letter contains the specific number to call.

Letter 5747C. You’ll need to verify in person at a Taxpayer Assistance Center. Make an appointment in advance through irs.gov.

Letter 5447C. Provides instructions for certain taxpayers outside the United States.

For any of these, have the letter, the affected return, a prior-year return if available, and your supporting documents like W-2s and 1099s in front of you when you start. If you did not file the return the IRS is asking about, you must clearly tell the IRS that during the verification process. That distinction is what kicks the case onto the identity theft track instead of routine verification.

If you complete verification successfully and confirm the return wasn’t yours, the IRS treats your verification response as the trigger for the identity theft case. You don’t need to also file Form 14039. You will, however, want to complete the broader identity recovery steps described later in this article: filing at IdentityTheft.gov, placing fraud alerts and credit freezes, and checking your Social Security earnings record.

If You Discovered It Yourself, the Paper Filing Path

The other common scenario is that you found out before the IRS did. Your e-file rejected with a duplicate-return error. Your tax software notified you that someone tried to access your account. You haven’t received any IRS letter yet.

In this case, you can’t e-file your real return because the system thinks one already exists under your SSN. The path the IRS and the Taxpayer Advocate Service direct you to is paper filing combined with Form 14039.

The specific steps:

1. Print and sign your real federal tax return.
2. Include a copy of the e-file rejection notice with the paper return.
3. Mark the first page of the return “REJECTED ELECTRONIC RETURN” and write the rejection date next to it.
4. Complete Form 14039, the Identity Theft Affidavit, and either include it with your paper return or submit it online while mailing the paper return separately.
5. Mail the package to the IRS address that applies to your return type.

A few things worth understanding before you start.

Form 14039 is specifically for tax-related identity theft, not general identity theft. The IRS has stated repeatedly that most people do not need to file it because the agency catches most refund fraud through its own filters first. But when you’re in the situation of needing to paper-file because someone already filed under your number, Form 14039 is the right tool.

Do not file duplicates. The IRS specifically warns that duplicate Forms 14039 cause processing delays. If you’ve already submitted one, don’t submit another unless the IRS directly asks you to.

If the paper filing process means you can’t meet the original filing deadline, you can still request a filing extension to give yourself more time. The extension is for filing, not paying, so estimate any tax owed and pay that amount by the original deadline to avoid late-payment penalties.

The Broader Identity Recovery Work

Whether the IRS detected the fraud or you did, there’s a parallel set of steps that aren’t tax-specific but matter for protecting yourself going forward. These run alongside the IRS process, not after it.

File at IdentityTheft.gov. The FTC’s identity theft tool generates an official FTC Identity Theft Report and a personalized recovery plan. This is the same step covered in detail in our credit card fraud recovery guide, and the same documentation applies here. The Identity Theft Report is your leverage for stopping debt collection on fraudulent accounts and for the four-business-day identity theft block path with the credit bureaus.

Place a fraud alert and freeze your credit. Tax identity theft itself doesn’t directly affect your credit file, but the personal information used to file a fraudulent return often gets used for other forms of fraud as well. A fraud alert at one bureau covers all three. A credit freeze blocks new account openings entirely. Our credit freeze guide walks through the process at each bureau.

Check your Social Security earnings record. Log in to your account at ssa.gov and review your earnings history. If you see wages from employers you didn’t work for, that’s a sign of employment-related identity theft, which often runs alongside refund fraud. SSA can review and correct the earnings record. Tax-account corrections still go through the IRS.

Request a copy of the fraudulent return. The IRS allows identity theft victims to request a masked copy of the fraudulent return filed using their SSN, using Form 4506-F. Knowing what was on the fraudulent return helps you understand how your information was misused and supports later correction steps.

Document everything. Keep a log of every call, every letter, every reference number. The IRS process takes longer than ordinary credit fraud recovery and involves more handoffs between agencies. Your memory of phone call details from week one will not be reliable by month four. The log is what keeps you organized when an IRS representative asks what was promised in a call you made eight months earlier.

