Tax identity theft occurs when someone uses your Social Security number or personal information to file a false tax return in your name and claim a refund
The thief files before you do, using your SSN to request a refund they pocket. The IRS processes it. When you file your actual return weeks or months later, the system flags a duplicate filing under your number, and your legitimate return gets delayed or rejected. You then spend months proving you are who you say you are while the IRS investigates.
The theft does not require access to your bank account or credit cards. It requires only your name, address, and Social Security number — information that is far easier to obtain than most people realize.
Key Takeaways
- A thief needs only your name, address, and Social Security number to file a false tax return in your name and claim your refund.
- Data breaches at employers, healthcare providers, and government agencies expose millions of SSNs and personal details every year.
- Phishing emails and texts that mimic the IRS or your employer trick people into handing over SSNs, dates of birth, and bank details.
- The IRS does not contact taxpayers first by email, text, or phone — if you receive unsolicited contact claiming to be the IRS, it is fraudulent.
- Filing your return early in the tax season, before a thief can, is the single most effective way to prevent tax identity theft.
Data breaches expose millions of Social Security numbers at once
Large employers, hospitals, insurance companies, and government agencies store your SSN, address, date of birth, and sometimes bank details. When their systems are breached — through weak passwords, unpatched software, or employee negligence — that data is stolen in bulk and sold on the dark web or used directly by criminals.
The 2017 Equifax breach exposed SSNs and personal information for 147 million people. The 2021 breach of the U.S. Office of Personnel Management exposed data for 21.5 million federal employees and contractors. Healthcare breaches happen constantly; in 2023 alone, breaches affected tens of millions of patient records. Your SSN may have been compromised years ago and only now used for tax fraud.
You have no control over whether a company you do business with gets breached. You can only monitor for signs that your information has been misused.
Phishing emails and texts trick you into giving up your SSN
A criminal sends an email or text that looks like it came from the IRS, your employer's payroll department, or your bank. The message says your account is locked, your refund is delayed, or you need to verify information. It includes a link to a fake website that looks identical to the real one. You enter your SSN, date of birth, and sometimes your bank login or PIN.
The IRS does not initiate contact with taxpayers by email, text message, or unsolicited phone call. If you receive unsolicited contact claiming to be from the IRS, it is fraudulent. The IRS contacts people by mail when there is a problem, and only after you have already filed or been selected for an audit.
Phishing is effective because the fake sites are convincing and the urgency in the message — "your account will be closed," "act now" — makes people skip their normal caution. A single successful phishing email gives a criminal everything needed to file a false return.
Stolen mail and discarded documents put your SSN in a criminal's hands
Tax documents, W-2 forms, bank statements, and insurance paperwork all contain your SSN. If mail is stolen from your mailbox or a mail carrier's truck, a criminal has what they need. If you throw documents in the trash without shredding them, someone digging through your garbage or a dumpster can retrieve them.
This method is slower and less scalable than data breaches or phishing, but it still happens. Criminals sometimes target specific mailboxes in neighborhoods where they know tax refunds are likely to be large, or they work with postal workers or trash collectors who have access.
Shredding documents with your SSN before discarding them, and collecting mail promptly, reduce this risk. A cross-cut shredder is inexpensive and makes documents unreadable even if someone retrieves them.
Your employer or payroll processor may be the source
Your employer or the payroll company they use has your SSN, address, and salary information. If their systems are compromised, that data is exposed. Some criminals specifically target payroll processors because they hold employee data for hundreds or thousands of companies at once.
In 2020, the payroll processor Insperity was breached, exposing data for over 1 million employees. In 2022, the payroll company ADP was breached, affecting thousands of businesses and their employees. Your employer may not tell you when ready, or may not tell you at all if they are not required to by state law.
You cannot prevent your employer from being breached, but you can monitor your tax account and file early to catch fraud before a thief does.
Public records and social media make it easier to piece together your identity
Your name, address, and date of birth are public record in property deeds, voter registrations, and court documents. Social media profiles often display your birthday, hometown, and employer. A criminal can combine information from these public sources with a stolen SSN to make a false tax return look more legitimate.
Some criminals use this piecemeal approach when they have only a partial SSN or when they are targeting a specific person. Others use it to verify information they already have before filing a fraudulent return.
Limiting what you share on social media and being cautious about what personal details you post publicly makes it slightly harder for criminals to build a complete profile, but it is not a complete defense.
Criminals file returns early in the tax season before you do
The tax season runs from late January through April 15. A criminal who has your SSN files a false return in early February, before you have filed your legitimate one. The IRS processes it and issues a refund. When you file your actual return in March or April, the system detects the duplicate filing and rejects or delays your return.
This timing is deliberate. Filing early gives the criminal the best chance of getting the refund processed before the IRS catches the fraud. It also means you do not discover the theft until you file and your return is rejected — sometimes weeks after the criminal has already received your money.
Filing your own return as early as possible — as soon as you have your W-2 or other income documents — is the most effective way to prevent this. If you file first, the criminal's false return will be rejected as a duplicate.
Frequently Asked Questions
How do I know if my SSN has been stolen for tax fraud?
The IRS will contact you by mail if it detects a duplicate return filed under your SSN. You may also discover it when you file your return and the system rejects it as a duplicate. You can also check the IRS website or call the IRS Identity Theft Hotline at 1-800-908-4490 if you suspect fraud. The IRS can tell you whether a return has been filed under your number.
Can I prevent tax identity theft completely?
No. You cannot control whether a company you do business with gets breached or whether a criminal obtains your SSN through other means. You can reduce your risk by filing your return early, shredding documents with your SSN, being cautious about phishing emails, and monitoring for signs of fraud. But prevention is not may provide.
What should I do if I receive a phishing email claiming to be from the IRS?
Do not click any links or read any attachments. Do not enter any personal information. Forward the email to phishing@irs.gov and then delete it. You can also report it to the Federal Trade Commission at reportfraud.ftc.gov. The IRS does not initiate contact by email.
Will I have to pay back a refund that was issued to a criminal in my name?
No. The IRS understands that the refund was fraudulent and issued in error. You are not responsible for repaying it. However, resolving the fraud and getting your legitimate refund processed can take months, and you may need to provide documentation to prove your identity.
Is my information safer if I file electronically or on paper?
Electronic filing is generally safer because it is faster — you file and the IRS processes your return before a criminal can file a false one under your number. Paper returns take longer to process, which gives a criminal more time to file first. Filing electronically and early is your best protection.