What to Do If Your Tax Refund Is Stolen

Millions of Americans look forward to getting hefty tax refunds every year. But unfortunately, thousands of taxpayers will learn that their refunds have already been paid out to identity thieves. Tax-refund identity theft is rampant, and new Internal Revenue Service safeguards that make this crime harder to pull off on the federal level have only turned thieves' attention to state tax agencies.

Credit: Stokkete/Shutterstock

(Image credit: Stokkete/Shutterstock)

If the IRS or your state tax agency tells you you've already filed a return, or that your return is suspicious, here's what to do. Note that while this is a three-stage process, you will have to take many different steps in Stage 2, in no particular order but as quickly as possible.

Stage 1: Determine whether something is wrong.

  • Verify your identity with the IRS. If the federal tax agency sends you a letter saying it has suspicions about your income-tax return, it may just be a formality — assuming that you actually have already filed a return. Follow the steps detailed in the letter to verify your identity with the IRS.
  • If you haven't yet filed a return, then the verification request from the IRS will be a huge red flag. So would a notification from the IRS that you've filed a duplicate return when you know you've filed only once. In either case, proceed to Stage 2.

Stage 2: Take the following actions right away (and still pay your taxes). These aren't steps to be taken in order; instead, each must be done as quickly as possible. Keep copies of every completed form or letter, and write down the dates of each correspondence or form filing.

  • Fill out the IRS Identity Theft Affidavit, Form 14039. Mail it, along with a copy of the letter you received from the IRS about the duplicate return, to the address mentioned in the letter. If you didn't get a letter, but still have reason to suspect tax-return fraud, then staple Form 14039 to your paper tax return and file your taxes normally.
  • Request a copy of the tax return fraudulently filed in your name by filling out IRS Form 4506-F. The instructions are a bit complex, so read them through first. You'll need to submit a copy of your driver's license or passport.
  • File your tax return, on paper if necessary, and pay your taxes. Being a victim of tax-return identity theft doesn't excuse you from this obligation.
  • File a complaint with the Federal Trade Commission at https://www.identitytheft.gov/.
  • File a report of identity theft with your local police department. This is a very important legal step. Many private companies can't help you restore your credit until a police report is filed.
  • The police may ask you to fill out IRS Form 8821-A, which would authorize them to have access to your tax returns to aid in the investigation. Only law enforcement personnel are authorized to obtain and file this IRS form.
  • Contact one of the three main credit-reporting agencies — Equifax (1-888-766-0008), Experian (1-888-397-3742) and TransUnion (1-800-680-7289) — to place a free, 90-day fraud alert on your credit report. The agency you alert is required to inform the other two. You'll be notified of every credit inquiry and attempt to open an account in your name.
  • Look over your credit reports for any unfamiliar accounts. Each credit-reporting agency should give you a free credit report when you file a fraud alert. (If they don't, then go to annualcreditreport.com to obtain the reports.) If you find an account that doesn't belong, write a letter to the bank, credit-card issuer or other company that holds the account. State that your identity was stolen, that the account is fraudulent and that you'd like to close the account.
  • If it looks like someone else may have worked while using your Social Security number, send a letter to that person's employer explaining that your Social Security number was stolen and that you don't work for that employer.
  • If your case involves fraudulent state-income-tax returns, you'll also have to contact your state's tax-collection agency. (You should still follow the instructions above pertaining to the federal returns.) Start by checking the state tax agency's website for how to report a case of tax-refund identity theft.

Following are links to the relevant web pages for the 10 largest states that collect income tax. A full list of state tax agencies is at http://www.taxadmin.org/state-tax-agencies.

California: http://www.ftb.ca.gov/online/Fraud_Referral/index.shtml
New York: https://www.tax.ny.gov/help/contact/identity_theft.htm
Illinois: http://tax.illinois.gov/Fraud/IdentityTheft.htm
Pennsylvania: http://www.revenue.pa.gov/GetAssistance/IDTheftProtectionAndVictimAssistance/Pages/Reporting%20ID%20Theft.aspx
Ohio: http://www.tax.ohio.gov/Individual/IDTheft.aspx
Georgia: http://dor.georgia.gov/webform/fraud-referral-form
North Carolina: http://www.dor.state.nc.us/individual/identitytheft.html
Michigan: http://www.michigan.gov/documents/taxes/TaxpayerGuideIdentifyTheft_462936_7.pdf
New Jersey:  http://www.state.nj.us/treasury/taxation/identity_theft.shtml
Virginia: https://www.tax.virginia.gov/refund-fraud-prevention

Stage 3: Be patient while your case gets resolved.

  • Wait for a letter acknowledging receipt of IRS Form 14039. You'll be referred to the IRS Identity Theft Victim Assistance (IDTVA) team, which will investigate the case.
  • Wait for your IP PIN to arrive by mail. For the following year's tax return, you'll receive a special Identity Protection Personal Identification Number to include with the return.
  • The entire resolution process usually takes four months, according to the IRS website. Complex cases may take longer than six months. In the end, you are supposed to get your full tax refund, whether or not the crooks who stole it are caught.
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.