Tax refund fraud: how criminals file returns in your name, and what to do about it

You file your taxes in April. The IRS rejects your return. Someone already filed under your Social Security number and claimed your refund. The money went to a stranger's bank account six weeks ago.

Tax refund fraud is identity theft targeted at the IRS. Criminals use stolen Social Security numbers to file fake returns, claim fraudulent refunds, and disappear before the IRS catches on. You discover the fraud only when you try to file your legitimate return and the system rejects it because it's already been processed.

Here's how the mechanism works, why it succeeds, and what you do when it happens to you.

The underlying mechanism

Tax refund fraud exploits a timing gap. The IRS accepts returns starting in late January. Most employers send W-2s by January 31. Criminals file fraudulent returns in early February, before you file your legitimate return. The IRS processes the fake return, issues the refund, and only discovers the fraud months later when you file and the system flags a duplicate SSN.

The attack requires three pieces of information: your name, Social Security number, and date of birth. Criminals acquire this data from breaches, phishing attacks, or credential stuffing operations. Your SSN might have been exposed in the Equifax breach in 2017, a healthcare breach in 2020, or a payroll processor breach you've never heard of. According to Have I Been Pwned, billions of records containing personal data circulate in criminal markets. Once your SSN is out there, it stays out there.

The fraudulent return itself is simple. Criminals fabricate W-2 income from real employers, claim standard deductions, and request direct deposit to accounts they control. The IRS doesn't verify W-2s against employer records until after it issues refunds. By the time the mismatch surfaces, the money is gone.

The refund goes to a bank account or prepaid debit card opened with fake or stolen credentials. Some criminals use money mules, people who receive deposits and forward funds in exchange for a cut. Others use synthetic identities that blend real SSNs with fake names and addresses. The IRS sends the refund, the criminal withdraws it, and the account closes.

You find out when you file your legitimate return and the IRS rejects it. The system shows one return already processed under your SSN. At that point, the fraud is weeks or months old. The criminal has the money. You have a rejected return and a long recovery process ahead.

Why tax refund fraud succeeds

The IRS processes around 150 million individual returns each year. The agency verifies SSNs, checks for mathematical errors, and flags obvious fraud patterns, but it doesn't cross-check every W-2 against employer records before issuing refunds. That verification happens later, after most refunds are already out the door.

Criminals exploit this lag. They file early, before you do, and before the IRS receives employer W-2 data. The system sees a return with a valid SSN, plausible income figures, and no immediate red flags. It processes the refund. By the time the IRS matches W-2s and discovers the fabrication, the money is gone.

The fraud succeeds because the IRS prioritizes speed. Taxpayers expect refunds within 21 days. Congress pressures the agency to process returns quickly. Fraud detection slows things down. The IRS balances speed against accuracy, and criminals exploit the gap.

Direct deposit makes the fraud faster. Refunds land in bank accounts within two weeks. Paper checks take longer and create a paper trail. Criminals prefer direct deposit because it's faster and harder to reverse once the money moves.

The scale matters. Tax refund fraud isn't one criminal filing one fake return. It's organized groups filing thousands of returns using stolen SSNs bought in bulk. Some operations file returns for dead people whose SSNs remain active in IRS systems. Others target children whose SSNs have never been used for tax purposes. The IRS estimates billions of dollars in fraudulent refunds each year, though the agency doesn't publish exact figures.

What you see when it happens

The first sign is a rejected e-file. You submit your return through TurboTax, H&R Block, or your accountant's software. The system rejects it. The error message says a return was already filed under your SSN. You didn't file it. Someone else did.

Or you receive an IRS notice. Form CP01A says the agency issued a refund you didn't claim. Form CP2000 says you failed to report income you didn't earn. Form 5071C asks you to verify your identity because the IRS suspects fraud. These notices arrive months after the fraudulent return was filed.

Or your employer contacts you. The IRS sent them a notice saying you filed a return reporting income they didn't pay. The employer knows you didn't work for them that year. They're confused. So are you.

In some cases, you receive a 1099-G form from your state unemployment office. The form reports unemployment benefits you never claimed. Someone filed for unemployment using your SSN, collected the payments, and disappeared. The state reported the income to the IRS. Now you're on the hook for taxes on money you never received.

