Tax identity theft happens when a criminal uses your Social Security number, National Insurance number or tax account to file a false return, claim your refund or pose as the tax authority to take your money. It comes in two forms: fraudulent filings made in your name, and impersonation scams by email, text, phone and social media that pretend to be the IRS or HMRC. This guide explains how both work, the official signs to look for, the US Identity Protection PIN (IP PIN), and exactly where to report in the US and the UK. It is written in plain English for the public, with enough detail for fraud, help desk and payroll teams who field these questions every filing season.
Key takeaways
- Tax authorities write first. The IRS says it normally contacts you the first time by letter through the US Postal Service, and social media direct messages are never from the IRS; HMRC never offers a tax rebate through social media.
- A rejected e-filed return is the classic warning sign. If the IRS rejects your return because one was already filed with your number, someone may have filed in your name first.
- The IP PIN is the strongest single protection in the US. It is a six-digit number, valid for one calendar year, that must be on any federal return filed with your SSN or ITIN, so a thief without it cannot e-file as you.
- Credit monitoring will not catch it. The FTC notes that credit and most identity monitoring services usually will not alert you when someone files a tax return using your Social Security number.
- Report through the official channels only. Forward IRS-themed messages to [email protected]; forward HMRC scam texts to 60599 and emails to [email protected]; report money lost in the UK to Report Fraud.
What it is
Tax fraud aimed at individuals falls into three overlapping groups. Knowing which one you face decides what you do next.
| Type | What the criminal does | What you usually notice | First action |
|---|---|---|---|
| Fraudulent filing (tax identity theft) | Files a federal return with your SSN or ITIN, often with invented wages and withholding, to collect a refund | Your e-filed return is rejected, or you get an IRS letter about a return you did not file | Follow the letter's instructions, use the IRS verification service if directed, get an IP PIN |
| Employment or benefits misuse | Uses your number to work or to claim unemployment benefits | A Form W-2 or 1099 from an employer you never worked for, a Form 1099-G for benefits you never claimed, or a CP2000 unreported income notice | Report to the IRS and your state; start a recovery plan at IdentityTheft.gov |
| Impersonation scam | Pretends to be the IRS or HMRC by email, text, phone, QR code or social media to take money or personal details | An unexpected message offering a refund or threatening arrest, a lawsuit or immediate payment | Do not reply or click; report it; if you paid or shared details, contact your bank |
| Preparer and promoter fraud | A "ghost" preparer or social media promoter files false claims for fees or a share of the refund | A preparer who will not sign the return, wants the refund paid into their account, or promises credits you have never heard of | Stop using them; file a preparer misconduct complaint; check the return filed in your name |
The IRS lists these warning signs of tax-related identity theft: a rejected return; a W-2 or 1099 from an employer you did not work for; a 1099-G for unemployment you did not receive; an employer identification number (EIN) you did not apply for; an unreported income notice; unexpected account, password reset or login alerts; a data breach that exposed your details; and Social Security statements showing wages you did not earn.
How it works
Fraudulent filings
The criminal needs your name, date of birth and tax number, which often come from data breaches, phishing or stolen documents. They file early, before you do, so their return is processed first and yours is rejected as a duplicate. Fake withholding on forged or invented forms inflates the refund. The IRS 2026 Dirty Dozen list includes "overstated withholding" schemes of exactly this kind, and notes the IRS may delay processing to verify them. Criminals also use stolen details to open or take over an IRS Online Account, or pose as "helpers" during account setup, which the IRS also lists for 2026.
Impersonation scams
Impersonation scams copy the tone, logo and timing of the real authority. The IRS 2026 Dirty Dozen (IR-2026-30, 5 March 2026) names email and text impersonation, sometimes using QR codes that lead to fake IRS sites, and AI-enabled phone impersonation with robocalls, voice mimicry and spoofed caller ID. It reported more than 600 social media impersonators in fiscal year 2025. HMRC's published examples cover the UK equivalents.