The Timeline the IRS Doesn’t Lead With

This is the section most tax identity theft articles either skip entirely or misrepresent. The IRS publishes its current case-handling times on its own dashboards. They aren’t reassuring.

The IRS’s own page on how identity theft case resolution works says cases are generally resolved in 120 days under normal conditions. That’s the figure most articles quote, and it’s the figure the IRS leads with.

What the same page acknowledges, in a separate paragraph, is that the current average is 611 days. As of late April 2026, the IRS dashboard shows the agency is processing Form 14039 affidavits that were received in September 2024. The Taxpayer Advocate Service reported similar numbers in its January 2025 update: an average of 676 days for identity theft victim assistance cases closed in fiscal year 2024, and 506 days for cases closed in the first part of fiscal year 2025.

In other words: the official “120 days” figure has not reflected reality for years. Real timelines are well over a year, and frequently over two.

For practical planning, separate two distinct timelines:

Paperwork processing time. This is how long it takes the IRS to open and begin handling your affidavit, correspondence, and account issue. The current Form 14039 backlog reaching back to September 2024 is a measure of this intake time. It’s not a measure of when your refund will arrive.

Refund release time. This depends on how the case got started. If the IRS flagged a suspicious return and you completed identity verification quickly, the Taxpayer Advocate Service says your legitimate refund may take up to nine weeks after verification. That’s the best-case scenario, and it’s still longer than ordinary processing.

If the case started from a self-reported Form 14039 with a paper return, refund release is part of the broader Identity Theft Victim Assistance case resolution process. That includes removing the fraudulent return from your account, correcting the account, properly processing your real return, and then releasing any refund. All of that work has to finish before the refund moves.

If a delayed refund is causing actual financial hardship (eviction risk, utility shutoff, inability to pay for medical care), you can request hardship assistance from the Taxpayer Advocate Service. TAS is an independent organization within the IRS specifically designed to help when normal channels are failing or when delays are causing serious harm. Their assistance is free.

The honest planning advice: assume the case will take well over a year. Continue filing your taxes on time during that period using whatever process the IRS instructs (paper filing if necessary). Don’t wait for the identity theft case to close before filing future-year returns.

Prevention Going Forward: The IP PIN

The single strongest IRS-specific prevention tool is the Identity Protection PIN, or IP PIN. It’s a six-digit number known only to you and the IRS, and it must be included on any tax return filed under your SSN. Without the correct PIN, the IRS rejects e-filed returns and delays paper returns for identity verification.

Here’s why it works. The IP PIN turns tax filing from a one-factor process (your SSN) into a two-factor process (your SSN plus a number that arrives by mail each January and that a fraudster has no way to obtain). It’s a structural defense, not a behavioral one. You don’t have to recognize the fraud or react to it. The PIN simply blocks any return filed without it.

If you’ve been confirmed as a tax identity theft victim, the IRS automatically enrolls you in the program going forward. You don’t have to apply.

If you haven’t been victimized but want the protection anyway, anyone with an SSN or ITIN who can verify their identity can enroll proactively at irs.gov/ippin. The program isn’t niche: the IRS reported more than 10.4 million enrolled taxpayers as of mid-2024. Enrollment works best when completed before filing season begins, because once a fraudulent return is already in the system, the IP PIN doesn’t undo it.

A few things the IP PIN doesn’t do, worth knowing because the marketing for paid services sometimes implies otherwise.

Standard credit monitoring services do not detect tax identity theft. A fraudulent tax return doesn’t appear on your credit file, which means dark web monitoring and credit alerts can’t see it. The FTC says this directly. If you’re paying for identity protection mainly for tax fraud coverage, the IP PIN is doing more for you than the monitoring service is.