These scenarios share a pattern: someone used your SSN to interact with government systems, claimed money, and left you to deal with the consequences. The fraud surfaces when legitimate systems detect a conflict.

What to do immediately

File Form 14039, the Identity Theft Affidavit. This form tells the IRS someone filed a fraudulent return using your SSN. You can file it online through the IRS website, by mail, or by fax. Include a copy of the rejection notice if you have one. The form goes to the IRS Identity Theft Victim Assistance unit.

File your legitimate return on paper. E-filing won't work because the system already shows a return under your SSN. Print your return, sign it, attach Form 14039, and mail it to the IRS address listed in the form's instructions. Use certified mail so you have proof of delivery.

Contact the IRS Identity Protection Specialized Unit at 800-908-4490. This number connects you to agents trained in tax refund fraud cases. Expect long hold times. Have your Social Security number, previous year's tax return, and any IRS notices ready when you call. The agent will walk you through the process and confirm receipt of your Form 14039.

Place a fraud alert or credit freeze with the three credit bureaus: Equifax, Experian, and TransUnion. Tax refund fraud often coincides with other identity theft activity. Criminals who have your SSN might try to open credit accounts, apply for loans, or file for unemployment benefits in your name. A credit freeze stops new accounts from opening.

Check your Social Security earnings record at ssa.gov. Log in to your my Social Security account and review the income reported under your SSN. If you see income from employers you didn't work for, someone is using your SSN for employment fraud. Report it to the Social Security Administration's Office of Inspector General at oig.ssa.gov/report.

Report the fraud to the Federal Trade Commission at IdentityTheft.gov. This creates an official report and generates a recovery plan. The FTC doesn't investigate individual cases, but the report documents the fraud for your records and can support disputes with creditors or employers.

The IRS resolution process

The IRS assigns your case to the Identity Theft Victim Assistance unit. An agent reviews your Form 14039, verifies your identity, and compares your legitimate return to the fraudulent one. This process takes time. The IRS estimates six to nine months, but some cases stretch past a year.

The agent might contact you for additional documentation. They'll ask for copies of your driver's license, Social Security card, prior-year tax returns, and any IRS notices you received. They might ask for proof of income, like W-2s or pay stubs. Provide everything they request. Delays in documentation extend the timeline.

The IRS will issue you an Identity Protection Personal Identification Number, or IP PIN. This six-digit number changes annually and must be entered on your tax return. The IRS won't process a return under your SSN without the correct IP PIN. This stops criminals from filing fraudulent returns in future years. You receive your IP PIN by mail each January. Don't lose it. If you do, you'll need to call the IRS to retrieve it, which means more hold time.

Your legitimate refund will eventually arrive, but it won't be fast. The IRS processes fraud cases manually. Once the agent verifies your return, they forward it to the processing unit. You'll receive your refund weeks or months after that. If you were counting on that refund to pay bills, make other arrangements. The money won't arrive on schedule.

If the fraudulent return claimed a refund and you're owed a refund, the IRS will issue yours once the case closes. If the fraudulent return claimed a refund and you owe taxes, the IRS will apply your payment to your actual tax liability. If the fraudulent return fabricated income that increased your tax burden, the IRS will adjust your account once they verify the correct figures.

Preventing future fraud

File early. The earlier you file, the less time criminals have to file a fraudulent return before you do. If you file in February, you reduce the window. If you file in April, you give criminals two extra months.

Use the IP PIN if the IRS issued you one. Don't ignore it. The IP PIN is the strongest defense against repeat fraud. Without it, criminals can't file under your SSN even if they have all your personal information.

Monitor your IRS account online. Create an account at irs.gov and check it periodically. You'll see transcripts of returns filed under your SSN, refunds issued, and notices sent. If something looks wrong, you'll catch it faster than waiting for a rejection notice or an unexpected 1099.

Watch for IRS notices year-round. Criminals don't just file fraudulent returns during tax season. They file for unemployment benefits, apply for pandemic relief programs, and submit forms claiming income you didn't earn. Any IRS notice about income or refunds you don't recognize is a red flag.

Protect your Social Security number. Don't carry your Social Security card in your wallet. Don't give your SSN to anyone who doesn't legally require it. Employers, banks, and the IRS need it. Your gym, your dentist, and your utility company don't. When someone asks for your SSN, ask why they need it and whether you can use an alternative identifier.

