Personal Finance & Estate › Fraud, scams & protecting family › Financial scams & fraud (incl. affinity & Ponzi schemes)
Identity theft & the IRS IP PIN
· Concept or strategy
Watch outA common mistake, trap or scam.
Someone uses your Social Security number or other personal data to open credit, file a tax return, claim benefits or get care.
See it on the Personal Finance & Estate map →How it works
Huge breaches mean most Social Security numbers are likely already exposed, so the defense is locking doors rather than hiding keys. Common forms: new cards or loans, account takeovers, fake tax returns that grab refunds, and use of a deceased relative's identity. The IRS Identity Protection PIN, a six-digit code that changes yearly, stops anyone else from filing a return under your number; any taxpayer who can verify identity can get one online. Report at IdentityTheft.gov, which builds a recovery plan.
Why it matters for you
Cleanup can take months or years; a fake tax return, for example, can hold up a real refund for well over a year while the IRS sorts it out.
Think of it like
An IP PIN is like a lock code the IRS changes every January: without this year's code, nobody can file in your name.
Red flags and protection
The FTC received about 1.1 million identity-theft reports in 2024; the IRS opened IP PINs to all taxpayers in 2021; the National Taxpayer Advocate reports on long case delays.
Watch out for
The harm from any single breach is hard to trace, and the verification tools used by the IRS and the credit bureaus keep changing as thieves adapt.
Inside this (1)
Connections (4)
▸Identity theft & the IRS IP PIN feeds Financial scams & fraud (incl. affinity & Ponzi schemes)Watch out
How they connect
Stolen identities are raw material for many scams. Data from breaches, phishing or a lost wallet let criminals open credit, take over accounts and file fake tax returns, and make impostor calls more convincing because the caller already knows an address or the last four digits of a Social Security number.
When it applies
Ongoing; giant breaches such as Equifax's in 2017, which exposed data on about 147 million Americans, keep feeding fraud for years afterward.
How sure?
FTC reports track identity theft alongside fraud; prosecutions often show breach data sold on criminal marketplaces and reused in scams.
Watch out for
Linking a specific fraud to a specific breach is usually impossible, so the full downstream cost of breaches is unknown.
▸Credit freeze (free at all three bureaus) is a strong defense against Identity theft & the IRS IP PINStandard practice
How they connect
Most new-account fraud needs a lender to pull a credit report. A freeze blocks that pull, so applications in your name are declined. It does nothing for existing cards, tax returns or Medicare numbers, so it pairs with an IRS IP PIN and regular statement reviews.
When it applies
At Equifax, Experian and TransUnion, online or by phone; free nationwide since September 21, 2018, after the 2017 Equifax breach pushed Congress to act.
How sure?
The FTC and CFPB recommend freezes as the strongest tool against new-account fraud; the 2018 law requires bureaus to place a freeze within one business day.
Watch out for
No public data show exactly how much fraud freezes prevent, or how much thieves simply shift to account takeovers and tax fraud that a freeze cannot stop.
▸Federal Trade Commission (FTC) takes reports of Identity theft & the IRS IP PINLaw or rule (2026)
How they connect
The FTC is the national clearinghouse for identity theft. A report at IdentityTheft.gov creates an official FTC report and a step-by-step recovery plan, and the data go to law enforcement through Consumer Sentinel. Victims use the report to dispute fraudulent debts and get extended fraud alerts.
When it applies
Since the Identity Theft and Assumption Deterrence Act of 1998 made the FTC the central collection point; IdentityTheft.gov added personal recovery plans in 2016.
The rule
Consumer Sentinel publishes yearly data, about 1.1 million identity-theft reports in 2024; the Fair Credit Reporting Act gives these reports weight with the bureaus.
Watch out for
The FTC does not investigate individual cases, and how often reports lead to prosecutions is unclear.
▸Identity theft & the IRS IP PIN is reported to and blocked by Internal Revenue Service (IRS)Law or rule (2026)
How they connect
Tax identity theft runs through the IRS: a thief files a fake return early to claim a refund. Victims file Form 14039 or answer an IRS letter, and an Identity Protection PIN, a six-digit code issued yearly, blocks anyone else from filing under that number.
When it applies
Each filing season; the IRS began issuing IP PINs to confirmed victims in 2011 and opened them in 2021 to all taxpayers who can verify identity.
The rule
IRS data and National Taxpayer Advocate reports document cases and long delays; the IRS rejects e-filed returns without the correct IP PIN.
Watch out for
How many fraudulent returns slip past IRS filters each year is unknown, and victim case resolution has often taken well over a year.