Last filing season, thousands of Americans discovered they had been robbed before they even knew anything was wrong. They sat down to e-file their federal tax returns and got an immediate rejection: someone had already filed under their Social Security number and claimed their refund. The money was gone, routed to a prepaid debit card or a bank account controlled by a stranger. Resolving the mess typically takes months of paperwork and phone calls with the IRS.
The scheme is called stolen-identity refund fraud, and the Treasury Inspector General for Tax Administration (TIGTA) has repeatedly identified it as one of the most significant risks facing the U.S. tax system. In a 2023 audit report, TIGTA noted that while the IRS has made progress, criminals continue to adapt. Yet the IRS offers a free, opt-in defense that most taxpayers have never activated: an Identity Protection PIN.
How the IP PIN works
An Identity Protection PIN, or IP PIN, is a unique six-digit number the IRS assigns to any taxpayer who requests one. When a federal return is e-filed, the IRS system checks the PIN against its records. If the code is wrong or missing, the return is rejected instantly. No PIN match, no refund issued.
The IRS describes the IP PIN as a free credential designed to prevent someone else from filing a federal return using your Social Security number or Individual Taxpayer Identification Number. Any person with an SSN or ITIN is eligible to enroll, according to the Taxpayer Advocate Service.
A critical design feature: the IRS generates a fresh PIN every calendar year and mails it to enrolled taxpayers in a CP01A notice before filing season opens. That means a stolen prior-year code is useless. Internal procedures in the IRS’s fraud and identity theft section, detailed in the Internal Revenue Manual, describe how returns missing a required PIN are routed and rejected. The PIN functions as a hard gate in the electronic filing pipeline, not a soft flag that gets reviewed later.
The fraud it is designed to stop
Stolen-identity refund fraud follows a well-documented pattern. Criminals harvest personal data through data breaches, phishing emails, or dark-web marketplaces, then electronically file hundreds or thousands of false returns seeking refunds. The Department of Justice’s Tax Division has prosecuted numerous fraud rings built on this model.
One landmark case illustrates the scale. In 2013, a federal court in the Southern District of Florida sentenced Alci Bonannee to 15 years in prison after she led a conspiracy that used stolen personal information to file more than 4,000 fraudulent returns claiming over $11 million in refunds. More than a decade later, the underlying tactic has not changed; only the tools have gotten faster. Criminals now use automated software to submit fraudulent returns in bulk within days of the IRS opening e-filing each January.
The IP PIN directly interrupts this cycle. Because the PIN is known only to the taxpayer and the IRS, a criminal who possesses a stolen Social Security number but lacks the current six-digit code cannot successfully e-file a return under that number. The return is rejected before any refund is processed.
Three ways to get a PIN
The fastest route is through the IRS online account portal. Taxpayers verify their identity through ID.me, and the PIN appears on screen immediately. For those who cannot verify online, two alternatives exist:
- In person: Visit a local IRS Taxpayer Assistance Center with a valid photo ID and a second form of identification. Staff will verify your identity and process the request on the spot.
- By mail: File Form 15227 with the IRS. After a phone verification call, the IRS mails the PIN to your address on file. This option is limited to taxpayers with an adjusted gross income at or below the thresholds listed in the current Form 15227 instructions (the IRS may update these figures annually, so taxpayers should confirm the limits on that page before applying).
Once enrolled, you receive a new PIN in a CP01A notice each January. You must enter the PIN when filing your federal return, whether you use tax software, a professional preparer, or a paper form. If you misplace the notice, you can retrieve your current PIN by logging into your IRS online account.
What the PIN does not cover
The IP PIN protects federal returns only. It does not apply to state tax filings, which means taxpayers in the 41 states (plus Washington, D.C.) that levy a personal income tax may still be vulnerable to state-level refund fraud. Some states have developed their own identity verification systems. New York, for example, requires additional identity checks through its identity verification program, but coverage and rigor vary widely from state to state.
The PIN also does not prevent other forms of identity theft, such as fraudulent credit applications, medical identity fraud, or employment fraud using a stolen SSN. It is a narrow but effective tool aimed at one specific problem: stopping someone else from filing a federal tax return in your name.
Open questions about adoption and impact
Despite the PIN’s clear mechanical function, several gaps make it difficult to measure the program’s full reach. The IRS has not published recent enrollment figures showing how many of the roughly 163 million individual filers have opted in. Anecdotal reports from tax professionals suggest that enrollment has grown since the IRS opened the program to all taxpayers in 2021, but without official numbers it is impossible to know whether adoption is keeping pace with the scale of the fraud threat.
There is also no public analysis isolating the PIN’s effect from other fraud filters. The IRS runs a broader Taxpayer Protection Program that uses algorithmic screening to flag suspicious returns before refunds are issued. A Government Accountability Office report evaluating that program found ongoing vulnerabilities where fraudsters could still obtain refunds even with screening in place. Because the IP PIN operates alongside these other systems, no published report attributes a specific dollar amount of prevented fraud to the PIN alone.
Retention is another practical concern. The code changes every year, and a misplaced CP01A letter can delay filing. The IRS allows taxpayers to retrieve their current PIN through the online portal, but the agency has not released data on how often filers abandon or postpone e-filing because they cannot locate their code.
“I have clients in their 80s who do not have smartphones or reliable internet, and getting them through the ID.me process is a real ordeal,” said one enrolled agent at a mid-size tax preparation firm who asked to be identified only by her professional credential. “The mail option helps, but the income cap shuts out a lot of people who would otherwise benefit.” Her experience reflects a broader accessibility gap that the IRS has acknowledged but not yet fully addressed.
How to enroll before June 2026 and lock your next return
The IP PIN is not a cure-all for identity theft, and no public data quantifies exactly how many fraudulent refunds it has blocked. But the program’s mechanics are transparent and well-documented by the IRS. The credential is free. The main cost to the user is the minor inconvenience of safeguarding a six-digit number each year and entering it at tax time.
Set against the alternative, that tradeoff is hard to argue with. Victims of tax-related identity theft routinely face months of delays, frozen refunds, and hours on hold with the IRS trying to prove they are who they say they are. The IP PIN is designed to prevent that experience entirely.
The IRS accepts new IP PIN enrollments year-round. Taxpayers who sign up by June 2026 will have their PIN in hand well before the following filing season opens. In a landscape where criminals continue to exploit stolen Social Security numbers at industrial scale, opting in is one of the few proactive steps any taxpayer can take. The enrollment page is at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.