Freeze your credit if you're not planning to apply for new credit. A credit freeze stops new accounts from opening in your name. It won't prevent tax refund fraud directly, but it limits the damage if criminals have your SSN and try to open credit accounts alongside filing fraudulent returns.

Use a password manager and enable two-factor authentication on your IRS account, Social Security account, and any financial accounts. Tax refund fraud often starts with compromised credentials. If criminals gain access to your email or online accounts, they can reset passwords, intercept IRS notices, and file returns without you knowing until it's too late.

What about children

Children are targets for tax refund fraud because their SSNs are clean. Most kids don't have credit files, tax history, or employment records. Criminals file fraudulent returns using children's SSNs, claim fake dependents, and disappear. Parents don't discover the fraud until they try to claim the child as a dependent on their own return and the IRS rejects it.

Check your child's credit file annually. Children under 18 shouldn't have credit files unless someone opened accounts in their name. Contact Equifax, Experian, and TransUnion and request a manual search for files under your child's name and SSN. If a file exists, freeze it immediately and report the fraud.

Request an IP PIN for your child if the IRS allows it. As of 2026, the IRS issues IP PINs to confirmed identity theft victims of any age. If your child's SSN was used for fraud, file Form 14039 on their behalf and request an IP PIN. You'll need to provide documentation proving you're the parent or legal guardian.

Don't give out your child's SSN unless required. Schools, doctors, and extracurricular programs sometimes ask for it. Ask why they need it and whether they can use an alternative identifier. The fewer places that have your child's SSN, the lower the risk of exposure in a breach.

The Star Trek: The Next Generation problem

In Star Trek: The Next Generation, the ship's computer voice authentication system recognizes Captain Picard's voice and grants him access to secure systems. The mechanism assumes that voice equals identity. It works until someone records Picard's voice and plays it back, or until a holographic duplicate mimics his speech patterns. The system has no way to distinguish between the real Picard and a convincing fake.

Tax refund fraud works the same way. The IRS system assumes that possession of a valid SSN equals identity. If the return contains a real SSN, plausible income figures, and no obvious errors, the system processes it. The mechanism has no built-in verification that the person filing the return is the person to whom the SSN was issued. By the time the mismatch surfaces, the refund is gone.

The IP PIN solves this by adding a second factor. Possession of the SSN alone isn't enough. You need the PIN, which changes annually and is sent only to the legitimate taxpayer. It's the equivalent of requiring Picard to enter a code that only he knows, in addition to speaking his name. The system becomes harder to fool.

What doesn't work

Monitoring services don't prevent tax refund fraud. They alert you after the fraud happens, not before. By the time you receive an alert, the fraudulent return is already filed and the refund is already issued. Monitoring services are useful for catching identity theft early, but they don't stop tax refund fraud in real time.

Credit monitoring doesn't help. Tax refund fraud doesn't involve opening credit accounts. It involves filing tax returns. Credit monitoring services won't see it. You need to monitor your IRS account and your Social Security earnings record directly.

Changing your Social Security number is nearly impossible and rarely worth it. The Social Security Administration issues new SSNs only in extreme cases of ongoing harm that can't be resolved any other way. Tax refund fraud doesn't meet that threshold. You're better off using an IP PIN and monitoring your accounts.

Paying for identity theft protection services after the fraud happens doesn't speed up the IRS resolution process. The IRS handles fraud cases internally. Third-party services can't intervene or expedite your case. They might help with credit disputes or monitoring, but they won't get your refund faster.

The long-term impact

Tax refund fraud creates a years-long paper trail. The fraudulent return stays in IRS records. You'll need to reference it when you file future returns, especially if the fraud affected multiple years. Keep copies of Form 14039, your correspondence with the IRS, and any notices you received. You'll need them if the fraud resurfaces or if the IRS reopens your case.

Some victims report ongoing issues with state tax agencies. Criminals who file fraudulent federal returns sometimes file fraudulent state returns using the same stolen SSN. You'll need to contact your state's department of revenue, file a separate identity theft affidavit, and go through a similar resolution process. State agencies don't coordinate with the IRS automatically. You have to notify them separately.

Employment fraud sometimes accompanies tax refund fraud. If someone used your SSN to file a fraudulent return, they might also have used it to get a job. Employers report wages to the Social Security Administration under your SSN. You'll see phantom income on your Social Security earnings record. This affects your future Social Security benefits calculations. Report the fraudulent income to the SSA's Office of Inspector General and request a correction.

