IRS Identity Theft Affidavit Form 14039: Filing Steps and IP PIN

IRS Form 14039, the Identity Theft Affidavit, is the form you file to tell the IRS that someone has used your Social Security number or Individual Taxpayer Identification Number for tax fraud. Most people discover the problem when their own e-filed return is rejected because a return under their SSN is already on file. The IRS now prefers you submit the form online, though mail and fax remain available. Expect a long wait: at the close of fiscal year 2024, identity theft cases were taking the IRS an average of 22 months to resolve.¹

When Form 14039 Is the Right Form

File Form 14039 only for tax-related identity theft — situations where someone has used your personal information to interfere with your federal tax account. The common triggers:

Your electronically filed return is rejected because a return using your SSN or ITIN was already filed for that year.
You receive an IRS letter about a return or balance due that isn’t yours.
The IRS sends a notice claiming you earned wages from an employer you’ve never worked for.
You receive a Letter 5071C asking you to verify your identity before the IRS will process a return you never filed.

Some situations do not call for this form. If you’ve already submitted Form 14039 for the same incident, don’t send a second one; duplicates slow processing. If a parent or guardian used a dependent’s information on a tax filing, the IRS does not treat that as identity theft here.² And if the identity theft isn’t tax-related — a credit card opened in your name, say, with no touch to your taxes — report it at IdentityTheft.gov instead. Businesses use a different form, covered below.

What to Gather Before You Start

Form 14039 has five required sections, A through E. Have the following ready:

Your full legal name, current mailing address, phone number, and SSN or ITIN.²
The reason you’re filing. Section A asks whether you’re acting on your own or responding to an IRS notice. If a notice prompted this, keep it in front of you.
The type of fraud. Section B asks whether someone filed a fraudulent return, reported false wages under your SSN, or both.
The tax year or years involved.
Copies of any IRS notices that reference the suspicious filing or income you don’t recognize.

Filing on someone else’s behalf goes in Section F. A surviving spouse filing for a deceased victim does not need to attach a death certificate. A personal representative must attach a copy of the court appointment, and anyone with power of attorney must include that documentation.²

Keep a copy of everything you send. You’ll want it if the IRS requests follow-up information, and it’s your record if anything is lost.

Three Ways to Submit

The IRS accepts Form 14039 online, by mail, or by fax. Pick one. Submitting through more than one channel creates duplicate cases and delays.²

Online

The IRS lists online submission as its preferred method. You can complete and submit the form at irs.gov/dmaf/form/f14039. One limitation: the online portal does not accept attachments. If your situation requires supporting documents, such as copies of IRS notices or a court appointment letter, use mail or fax.²

Mail

Where you mail the form depends on your situation. If you’re responding to an IRS notice, send the form to the address printed on the notice, along with a copy of that correspondence. If your SSN was misused and you can’t e-file, attach Form 14039 to the back of your paper return and mail everything to the IRS filing address you’d normally use. Otherwise, mail the form to Department of the Treasury, Internal Revenue Service, Fresno, CA 93725.²

Fax

If you’re responding to an IRS notice with a fax number on it, use that number. Otherwise, the general fax line for Form 14039 is 855-807-5720. Include a cover sheet marked “Confidential.”²

If Your E-Filed Return Was Rejected

When a thief has already filed under your SSN, the IRS system rejects your legitimate e-filed return as a duplicate. The rejection code you’ll usually see is IND-181-01, which indicates the IRS is expecting an Identity Protection PIN you don’t yet have.³

Paper-file instead. Print your return, attach Form 14039 to the back, and mail the package to the IRS address where you’d normally file.² That one submission handles both the identity theft report and your tax filing. Paper filing is slower than e-filing at the best of times, and identity theft processing stacks additional months on top, but it puts your legitimate return in the system.

What Happens After You Submit

The IRS Identity Theft Victim Assistance (IDTVA) organization handles the case. It compares the fraudulent return against your legitimate filing history and income records, and may send follow-up letters asking for additional verification. Respond quickly; delays on your end add to already long processing times. If you filed a legitimate return and the IRS confirms it’s yours, your refund may be released while the broader identity theft case remains open.⁴

As of the end of fiscal year 2024, the average time to fully resolve an identity theft case was 676 days, more than 22 months.¹ That figure has been climbing, not shrinking. Plan accordingly.

