Tax Identity Theft: When to File IRS Form 14039

The most common mistake people make about tax identity theft is filing IRS Form 14039, the Identity Theft Affidavit, when they do not need to. The IRS's own guidance is direct on this point: in most cases of tax-related identity theft, there is no need to file the affidavit at all, because the IRS's own systems typically flag a suspicious return and contact you first. Knowing when the form is actually the right move, and when following an IRS letter instead is the correct step, saves real time during an already stressful process.

This page covers exactly when the IRS says to file Form 14039, when not to, how to file it if you need to, and the Identity Protection PIN program, which is open to any taxpayer as a preventive step, not only confirmed victims. For the broader identity theft recovery process, see our identity theft laws hub and our guide to reporting identity theft.

The Most Important Fact First: Most Cases Do Not Need Form 14039

The IRS's own published guidance corrects a widespread assumption directly: "In most cases of tax-related identity theft cases, there is no need to file the Form 14039 affidavit." The reason is structural, not a matter of luck. The IRS's fraud-detection systems typically catch a suspicious return, such as a second return filed under your Social Security number, before you would even know to report it, and the IRS reaches out to you with a specific letter when that happens. Filing the affidavit as a default precaution, without one of the specific triggers described below, is unnecessary and can slow down processing rather than speed it up.

When the IRS Says You Should File Form 14039

The IRS publishes a specific list of situations where filing Form 14039 is the right move, and that list is broader than most summaries of it suggest. Start with the two filing failures: you should file the affidavit if you cannot e-file your tax return because the IRS's system rejects it as a duplicate return filed using your Social Security number, or because a dependent's Social Security number or ITIN was already used on someone else's return without your knowledge or permission.

The list also covers two warnings that arrive before any IRS notice does. One is receiving a tax transcript in the mail that you never requested. The other involves your tax software: file the affidavit if a tax preparation software company notifies you that an online account was created in your name when you did not create one, or that your existing online account was accessed or disabled when you took no action. This second trigger is easy to miss, because the message comes from a private company rather than the IRS, but the IRS lists it alongside the rest.

Three further triggers involve notices from the IRS itself. File Form 14039 if you receive an IRS notice saying you owe additional tax, that your refund was offset to a balance due, or that collection action has been taken against you for a year in which you earned no income and filed no return. The same applies to a notice indicating that you received wages or other income from an employer you never worked for, and to being assigned an Employer Identification Number you did not request or apply for.

These signs overlap with the ones on our identity theft laws hub, which lists the FTC's general identity theft warning signs, since tax-related fraud is one specific category within the broader picture: "The IRS notifies you that more than one tax return was filed in your name, or that you have income from an employer you don't work for."

If You Got an IRS Letter Instead, Follow the Letter

If the IRS has already contacted you directly with Letter 5071C (verify your identity online), Letter 4883C (call the IRS to verify your identity), or Letter 5747C (verify your identity in person at a Taxpayer Assistance Center), the IRS is explicit: "If the taxpayer receives any of these letters, there is no need to file a Form 14039. Instead, they should follow the instructions in the letter." These letters mean the IRS's own systems already caught the suspicious activity and are asking you to confirm your identity directly. Filing Form 14039 on top of responding to the letter is redundant and does not speed up your case.

How to File Form 14039

If your situation matches one of the triggers above and you have not received one of the identity-verification letters, there are four routes for submitting Form 14039. Online filing at IRS.gov's dedicated Form 14039 portal is the method the form's own instructions label the preferred one, and it requires no attachments.

You can also fax the form toll-free to 855-807-5720, always including a cover sheet marked “Confidential”, or mail it to the Department of the Treasury, Internal Revenue Service, Fresno, CA 93888-0025. The fourth route runs through the Federal Trade Commission: you can complete the form online at the FTC, and the FTC will electronically transfer the Form 14039, though not your tax return, to the IRS.

Two practical notes. The IRS asks you to pick one method rather than sending the same affidavit through several, and if you are responding to an IRS notice or letter that supplies its own fax number or address, send the form there instead of to the general fax and mailing address above. Keep a copy of whatever you submit and note the date, since tax identity theft cases can take time to resolve and you will likely need to reference your filing again.

