How To Keep Your Tax Refund Safe From Fraudsters

Tax refund theft happens when someone files a return using your Social Security number and collects the refund before you do. Most victims find out one of 2 ways: their own e-filed return bounces back because a return is already on file, or an IRS letter arrives about a return they never sent. The scale is large and current. A Treasury Inspector General for Tax Administration report released in May 2026 found the IRS stopped roughly $7 billion in fraudulent refunds across 2024 and 2025, and pulled about 7.5 million individual returns into its identity theft filters over the same period.

What this guide covers:

• Prevention that works – filing early, an Identity Protection PIN, and locking down the accounts that hold your tax data
• The 2 IRS letters that matter – a CP5071 series notice or letter 5447C means your return is on hold pending identity verification
• When Form 14039 is required, and when filing it slows you down – the IRS tells most people not to send it
• The Michigan steps – the state runs a separate process with its own document checklist and mailing addresses
• Realistic timelines – IRS identity theft victim cases averaged 506 days to resolve in fiscal 2025 and 676 days in fiscal 2024, far longer than the 120 to 180 days most guides quote

If a fraudulent return has already been filed under your number, call the IRS identity theft line at 800-908-4490, report the theft at IdentityTheft.gov, and file your real return on paper and on time. You do not lose the refund you are owed. What you lose is time, which is why the prevention steps below are worth more than the recovery steps.

How Tax Refund Theft Works, And How Common It Is Now

A thief needs 3 things to file in your name: your Social Security number, a name and date of birth that match it, and enough income detail to produce a return the IRS will accept. Data breaches supply the first 2 routinely. The income figures can be invented, because the IRS often receives wage and retirement statements after refunds start going out, which leaves a window where a fabricated return cannot be checked against employer records.

The IRS screens returns through identity theft filters before releasing refunds. Those filters are catching more, and they also catch a lot of honest filers. The same 2026 oversight report found about 2.4 million legitimate returns were pulled into the filters in calendar year 2024, and that false selections ran at 52% of all selections in processing year 2024, down from 55% the year before. Roughly 955,000 selections across 2024 and 2025 were cleared without ever contacting the taxpayer.

2 practical conclusions follow. A held refund is not proof that someone stole your identity, since about half of flagged returns belong to the person who filed them. And a real theft is usually discovered by the taxpayer, not announced by the IRS, so knowing the warning signs shortens the delay.

Warning Signs Your Tax Refund May Be At Risk

• Your e-filed return is rejected because a return using your Social Security number is already on file
• You receive a CP5071 series notice or letter 5447C asking you to verify a return you do not recognize
• An IRS notice arrives about a tax year you did not file, or a balance owed for a year you did not work
• A tax transcript you never requested shows up in your mail
• IRS records show wages from an employer you have never worked for
• You get an alert that an IRS online account was created or accessed, and it was not you
• A Form 1099-G arrives for unemployment benefits you never claimed

What Happens To Your Real Return

Your legitimate return is rejected as a duplicate filing, and your refund is held while the IRS decides which return is real. The account has to be corrected before anything moves, and that correction sits in the Identity Theft Victim Assistance queue. The refund itself is not forfeited. Interest and your filing rights are preserved, and the IRS issues the refund once it verifies you. The cost is the wait, plus the paperwork you have to keep current while the case is open.

How To Protect Your Refund Before You File

File As Early As You Can

Refund theft is a race. The first return filed under a Social Security number is the one the system accepts, and every later one is rejected. The IRS opens filing in late January. Gather your W-2 and 1099 forms and file as soon as they are complete and correct. Filing early only helps if the return is accurate, so do not send an estimate to beat a thief.

Get An Identity Protection PIN

An Identity Protection PIN is a 6-digit number the IRS requires on your return. Without it, an electronically filed return under your number is rejected, which shuts down the most common form of refund theft. The program is open to anyone with a Social Security number or ITIN who can verify their identity, not only to people who have already been victimized.

• Fastest route – request it in the IP PIN section of your IRS online account, which issues the number immediately
• If you cannot verify online – Form 15227 is available when adjusted gross income on your last return was below $84,000 for individuals or $168,000 for married filing jointly. The IRS calls you to verify identity, and the PIN arrives in 4 to 6 weeks
• In person – book an appointment at a Taxpayer Assistance Center with identification, and the PIN is mailed in about 3 weeks
• It expires – the PIN is valid for 1 calendar year and a new one is generated each year. Voluntary enrollees retrieve it from their online account, generally available from mid-January through mid-November. Confirmed identity theft victims receive a CP01A notice with the new number by mail

Keep the PIN where you can find it in January, and give it to your preparer only through a secure channel. Never send it by email or text.