Once the case is fully resolved, the IRS places an identity theft indicator on your account to flag suspicious activity going forward and enrolls you in the Identity Protection PIN program.⁴

Your Identity Protection PIN

After resolving your case, the IRS assigns you a six-digit Identity Protection PIN (IP PIN). This number blocks anyone else from e-filing a return under your SSN. You must include the current IP PIN on every future federal return; without it, your e-filed return will be rejected.⁵ Each January the IRS mails confirmed identity theft victims a CP01A notice with the new PIN.⁶

A new IP PIN is generated annually, so watch for that notice before filing season. If you lose it or don’t receive it, retrieve the current one through your IRS online account.

You don’t have to be a theft victim to get an IP PIN. Any taxpayer with an SSN or ITIN can enroll voluntarily through their IRS online account. Once you’ve been through this once, enrolling a spouse and dependents is worth the few minutes it takes.⁶

When to Escalate to the Taxpayer Advocate Service

If the delay is causing real financial hardship — you can’t pay rent, utilities are being shut off, medical bills are piling up — the Taxpayer Advocate Service (TAS) may be able to move your case along. TAS is an independent organization within the IRS for taxpayers stuck in situations the normal channels aren’t resolving.⁷

You request TAS help by submitting Form 911 (Request for Taxpayer Advocate Service Assistance). You generally need to show you’ve already tried the normal IRS channels and that the delay is causing economic harm. TAS can also intervene when the IRS has gone more than 30 days past its normal processing timeline without resolution, or when you keep getting “we need more time” letters without progress.⁸ Given the current 22-month average, many identity theft victims will meet that threshold.

If a Business EIN Was Used Instead

Form 14039 is for individuals. If someone used your business’s Employer Identification Number, the right form is Form 14039-B, the Business Identity Theft Affidavit. It covers businesses, trusts, estates, and tax-exempt organizations. Signs an EIN has been compromised include a rejected business return because one is already on file, an IRS notice about a return you didn’t file or a balance you don’t owe, a Social Security Administration inquiry about W-2s you never issued, or a notice for a business under an EIN you never applied for. Do not file 14039-B for a data breach alone; there must be evidence of actual fraudulent returns or W-2s.⁹

Steps to Take Outside the IRS

Someone with enough of your information to file a fraudulent return usually has enough to do other damage. Work these steps in parallel with the IRS process.

Place a fraud alert by contacting one of the three major credit bureaus (Equifax, Experian, or TransUnion); that bureau must notify the other two.¹⁰ A credit freeze is stronger — it blocks new creditors from accessing your file entirely — but you must contact all three bureaus separately. Freezes are free under federal law, and the bureaus must place them within one business day of an online or phone request. You can lift a freeze temporarily when you need to apply for credit, then relift it.¹¹

File a report at IdentityTheft.gov, the FTC’s central portal for identity theft victims.¹² The site generates a personalized recovery plan and an Identity Theft Report you can use when disputing fraudulent accounts with creditors. A police report is also worth filing if the theft goes beyond taxes; some creditors and insurers require one before they’ll process a dispute.

Checking on Your Case

To verify your identity or check the status of an identity theft case, call the IRS at 800-908-4490. This line is dedicated to identity theft inquiries and cannot answer general refund status or other tax questions.¹³ For general account questions, use the standard IRS number, 800-829-1040.

1
Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds
2
Internal Revenue Service. Form 14039 – Identity Theft Affidavit
3
TaxSlayer Support. Why Am I Being Asked for an IP PIN Reject Code IND-181-01
4
Internal Revenue Service. How IRS ID Theft Victim Assistance Works
5
Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number
6
Internal Revenue Service. Get an Identity Protection PIN
7
Taxpayer Advocate Service. Identity Theft
8
Taxpayer Advocate Service. Submit a Request for Assistance
9
Internal Revenue Service. Report Identity Theft for a Business
10
Federal Trade Commission. Credit Freezes and Fraud Alerts
11
Consumer Financial Protection Bureau. Free Credit Freezes Are Here
12
Federal Trade Commission. Report Identity Theft
13
Internal Revenue Service. Identity Theft Guide for Individuals