Protecting Your Identity and Tax Information
You can reduce identity-theft risk by securing your accounts and limiting how you share personal information. Regular checks of bank statements, credit reports, and tax notices can also help you notice problems early.
The response depends on what happened. An unfamiliar charge, an exposed Social Security number, and a tax return filed in your name each call for different steps.
Protect your accounts and records
- Use a strong, unique password for each account. A reputable password manager can help you create and keep track of them. Change a password promptly if it has been compromised or exposed.
- Turn on multifactor authentication, which requires an additional way to verify your identity when you sign in. Protect your email account as carefully as your financial accounts because email is often used to reset other passwords.
- Keep your devices and security software updated, and back up important records. Automatic updates can help you avoid missing security fixes.
- Keep tax documents and identification records in a secure place. Shred papers containing personal information when you no longer need to retain them.
- Limit personal and family information posted publicly. Before providing a Social Security number, ask why it is needed, how it will be protected, and whether another identifier will work.
For tax documents and other sensitive records, use the recipient's established secure transfer method. Verify an unexpected change in delivery or payment instructions through a contact you already know. Ordinary unsecured email is a poor place for Social Security numbers and complete tax returns.
Verify unexpected contact
The IRS usually makes its first contact by mail, but it can call about account matters. Certain email and text messages are legitimate when you have opted in. The IRS does not send direct messages through social media.
If a message or call is unexpected, verify it independently. Use a known phone number or type IRS.gov into your browser and find the appropriate contact information. A caller's name, caller ID, or the callback number they supply is not enough. The IRS contact guide explains how the agency communicates.
The same caution applies to messages that appear to come from your bank, employer, or someone you know. Familiar names can be impersonated. A website's HTTPS address or lock symbol indicates encryption, not proof that the organization is legitimate. Avoid suspicious links and attachments, and confirm the request through a known genuine channel.
Suspicious IRS emails can be reported to [email protected]. Follow the IRS reporting instructions, which explain how to preserve useful message details. Do not send your tax documents to that address.
Review your credit and financial accounts
Check bank and credit card statements for transactions you do not recognize. Credit reports serve a different purpose: they can reveal unfamiliar accounts or inaccurate information in your credit history. These checks work together.
| Tool | What to know |
|---|---|
| Free credit reports | Each nationwide credit bureau offers a free weekly online report through AnnualCreditReport.com. These are credit reports, not credit scores. |
| Credit freeze | Contact Equifax, Experian, and TransUnion separately. Placing or lifting a freeze is free. It restricts access to your report for new-credit decisions and remains until you lift it. |
| Fraud alert | An initial alert prompts businesses to verify your identity before opening new credit. It is free and lasts one year, with renewal available. Contact one bureau; it must notify the other two. |
A credit freeze does not stop misuse of existing accounts or prevent a fraudulent tax return. You may need to lift it temporarily when applying for new credit. For details, see the FTC's guidance on free credit reports and credit freezes and fraud alerts.
Consider an IRS identity protection PIN
An identity protection PIN, or IP PIN, is a six-digit IRS code that helps prevent someone else from filing a return using your Social Security number or individual taxpayer identification number. You can request one proactively if you can verify your identity; you do not have to wait until you become a victim.
Use the current calendar-year PIN when filing your individual federal income tax return, including a return for an earlier year. Enter it in your tax software or give it to your trusted preparer when you are ready to sign and file. The IRS will not call, email, or text to ask for your IP PIN. Its IP PIN guide explains enrollment and how to obtain the current code.
Respond to signs of identity theft
An unexpected IRS notice or rejected return can be a warning sign, but it does not automatically establish identity theft. Verify the notice and check the reason for the rejection before deciding what to file.
Follow the instructions in genuine IRS correspondence and the IRS identity-theft guide. Most people do not need Form 14039, Identity Theft Affidavit. Do not file it automatically after every breach or rejection, send duplicate affidavits, or assume every rejected return must be filed on paper.
For broader identity theft, IdentityTheft.gov provides recovery steps based on the information misused. Contact affected financial institutions promptly through known channels, secure compromised accounts, and keep records of the notices and actions taken. Continue meeting your tax filing and payment responsibilities while the issue is being resolved.