The IP PIN Program: Prevention Open to Everyone

An Identity Protection PIN, or IP PIN, is a six-digit number that prevents someone else from filing a tax return using your Social Security number or Individual Taxpayer Identification Number. The IRS states that "anyone who has an SSN or individual taxpayer identification number (ITIN) and is able to verify his/her identity is eligible to enroll." This is a meaningful shift from the program's original scope: it is no longer limited to confirmed identity theft victims. The IRS frames it as a genuinely optional precaution: "you may get an IP PIN as a proactive step to protect yourself from tax-related identity theft, even if you are not required to file."

An IP PIN is valid for one calendar year only. The IRS generates a new one each year, and it is generally viewable in your online IRS account from mid-January through mid-November. There is no requirement to have already been a victim, no requirement to have filed a police report, and no requirement to have filed Form 14039 to get one.

Getting an IP PIN

The fastest way to get an IP PIN is through your IRS online account. If you cannot verify your identity that way, the IRS also offers Form 15227, an income-based alternative available to taxpayers under a specific adjusted gross income threshold that the IRS periodically adjusts, so confirm the current figure directly on IRS.gov rather than relying on a number that may be out of date. In-person verification at a Taxpayer Assistance Center is also available if neither online option works for you.

If You Suspect Tax Identity Theft Right Now

If you are currently dealing with a rejected e-filed return, an unexpected IRS notice, or any of the specific triggers described above, file Form 14039 through one of the four routes listed, and consider enrolling in the IP PIN program once your case is resolved to prevent a repeat. If the tax fraud is part of a broader pattern, new accounts opened in your name, unfamiliar charges, or a data breach notice from a company you do business with, our identity theft laws hub and our guide to reporting identity theft cover the full recovery process, including the free FTC Identity Theft Report that most non-tax remedies are built around.

Information last verified on 2026-08-13, drawn directly from the IRS's "When to File an Identity Theft Affidavit" guidance, the "Get an Identity Protection PIN" page, and the submission instructions printed on Form 14039 itself. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.

Frequently Asked Questions

Do I need to file IRS Form 14039 if I am worried about tax identity theft?

Usually not. The IRS states that in most cases of tax-related identity theft, there is no need to file Form 14039, because the IRS's own systems typically catch a suspicious return first and contact you directly with a specific letter.

When should I actually file Form 14039?

File it if your e-filed return is rejected as a duplicate, if a dependent's Social Security number or ITIN was already used on someone else's return, if you receive a tax transcript you did not request, if a tax preparation software company tells you an account was created or accessed in your name without your action, if you get an IRS notice about tax owed, a refund offset, or collection action for a year you did not file, if you get a notice about wages from an employer you never worked for, or if you are assigned an Employer Identification Number you never applied for.

I received IRS Letter 5071C, 4883C, or 5747C. Should I also file Form 14039?

No. The IRS says that if you receive any of these letters, there is no need to file Form 14039. Follow the instructions in the letter itself, since the IRS already flagged the return and is asking you to verify your identity directly.

How do I file Form 14039?

There are four routes. Online through the IRS's dedicated portal is the method the form's instructions label preferred, and it needs no attachments. You can also fax it toll-free to 855-807-5720 with a cover sheet marked “Confidential”, mail it to the Department of the Treasury, Internal Revenue Service, Fresno, CA 93888-0025, or complete the form online at the Federal Trade Commission, which will electronically transfer it to the IRS. Choose one method rather than sending it several ways.

What is an IP PIN and who can get one?

An Identity Protection PIN is a six-digit number that prevents someone else from filing a tax return using your Social Security number or ITIN. It is now open to any taxpayer who can verify their identity, not only confirmed identity theft victims, and getting one is entirely voluntary.

How long does an IP PIN last?

An IP PIN is valid for one calendar year only. The IRS generates a new one each year, generally viewable in your IRS online account from mid-January through mid-November.

Do I need a police report to get an IP PIN or file Form 14039?

No. Neither requires a police report. The IP PIN program in particular is designed as a proactive, voluntary step available to any taxpayer who can verify their identity, whether or not they have ever been a victim.