A stolen Social Security number gives a criminal enough information to file a fake federal return before the legitimate taxpayer, but it is not enough to defeat an IRS Identity Protection PIN. The six-digit code becomes a second credential attached to the tax identity, and a return missing the correct current-year PIN can be rejected or pulled out of normal processing. That barrier protects both the filing slot and any refund connected to it.
The PIN turns a Social Security number into incomplete access
Tax-refund theft exploits timing. A criminal submits a fabricated return early, claims withholding or credits, and directs the refund to a controlled account. When the real taxpayer files, the IRS sees a duplicate return and begins an identity-theft review. The victim may ultimately receive the correct refund, but only after proving identity and unwinding a filing that should never have been accepted.
The IRS describes an IP PIN as a six-digit number known only to the taxpayer and the agency that prevents someone else from filing a return using the protected Social Security number or individual taxpayer identification number. The code applies to electronic and paper returns. A thief who has a name, birth date, address, and SSN still lacks the credential required for acceptance.
Enrollment is open to anyone with an SSN or ITIN who can verify identity, not only to people already victimized. Parents and legal guardians can also request protection for dependents. That matters because a stolen child’s identity can be used to claim an improper dependent credit or block the family’s legitimate return even when the child has no income and would never file independently.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
A new number arrives for every filing season
The IP PIN is not a permanent six-digit password. The IRS generates a new number each calendar year, and the taxpayer must use the number issued for that filing season even when submitting a prior-year return. A code saved with last year’s tax documents will not authenticate the next filing. Online-account users retrieve the current number from the IP PIN section of their IRS profile.
The agency’s IP PIN frequently asked questions explain where the code belongs on individual returns and how it applies to spouses and dependents. Every protected person whose SSN appears on the return needs the appropriate current PIN. Omitting a dependent’s code can stop a return even when the primary taxpayer entered a valid one.
The code should be shared only with the trusted preparer filing the return. The IRS does not call, email, or text to demand an IP PIN, and a preparer does not need it until the return is being completed. A scammer asking for the number has revealed the missing piece needed to bypass the protection, which makes the request more dangerous than an ordinary demand for information already exposed in a breach.
The protection prevents filing, not every form of identity theft
An IP PIN does not freeze credit, stop account takeover, or prevent a criminal from opening loans elsewhere. Its scope is federal tax-return authentication. Credit freezes, bank alerts, and account-password controls address different uses of stolen identity data. The PIN is powerful precisely because it is narrow: the IRS can enforce it at the point where a return enters its processing system.
When identity theft has already occurred, the IRS uses a separate victim-assistance process. Its identity-theft guidance describes how suspicious returns are flagged and how confirmed victims are placed in the IP PIN program. The code can protect future years, but resolving an already-filed fraudulent return may still require authentication, correspondence, and processing time.
Electronic filing makes an incorrect PIN visible quickly because the return is generally rejected before normal processing. A paper return with a missing or incorrect code can take longer to resolve, and the IRS warns that processing may be delayed. A rejection is protective rather than punitive: it indicates that the tax identity is locked until a return arrives with the credential the agency issued.
Tax software usually asks for IP PINs in a separate identity-protection field. Entering the number as an e-file signature PIN or preparer credential does not satisfy the requirement. Married couples may need two codes, and a dependent’s code belongs with that dependent’s information. The return should not be transmitted until every protected SSN has its matching current-year PIN.
Enrollment becomes an annual responsibility because taxpayers generally cannot opt out once the IRS assigns protection. The yearly code should be retrieved before filing and kept apart from documents routinely emailed or uploaded. A compromised tax organizer that contains both the Social Security number and the current IP PIN would collapse the two-factor barrier the program was designed to create.
The financial value of the PIN is the delay it prevents. Refund theft can lock up money needed for property tax, medical bills, or debt payments while the IRS determines which return is genuine. A six-digit number does not restore privacy after an SSN leak, but it removes the leaked SSN’s ability to function as a complete key to the federal return and the refund behind it.
This article was produced with AI assistance and reviewed by The Money Overview editorial team.
More Financial Reading
