Tax Identity Theft: What to Do When Your IRS Return Is Already on File

You finish your taxes, hit submit, and wait for the usual confirmation. Instead, the software says a return is already on file.

It’s an unsettling message to get on an ordinary evening. Before trying again, save the exact wording. One detail can change what you need to do next.

Overview

A rejected return is a warning, not a diagnosis

Tax identity theft can occur when someone uses your Social Security number to file a federal return you didn’t authorize, often to claim a refund.

You might discover it when your real return gets rejected. You could also learn about it through a letter asking you to verify a return.

But software can reject a return for reasons that have nothing to do with a thief. A missing code or incorrect number may be enough.

Begin with what you can establish. Did the IRS reject your return, or did the software detect an error before it even sent your filing?

Find out whose information the rejection names

A notice about your own Social Security number calls for a different check than one about a child already claimed on somebody else’s return.

Duplicate dependent claims can result from a mistake or a genuine dispute over eligibility. The rejection doesn’t identify the other filer or settle who qualifies.

A rejection for an incorrect Identity Protection PIN is another situation. It doesn’t say that another taxpayer filed ahead of you.

Keep the reject code beside the tax year and the software’s description. The IRS rejection FAQ helps explain what the individual messages mean.

One safe starting point for three different problems

• A verified IRS letter: Follow the instructions for that letter, not an unrelated guide that happens to mention identity theft.
• A rejection naming your own taxpayer number: Check prior submissions, verify the number, and use IRS guidance if you still can’t explain the duplicate.
• A duplicate dependent: Check eligibility and the dependent’s details before deciding whether to refile electronically or send a paper return.
• A refund text you never requested: Keep it separate from your filing problem. Check through IRS.gov rather than its link.

Those situations can arrive together. Receiving a dubious message the week you file doesn’t mean the sender knows anything about your real return.

And a real notice isn’t an invitation to send tax records to whoever calls next. You’re entitled to stop and verify the route before providing anything.

How Tax Refund Identity Theft Works

Step 1: Tax information gets exposed

A criminal needs information that belongs to someone else. A stolen document, compromised account, or deceptive request for payroll records can expose sensitive details.

There doesn’t have to be a memorable phone call. Some people never learn exactly where their information was exposed.

Conversely, a breach notice doesn’t prove that a return was filed in your name. Treat exposure as a reason to protect your account, not as a filing record.

For a taxpayer, the useful distinction is between information that might be out there and activity the IRS can actually check.

Step 2: A return appears that you didn’t authorize

In refund identity theft, a fraudulent return claims money in another person’s name. The real taxpayer may still be waiting for documents or planning to file.

The existence of the return doesn’t establish that a refund was paid. The agency can flag a submission for review and ask about it first.

If someone gives you an alleged refund amount on a call, don’t use that amount to decide the caller is real. Check through a trusted IRS route.

Keep separate notes for any return you prepared, any return you authorized a preparer to send, and the filing the agency asks about.

Step 3: Your filing or an IRS notice exposes the mismatch

You submit your own federal return and receive a duplicate rejection. Or the IRS writes about a submission you don’t recognize.

In the first case, the rejection is evidence that the submission didn’t go through as expected. It isn’t confirmation that the return you prepared is on file.

In the second, you may be asked whether you filed the return described. You can explain that you didn’t, using the instructions the IRS gives you.

Don’t confuse verifying your identity with agreeing that the return belongs to you. Read the agency’s questions and answer for the filing they actually name.

Step 4: There may be a separate attempt to collect more information

Refund phishing doesn’t require a fraudulent return at all. A message can simply offer a refund or threaten a delay to get you to visit a link.

Someone who contacts you about your taxes may have only a name and a phone number. They don’t need access to IRS records to sound confident.

A surprise request for your Identity Protection PIN is not legitimate. The IRS says it won’t ask for that PIN by phone, email, or text.

If you have both a real filing problem and a suspicious message, deal with them separately. Report the message and resolve the return through verified channels.

What to Do if Someone May Have Filed in Your Name

1. Save the rejection. Record the code, tax year, and date. Keep your transmission receipt and determine whether the problem names you or a dependent.
2. Check what was submitted. Review your software history or call your own preparer using a known number. Make sure an earlier submission wasn’t accepted.
3. Verify any IRS letter. Start at IRS.gov, confirm what the notice is, and follow the instructions for that specific letter if it’s genuine.
4. Use the right identity theft process. Check when the IRS calls for Form 14039. Don’t file it in addition to the verification process unless instructed.
5. Work out how to file your real return. If you cannot e-file, use the applicable paper filing instructions. Confirm deadlines and any payment obligations separately.
6. Protect future returns. Review the IRS Identity Protection PIN program. Store the PIN securely and share it only with a trusted preparer when needed to file.
7. Check for wider misuse. If your identity documents were exposed, use the FTC recovery site and check whether your state tax agency needs a separate report.

When you have a letter in front of you

Read the notice number and tax year before doing anything. Then open the IRS victim assistance guide independently to compare the instructions.

Some letters direct you to an online verification service. Others call for a phone conversation or an appointment. The specific instructions matter more than a generic checklist.

For example, the IRS distinguishes the options for Letters 5071C, 4883C, and 5747C. Don’t assume the same online service applies simply because the numbers look similar.

