Every tax season, identity thieves race to file fraudulent returns using stolen Social Security numbers, often collecting refunds before the real taxpayer even logs in. The IRS offers a free six-digit Identity Protection PIN that blocks any return filed without it, and the agency now makes the code available to every taxpayer in the country, not just past victims. The tool is simple, costs nothing, and works on both electronic and paper filings.
Why the IRS IP PIN program matters right now
Tax-related identity theft follows a predictable pattern: a criminal obtains a Social Security number or Individual Taxpayer Identification Number, files a return early in the season, and claims a refund. The legitimate taxpayer then discovers the fraud only after the IRS rejects a second filing under the same number. The IRS description of the IP PIN explains that it is a six-digit number assigned to a taxpayer that must be included on any federal return using that SSN or ITIN. Without the correct PIN, the return is rejected at the point of filing.
The program originally served only confirmed identity-theft victims. That changed when Congress passed the Taxpayer First Act of 2019, which directed the Treasury Secretary to establish a program issuing an IP PIN to any U.S. resident who requests one, according to the statutory language in S.928. The IRS later confirmed that all taxpayers are now eligible. The distinction matters: people do not need to prove they have already been victimized to lock down their filing identity.
The IRS also explicitly recommends the IP PIN for anyone who has been targeted by a scam. Agency guidance for scam victims lists the PIN alongside steps like reporting to IdentityTheft.gov and placing fraud alerts with credit bureaus, but the PIN is the only measure that directly prevents a fraudulent federal return from being accepted in the first place. It acts as a gatekeeper at the moment of filing, rather than a cleanup tool after damage has occurred.
How the six-digit code works and how to get one
Enrollment is available through three channels. The fastest is the IRS Online Account, where taxpayers verify their identity through ID.me and receive a PIN immediately once verification is complete. Those who cannot complete online verification can visit a Taxpayer Assistance Center in person with a photo ID and another identification document, such as a birth certificate or passport. A third option, the paper route using Form 15227, is available for taxpayers with income below a certain threshold, though it involves a longer processing time and requires a follow-up phone call from the IRS.
Once assigned, the PIN changes every calendar year. Taxpayers need to use the current year’s number on any original or amended return filed that year. If they choose to opt out in the future, they can do so, but remaining in the program keeps the SSN or ITIN locked behind that extra layer of verification. The IRS stresses that the IP PIN should be stored securely and shared only with a trusted tax professional or entered directly into tax software.
Taxpayers who lose their PIN or never received it can retrieve it online. The agency’s tool to recover a current IP PIN uses the same identity-verification process as initial enrollment and can regenerate the number for the active filing year. If online access is not possible, taxpayers can request a reissued PIN by mail after passing additional checks, though that option takes more time and may not be available close to filing deadlines.
The IRS does not request the IP PIN through phone calls, text messages, or emails, a point underscored in the agency’s official FAQ on the program. Any unsolicited contact claiming to need the number is itself a scam. The only time a taxpayer should provide the PIN is when entering it into a return, giving it to a preparer they selected, or using it in an official IRS online tool.
Does the IP PIN actually reduce fraud?
A reasonable question is whether taxpayers who obtain the PIN after reporting identity theft actually experience fewer repeat incidents than those who skip it. The IRS scam-victim checklist walks people through reporting and monitoring steps, but none of those measures physically block a fraudulent return the way the PIN does. The mechanical logic is clear: a return without the correct PIN is rejected before it can generate a refund, closing off the main channel criminals exploit.
Because the IP PIN is tied to a specific taxpayer’s SSN or ITIN and refreshed annually, a thief would need both the Social Security number and the current six-digit code to succeed. That combination is substantially harder to obtain than an SSN alone, especially when taxpayers keep the PIN offline and out of email. While no single tool can eliminate identity theft, the program shifts the odds sharply in favor of the legitimate filer.
For most people, the trade-off is straightforward: a few minutes of setup in exchange for a standing barrier against fraudulent filings. With tax-related scams continuing to evolve, enrolling in the IP PIN program gives taxpayers a direct way to assert control over their filing identity before the next season begins.