| Channel | Common US script (IRS) | Common UK script (HMRC) | What the real authority says |
|---|---|---|---|
| Refund waiting, verify your account, QR code to "secure" your details | Tax rebate email with a link to a fake HMRC page | IRS sends email only if you opted in; HMRC rebate emails come only from addresses ending hmrc.gov.uk, though spoofed addresses can look genuine | |
| Text (smishing) | Link to claim a refund or update details | Link asking for personal details, sometimes promising a refund; fake Customs Duty demands for a parcel | HMRC texts may link to GOV.UK guidance or webchat; IRS texts only if you opted in |
| Phone (vishing) | Pay now or face arrest or deportation; spoofed caller ID; cloned voices | Automated call saying HMRC is suing you and to press 1 to pay; calls about National Insurance number fraud | IRS normally writes first; HMRC calls the press-1 lawsuit message a scam: end the call |
| Social media and messaging | Direct messages offering help or refunds; viral "tax hacks" and bogus credits | Direct messages on X offering a refund; WhatsApp messages | IRS: social media DMs are never from the IRS. HMRC: no rebates via social media; WhatsApp only for one-way UK government channel alerts |
| Third parties | Ghost preparers, offer in compromise "mills" promising pennies on the dollar | Refund companies, unconnected to HMRC, that charge a fee to claim refunds | You can deal with both authorities directly without paying an intermediary |
See the Vishing and Smishing Guide and the QR Code Phishing (Quishing) Guide for the general techniques these scams reuse.
Why it matters
- Your refund is delayed: a genuine return filed after a fraudulent one is rejected or held while the IRS verifies who you are, and paper filing for a disputed dependent takes 6 to 8 weeks to process, per the IRS.
- The damage spreads: details used for tax fraud are often reused for credit, benefits or employment fraud, so treat it as identity theft, not a one-off. See the Identity Theft Recovery Guide.
- You remain responsible: the IRS warns that you are legally responsible for what is on your return even if a ghost preparer filed it.
- Tax professionals are a target too: the 2026 list includes spear-phishing and malware aimed at preparers through "new client" or "document request" emails, which puts many clients' data at risk at once.
- Organisations get pulled in: payroll and HR teams receive requests for W-2 data, fake bank detail changes and calls from "the tax office". See the Impersonation Scams Guide.
Protecting yourself in the US: the IP PIN
The IRS describes the IP PIN as a six-digit number that prevents someone else from filing a tax return using your SSN or ITIN. Facts as published by the IRS (page reviewed 2 November 2026):
| Item | Detail |
|---|---|
| Who can get one | Anyone with an SSN or ITIN who can verify their identity; parents and guardians can request one for dependents |
| Validity | One calendar year; a new IP PIN is generated each year |
| Fastest route | IRS app or IRS Online Account, IP PIN section of your profile, after identity verification |
| Form 15227 | For people who cannot set up an online account, with adjusted gross income on the last return below $84,000 (individual) or $168,000 (married filing jointly); the IRS calls to verify you and mails the PIN, usually in four to six weeks |
| In person | Taxpayer Assistance Center appointment with one federal or state photo ID plus one other ID; PIN usually mailed within three weeks |
| Forms it applies to | 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS, including prior-year returns filed during the year |
| Each year | Confirmed victims receive a CP01A notice with the new PIN; online opt-in users must retrieve it themselves, generally viewable mid-January to mid-November |
The IRS never asks for your IP PIN by phone, email or text. If you lose it, do not file Form 15227 again: view it online or request a reissue.
If it has happened: step by step
- Stop contact: do not send money or information to the scammer; if you clicked a link or opened an attachment, run antivirus software.
- Secure accounts: change your IRS Online Account password (or your HMRC online account sign-in) to a long, unique one, and your email password too.
- Answer real IRS letters: verify the letter on IRS.gov, then follow its instructions; if it directs you to the Identity and Tax Return Verification Service, use that service. To confirm a letter call 800-829-1040; for identity verification 800-908-4490.
- File Form 14039 only when needed: the IRS says most people do not need it. Do not file it if the IRS has already sent you a letter, you used the verification service, or you reported via IdentityTheft.gov. File it if the IRS asks, if you cannot use the verification service, or to report tax identity theft the IRS does not know about, for example after a data breach. Businesses use Form 14039-B.
- Get an IP PIN and keep filing and paying as normal; a copy of the fraudulent return can be requested with Form 4506-F.
- Report wider identity theft at IdentityTheft.gov for a personal recovery plan, consider free credit freezes at Equifax, Experian and TransUnion, and check with your state tax agency.