If you prepared the return yourself, keep a copy handy. If someone prepared it for you, confirm through the contact information you already used with them.

When you only have a software rejection

Work out whether the error is in your own records first. A preparer and a taxpayer can sometimes attempt to submit the same return separately.

If the first submission wasn’t yours, the IRS individual identity theft guide helps you decide whether you need a report, paper filing, or a different correction.

Don’t repeatedly submit the same rejected information to see whether it starts working. Follow the correction appropriate to the code or ask a tax professional.

Keep the original rejection and a copy of anything you mail. If you use a delivery service, retain its proof along with the return date.

Form 14039, a Duplicate Dependent, and the IP PIN

When Form 14039 may be relevant

Form 14039 is the IRS Identity Theft Affidavit for individuals. It’s not a general dispute form for every rejected filing or unexpected message.

If the IRS directs you to use its Identity and Tax Return Verification Service, its published guidance says not to file the affidavit as well.

When an affidavit is appropriate and you can’t e-file, the IRS victim assistance page explains how to submit it with a paper return or separately.

Use the current instructions and avoid sending duplicates. A second submission can make it harder to track what the agency has already received.

When a dependent appears on another return

Check the spelling, number, and filing year. If the information is correct, confirm who qualifies to claim the dependent before changing what you report.

The IRS permits certain electronic returns starting with tax year 2024 to go through despite a duplicate dependent when the primary taxpayer provides a valid IP PIN.

Use the current IP PIN FAQ for the affected form and year. A dependent generally doesn’t need a PIN for this exception unless one was issued.

Acceptance doesn’t settle who can claim the dependent. Save relevant records and follow any IRS notice, rather than trying to negotiate with an unknown filer.

What an IP PIN protects

An IP PIN is a six-digit number used on eligible federal returns. The IRS issues a new one each year for people who remain enrolled.

When a PIN is required, use the one that applies at the time of filing. An old one can be wrong even on a prior-year return.

The PIN is not your IRS sign-in password or a code to read out to someone calling about a refund. Keep those credentials separate.

It also doesn’t stop someone from using stolen information to open credit or file a state return. Deal with those risks through their own reporting channels.

Keep Your Records Without Spreading Them Further

Keep tax documents in one secure place. If you must share them with a trusted professional, ask which documents are necessary and how to transfer them.

Sending the entire folder to an address taken from a forwarded email can expose more data than you intended. Use the preparer’s verified portal if available.

Put the dates of the rejection, notice, and your responses on one page. Keep copies of letters and case references beside that timeline.

If a state return is involved, confirm its status independently. A federal warning does not tell you whether a state filing has been accepted or flagged.

If you suspect a tax account was accessed, reset its password through the official route and check the email account used for recovery.

If the problem extends beyond tax records, IdentityTheft.gov can help you work through additional identity theft steps without posting sensitive details publicly.

When the refund went to an unfamiliar account

First establish which return the refund belongs to. A notice about money issued on a return you didn’t file is different from an expected deposit going missing.

For a return you authorized, compare the refund instructions on your signed copy against what your preparer says was transmitted. Don’t rely on a verbal summary.

Ask your bank about deposits only through a known number. An incoming text offering to reroute the refund is not a reliable way to trace it.

When contacting the IRS, describe both facts separately: whether you authorized the return and whether you recognize the destination. That helps distinguish filing fraud from payment trouble.

When someone offers to fix the rejection for you

Don’t send a complete return to an unsolicited helper who claims to know how to push a filing through. Those pages contain enough information for further misuse.

If you need professional help, find it yourself and agree on what will be done before providing records. Ask to see the completed return before it is submitted.

Never sign a blank return. Keep the signed version and the transmission receipt so you can tell a later duplicate from a filing you actually approved.

If an existing preparer won’t explain a submission, save your agreement and filing records. Use the IRS reporting route for preparer misconduct rather than agreeing to another filing.

Frequently Asked Questions

Does a duplicate e-file rejection always mean tax identity theft?

No. An earlier valid submission, incorrect information, or duplicate dependent claim can also cause trouble. Save the code and verify the underlying problem first.

Can I ignore the rejection because someone else already filed?

No. An unauthorized return doesn’t satisfy your filing obligations. Ask the IRS or a trusted tax professional how to submit your own return and meet deadlines.

Should I file Form 14039 after a verified IRS letter?

Not automatically. Follow the instructions for your specific letter. If it directs you to the IRS verification service, don’t send the affidavit as an extra step.

Can an IP PIN help when someone already claimed my child?

For eligible returns, yes. It can allow electronic filing despite a duplicate dependent. It doesn’t determine who is entitled to claim the dependent.

Will an IRS employee ask for my IP PIN over the phone?

The IRS says it won’t ask for your IP PIN. Use it on your return or provide it to a trusted preparer when ready to file.

Can I request a copy of a fraudulent return?

Eligible taxpayers can request a masked copy under the IRS Form 4506-F instructions. That request is separate from reporting identity theft or filing your own return.

The Bottom Line

Save the exact rejection, then verify it through your preparer or the IRS. Don’t keep resubmitting, pay a refund helper, or hand your PIN to a caller.

If someone really filed in your name, use the appropriate IRS process and make a plan to file your own return. Protect future filings with an IP PIN.