The emotional toll is real. Tax refund fraud feels invasive. Someone used your identity to steal money from the government in your name. You're left proving you didn't commit the fraud. The process is slow, bureaucratic, and frustrating. You'll spend hours on hold, mail documents multiple times, and wait months for resolution. It's exhausting.

What the IRS is doing

The IRS has improved fraud detection in recent years, though the agency doesn't publish specifics about its methods. The agency uses algorithms to flag suspicious returns, cross-checks W-2 data earlier in the filing season, and requires additional verification for high-risk returns. The IP PIN program expanded to allow any taxpayer to opt in, not just confirmed fraud victims.

The IRS also delays some refunds for manual review. If your return triggers fraud flags, the agency might hold your refund for weeks while an agent verifies your identity. This frustrates legitimate taxpayers, but it stops some fraudulent refunds from going out. The tradeoff is slower refunds for everyone in exchange for fewer fraudulent refunds overall.

Congress has pushed the IRS to reduce fraud while also demanding faster refunds. These goals conflict. Faster refunds mean less time for verification. More verification means slower refunds. The IRS operates under both pressures, which explains why the system still has gaps.

What happens to the criminals

Some get caught. The IRS Criminal Investigation division prosecutes tax fraud cases, and the Department of Justice brings charges. Convictions result in prison time and restitution orders. But most criminals don't get caught. The refunds go to accounts that close quickly, the money moves through multiple hands, and the trail goes cold.

Money mules sometimes get caught and charged. These are people who receive fraudulent refunds in their accounts and forward the money to criminals in exchange for a cut. Many mules don't realize they're participating in fraud. They respond to job ads promising easy money, follow instructions to receive deposits and wire funds, and only learn they've committed a crime when law enforcement shows up. Some mules are victims of romance scams or job scams who thought they were helping a romantic partner or a legitimate employer.

The stolen SSNs that fuel tax refund fraud come from data breaches. Criminals buy them in bulk from underground markets. The Equifax breach exposed 147 million SSNs. Healthcare breaches expose millions more each year. Once your SSN is in a breach, it's available to anyone willing to pay. The criminals who buy stolen SSNs and file fraudulent returns are different people from the criminals who breached the databases in the first place. The supply chain is long and fragmented.

The reality of recovery

You will get your refund eventually, but it won't be fast. The IRS processes fraud cases slowly because they require manual review. If you were counting on that refund to pay rent, buy groceries, or cover an emergency expense, you'll need to find another solution. The refund will arrive, but it might take six months or longer.

You'll spend hours on the phone with the IRS. Hold times are long. Agents are helpful but overworked. You'll explain your situation multiple times to different people. Keep notes. Write down the date, time, and name of every agent you speak with. Document what they told you and what they asked you to send. You'll need this information if you have to call back.

You'll mail documents multiple times. The IRS loses things. Send everything by certified mail with return receipt requested. Keep copies of everything you send. If the IRS asks for a document you already sent, send it again. Don't argue about whether they should have it. Just send it.

Your case will close eventually. The IRS will verify your identity, process your legitimate return, issue your refund, and assign you an IP PIN. You'll file next year's return with the PIN, and the system will accept it. The fraud will be behind you, but the memory won't fade quickly.

What to remember

Tax refund fraud happens because criminals have your Social Security number and the IRS can't verify identity in real time. The fraud succeeds because the system prioritizes speed over verification. You discover it when you try to file your legitimate return and the system rejects it because someone else already filed.

The resolution process is slow. You'll file Form 14039, submit your return on paper, contact the IRS, and wait months for your refund. The IRS will assign you an IP PIN to prevent future fraud. You'll use that PIN every year when you file.

Prevention is better than recovery. File early, protect your SSN, monitor your IRS account, and use the IP PIN if you have one. These steps won't guarantee you'll never be a victim, but they reduce the likelihood and limit the damage if it happens.

If it happens to you, you're not alone. Millions of Americans deal with tax refund fraud every year. The process is frustrating, but it's survivable. Follow the steps, keep records, and be patient. Your refund will arrive. Your case will close. And next year, you'll file with an IP PIN and a better understanding of how the system works and where it fails.