- Keep records of every letter, call and email, with dates and reference numbers.
Where to report
| What happened | US (IRS and FTC) | UK (HMRC and police) |
|---|---|---|
| Scam email or message | Forward to [email protected] | Email to [email protected], then delete |
| Scam text | Forward to [email protected] | Forward to 60599 (network charges apply) or [email protected] |
| Scam phone call | Hang up; report via the IRS fake email and message page | HMRC suspicious phone call form with date, number and what was said |
| Fake social media account | Do not engage; IRS DMs are never genuine | [email protected] |
| Return filed in your name | IRS letter instructions, Form 14039 if appropriate, IRS.gov/idtheft | Contact HMRC through your official account or GOV.UK contact routes |
| Fraud or scam promoters, bad preparers | IRS.gov/SubmitATip; preparer misconduct complaint | Report to HMRC |
| Money lost | Your bank; IdentityTheft.gov | Your bank, then Report Fraud at reportfraud.police.uk |
Common misconceptions
- "The IRS will text me if there is a problem." The IRS says first contact is normally by post, and email and text are used only if you have opted in. An unexpected text about a refund is a red flag.
- "A message from an hmrc.gov.uk address must be real." HMRC itself warns that spoofed addresses and display names can look genuine. Go to GOV.UK directly instead of clicking.
- "I do not earn enough to be a target." Thieves file fake returns with invented income; what they need is a valid number, and children's and dependents' numbers are misused too. Parents can request IP PINs for dependents.
- "Credit monitoring protects me." The FTC says it usually will not alert you to a fraudulent tax return. The IP PIN is the targeted control.
- "A refund company is just helping me." HMRC notes refund companies are not connected to HMRC and charge a fee for something you can claim yourself. In the US, a preparer who will not sign the return, has no PTIN on it, or wants your refund paid into their own account is a ghost preparer warning sign.
- "Paying now will make it go away." Pressure to pay immediately, threats of arrest or deportation, and refusal to let you question the amount are IRS-listed signs of a scam. Real IRS payments go to the "United States Treasury".
Related concepts
- Identity theft recovery: the wider process of credit freezes, police reports and account clean-up. See the Identity Theft Recovery Guide and the Credit Freezes and Fraud Alerts Guide.
- Synthetic identities: invented identities built partly on real numbers, also used in benefit and refund fraud. See the Synthetic Identity Fraud Guide.
- Phishing recognition: the same habits that catch tax phishing catch other phishing. See the How to Spot a Phishing Email Guide.
- Account takeover: takeover of tax portal accounts follows the same patterns as other online accounts. See the Account Takeover Prevention Guide.
- For organisations: counting reports, payroll change requests verified by call-back, and staff awareness at filing season start (January in the US; the 31 January Self Assessment deadline in the UK) are practical measures. See the Identity Fraud Statistics page for wider data.
Practitioner checklist
- Get an IP PIN for yourself and dependents each year through the IRS app or Online Account, or Form 15227 if eligible.
- File early in the season so a fraudulent return is less likely to land first.
- Create your IRS Online Account directly at IRS.gov, never through a link or a "helper".
- Treat any unexpected tax refund, lawsuit or arrest message as a scam until verified through the official website or the number on a genuine letter.
- Report every scam message: [email protected] in the US; 60599 or [email protected] in the UK.
- Check any preparer has a PTIN and signs the return; never let a refund go to their account.
- Payroll teams: verify W-2 data and bank detail change requests by calling a known number before acting.
- Keep a written log of every letter, call and reference number if you become a victim.
Standards and references
- IRS: Get an identity protection PIN (IP PIN)
- IRS: Identity theft guide for individuals
- IRS: Dirty Dozen tax scams for 2026 (IR-2026-30)
- IRS: How to know it's really the IRS calling or knocking on your door
- IRS: Recognize tax scams and fraud
- HMRC: Phishing emails and bogus contact, examples
- FTC: What to know about identity theft
- IRS: Choosing a tax professional
Related NHI Mgmt Group resources: Identity Theft Recovery Guide · Impersonation Scams Guide · Vishing and Smishing Guide · Credit Freezes and Fraud Alerts Guide