Lock Down The Accounts That Hold Your Tax Data

Your IRS online account, your state tax account, your payroll portal and your preparer’s client portal all hold the information a thief needs. Use a unique password on each one and turn on multi-factor authentication everywhere it is offered. A password manager makes unique passwords practical. Reused passwords are the reason 1 breach at an unrelated company turns into a fraudulent tax return.

Treat Unexpected Tax Messages As Hostile

Phishing messages imitate the IRS, state treasuries, payroll providers and tax software companies, and they peak in filing season. They ask you to confirm a refund, unlock an account or open an attachment. Do not click links in these messages. Open a new browser tab and go to the agency or company site directly. Hovering over a link shows its real destination, which is usually enough to expose the fake.

Store The Paper Documents Properly

Social Security cards, birth certificates and old returns belong in a locked fireproof box or a safe deposit box, not a desk drawer and not a photo on your phone. Shred anything with a Social Security number on it before it goes in the trash, including the envelopes and worksheets left over from a completed return.

Vet Anyone Who Touches Your Return

A paid preparer must have a Preparer Tax Identification Number and must sign the return they prepare. A preparer who refuses to sign, who bases the fee on the size of your refund, or who wants your refund routed to an account you do not control is a risk to your identity and your money. Check credentials, ask how client data is stored, and confirm the refund will be deposited only to your own account.

Know How The IRS Actually Makes Contact

The IRS opens contact about a suspicious return by mail. It does not call, email or text to demand immediate payment, it does not threaten arrest, and it does not require a specific payment method such as gift cards or wire transfers. Any call that does those things is a scam. Hang up and call the IRS directly on a number from its own website.

What To Do If Someone Already Filed Using Your Social Security Number

The right first step depends on whether the IRS has written to you. Getting this order wrong is what adds months to a case.

If You Received A CP5071 Series Notice Or Letter 5447C

Use the IRS Identity and Tax Return Verification Service. Sign in to your IRS account, have the return in question in front of you, and answer the verification questions. If the return is not yours, you report that through the same service. After you verify, the IRS says to wait 2 to 3 weeks before checking your refund status, and that processing the return can take up to 9 weeks. Do not send Form 14039 in this situation unless the IRS specifically asks for it.

If Your E-File Was Rejected And No Notice Arrived

This is the case where Form 14039, the Identity Theft Affidavit, belongs. Attach it to a paper copy of your correct return and mail both together. File by the deadline and pay anything you owe on time, because a fraudulent return filed by someone else does not extend your deadline or excuse a late payment.

The IRS tells taxpayers not to file Form 14039 when it has already sent them a notice about the suspicious return, when they have already reported the theft through IdentityTheft.gov, when they are using the verification service, or when the identity theft is not tax related. Sending it anyway creates a duplicate case.

Report It Once, In The Right Place

Report the theft at IdentityTheft.gov, the Federal Trade Commission site that generates a recovery plan and an official identity theft report. For the tax side, the IRS identity theft line is 800-908-4490. Current IRS guidance does not list a police report among the required steps, though a local report can still help when a lender or credit bureau asks for documentation. The IRS resources for victims are collected at Identity Theft Central.

Freeze Your Credit, Then Watch The Accounts

Whoever filed the return has enough information to open credit in your name. A credit freeze at all 3 major bureaus blocks new account openings until you lift it, and it is free. A fraud alert is weaker: it asks creditors to verify identity before approving an application, and it does not block access. Review bank, card and investment statements for the months around the theft, and turn on transaction alerts.

Keep Filing While The Case Is Open

Victims sometimes stop filing while they wait for a resolution, which turns 1 problem into 2. File every year on time, on paper if the IRS is still rejecting your electronic returns, and keep copies of everything you send with proof of mailing. Once you are in the system as a confirmed victim, the IRS issues you an IP PIN each year, and future returns go back to normal.

The Michigan Steps Most Guides Leave Out

Fixing the federal side does not fix the state side. A thief who files a fraudulent federal return usually files a Michigan return too, and the Michigan Department of Treasury runs its own identity theft process with separate paperwork.