The IP PIN doesn’t replace broader monitoring. It blocks fraudulent tax filings under your SSN. It doesn’t block employment fraud (someone using your SSN to work), it doesn’t block credit fraud, and it doesn’t catch existing account takeover. It’s one specific defense for one specific attack. A complete protective posture combines the IP PIN with a credit freeze, an SSA earnings record check, and the broader practices described in our credit freeze guide.

Filing early helps, but it’s not a substitute. Many tax fraud cases involve a “first filer advantage” for the criminal: they file before you do, so when you submit your real return, the system rejects it as a duplicate. Filing as early as you can each year reduces the window in which a fraudster can submit one first. But the IP PIN is a stronger defense because it changes what the IRS requires to accept any return under your SSN. Early filing is a useful habit. The IP PIN is an actual block.

A Brief Note on Business Tax Identity Theft

If you got an IRS letter for your business that you don’t recognize, an EIN assignment you didn’t request, or a duplicate-return rejection on a business filing, you’re dealing with business tax identity theft. Different form, different process.

The form for businesses, trusts, estates, and tax-exempt organizations is Form 14039-B, not the individual Form 14039. The IRS specifically directs entities to use Form 14039-B if they receive any of the following:

• A rejection notice for an e-filed business return because one is already on file
• A notice about a return or W-2 the entity did not file
• A balance-due notice the entity does not owe
• A notice for an EIN the entity never requested
• IRS Letter 6042C or 5263C asking to verify business information

Worth knowing: the IRS specifically says not to use Form 14039-B for a mere data breach with no tax-related impact yet identified. The form is for confirmed or strongly suspected business tax fraud, not for precautionary filings.

The broader prevention framework for business tax identity theft mirrors the individual one but with an organizational layer: anti-malware, multi-factor authentication on tax filing accounts, accurate responsible-party information for the EIN, employee phishing training, and limited access to sensitive data. The IRS treats this as both a tax-filing problem and a data-governance problem, and that’s the right framing.

The Honest Bottom Line

Tax identity theft is one of the slower, more bureaucratic forms of fraud to recover from, and most articles either understate the timeline or skip the question of who detected the fraud first.

The right path depends on that question. If the IRS sent you a verification letter, follow the letter, and don’t file a separate affidavit unless directed. If you discovered the fraud yourself, the paper filing path with Form 14039 is the right move. The broader identity recovery steps (FTC report, credit freeze, SSA earnings check, paper trail) run in parallel either way.

For the timeline, plan for over a year, not 120 days. The official figure and the actual figure haven’t matched in a long time. If a delayed refund causes real hardship, the Taxpayer Advocate Service can help.

Going forward, the IP PIN is the strongest single defense against tax identity theft. It’s free, it works structurally rather than reactively, and it does something paid identity monitoring services genuinely can’t: it blocks fraudulent returns from being accepted under your SSN.

If you haven’t already worked through the broader recovery steps, our recovery guide for fraudulent accounts on your credit report covers them in detail. If you’re weighing whether a paid identity protection service makes sense on top of an IP PIN and a credit freeze, our piece on whether identity protection is worth it walks through that decision honestly.

For parents, our child identity theft guide covers the IP PIN enrollment process for dependents specifically. Minors can’t independently verify their identity through the IRS online system, so dependent enrollment requires an in-person appointment at a Taxpayer Assistance Center.

---

Tom Reardon spent over 20 years in product and operations at major identity protection providers. He writes at MyScamGuide.com to give consumers the honest picture the industry’s marketing never did.

---

Recommended resources:

• IRS Identity Protection PIN: enrollment for adults and dependents
• IdentityTheft.gov: FTC’s official recovery resource and identity theft report generator
• IRS Identity Theft Central: IRS hub for identity theft information including Form 14039 and Form 14039-B
• Taxpayer Advocate Service: independent help when normal IRS channels are failing or causing hardship
• SSA my Social Security account: review your earnings record and report SSN misuse