If you have not yet filed your Michigan return, Treasury requires a paper filing with supporting documents attached. Its published checklist asks for:

• A written statement describing what happened, or a copy of Form 14039 if you have one
• A copy of your driver’s license or other acceptable identification
• A copy of your Social Security card
• A copy of your federal return with all schedules
• Copies of your W-2 and 1099 forms
• A copy of your lease or property tax bill if you are claiming the Michigan Property Tax Credit on form MI-1040CR, or a heat bill if you are claiming the Home Heating Credit on form MI-1040CR-7

Everything goes on standard 8.5 by 11 inch paper. Returns claiming a refund or credit, or showing no balance due, go to the Michigan Department of Treasury, Lansing, MI 48956. Returns with tax owed go to Lansing, MI 48929. Treasury then places an informational stop on your account so fraudulent refunds are not issued, and it will verify your identity before processing future returns.

2 more Michigan details worth knowing. If Treasury writes to you about a return you did not file, the response has to be in writing, with a copy of their letter included. And if a Form 1099-G arrives for unemployment benefits you never received, Treasury tells identity theft victims to disregard it and leave that amount off the federal return. To obtain copies of the fraudulent return for your own records, file Form 4095 with the Treasury Disclosure Unit.

How Long Recovery Actually Takes

Most articles on this topic quote 120 to 180 days. The government’s own numbers are worse, and planning around the optimistic figure is how people get caught short.

The National Taxpayer Advocate reports that average cycle time for Identity Theft Victim Assistance cases ran 399 days in fiscal 2022, 556 days in fiscal 2023 and 676 days in fiscal 2024, with the accounts management side of that inventory averaging about 506 days in fiscal 2025 reporting. More than 447,000 aged cases were sitting in the inventory. Refund delays follow case delays, so a victim filing this year should plan for a wait measured in seasons, not weeks.

3 things shorten it in practice: responding to every IRS and Treasury letter within its deadline, keeping a single clean file of what you sent and when, and requesting help from the Taxpayer Advocate Service when the delay causes financial hardship such as an eviction notice or an unpayable bill.

When To Bring In A Tax Attorney

Straightforward refund theft with no balance owed is something many people resolve on their own with an IP PIN, a paper return and patience. Representation earns its place when the theft has knocked other things loose: a balance the IRS says you owe on income you never earned, collection notices or a wage garnishment tied to the fraudulent return, years the thief filed that you now have to unwind, or a state and federal case that have drifted out of sync.

A Michigan state tax attorney can file a power of attorney, deal with the IRS and Treasury directly, hold both agencies to their own procedures and deadlines, and keep collection activity from moving while the identity theft case is open. Getting the account back into full compliance matters too, because an open identity theft case does not pause the years you still owe. Austin & Larson Tax Resolution works IRS and State of Michigan cases from offices in Brighton, Saginaw, Lansing and Jackson, and you can talk to a tax attorney about where your case stands.

FAQs

How long does it take to recover a stolen tax refund?

Longer than most guides say. Identity Theft Victim Assistance cases at the IRS averaged 676 days in fiscal 2024, and the accounts management side of that inventory averaged about 506 days in fiscal 2025 reporting from the National Taxpayer Advocate. Simple cases close faster, but plan for a year or more. You do not lose the refund you are entitled to; the IRS releases it once your identity and your return are verified.

Do I have to file Form 14039?

Only in specific situations, and most victims should not send one. File it when your e-filed return was rejected as a duplicate and the IRS has not contacted you, or when the IRS asks you to. Do not file it if the IRS already sent you a notice about the return, if you already reported through IdentityTheft.gov, if you are using the Identity and Tax Return Verification Service, or if the theft was not tax related.

Can I still protect myself if my Social Security number was exposed in a data breach?

Yes. An exposed number cannot be recalled, but an Identity Protection PIN makes it far harder to use, because a return filed without the PIN is rejected. Combine it with filing early, a credit freeze at all 3 bureaus and regular review of your IRS online account and wage records.

Will the IRS call me about refund fraud?

No. The IRS opens contact about a suspicious return by mail. It does not demand immediate payment over the phone, threaten arrest, or insist on gift cards or wire transfers. Treat any call like that as a scam, hang up, and call the IRS on a number published on its own site.

What is the difference between a fraud alert and a credit freeze?

A credit freeze blocks access to your credit file so new accounts cannot be opened until you lift it. A fraud alert only asks creditors to verify your identity first, and it leaves the file accessible. For someone whose Social Security number has already been used to file a return, the freeze is the stronger protection.

Does a stolen refund affect my Michigan return too?

Usually, yes. The same stolen information is typically used to file a state return, and the Michigan Department of Treasury handles its own cases separately from the IRS. Michigan victims file a paper state return with identification, a copy of the federal return and an explanation of the theft, after which Treasury places a stop on the account and verifies identity on future filings.