Cyber
If the IRS rejects your e-file because a return was already filed with your SSN—or you get IRS notices about a return you did not submit—treat it as tax-related identity theft. Do not pay callers who demand gift cards to “release your refund.” Follow IRS and IdentityTheft.gov steps: respond to official notices, file the correct return with required identity-theft forms as IRS instructs, and enroll in an IP PIN. This guide is about recovery after a thief filed—not how to set up an IP PIN from scratch alone, not W-2 phishing prevention only, and not payday loan phishing.
1. Signs a thief filed first
Common signals include: e-file rejection because a return for that SSN already exists; IRS letters about a return, refund, or balance you do not recognize; employers reporting W-2 issues you did not cause; or unexpected tax transcripts activity. Scammers also cold-call pretending to be IRS collection after a fake filing—hang up and use official channels.
Fraudsters scrape news about tax season and call people whose e-file failed. They already “know” your rejection happened. Hang up, call numbers from your IRS notice or irs.gov, and never read SMS codes to anyone claiming to restore a refund.
2. Do vs don’t
| Do | Don’t |
|---|---|
| Use irs.gov and IdentityTheft.gov you open yourself | Pay gift cards, wires, or crypto to a caller “from IRS” |
| Mail forms the IRS lists for identity-theft returns when required | Ignore duplicate-filing rejection notices |
| Enroll in IP PIN after you stabilize the account | Share notice codes with strangers offering “expedite help” |
| Freeze credit and monitor bank accounts | Assume a credit lock alone fixes tax filing theft |
3. Steps: what to do next
- Stay calm and use written IRS processes. The IRS will not call demanding immediate gift-card or crypto payment.
- If e-file was rejected for a duplicate filing, follow the IRS identity-theft and rejected-return instructions for your situation—typically involving paper filing and Form 14039, Identity Theft Affidavit, when IRS guidance says to include it.
- Complete IdentityTheft.gov for a recovery plan covering credit and other accounts, not only tax.
- Respond to any CP or similar IRS notices using the contact methods printed on the notice—or accounts you open at irs.gov yourself—not numbers from a text.
- File your legitimate return as IRS directs so your refund or account can be sorted; keep copies of everything you mail.
- After the case is in process, enroll in the IRS IP PIN program so future returns need your six-digit PIN—see how to set up an IP PIN.
- Place free credit freezes at all three bureaus and review AnnualCreditReport.com for new accounts.
- If the thief also phished your email or device, change passwords, harden two-factor authentication, and scan with a trusted tool such as Norton or Bitdefender. Keep one primary real-time antivirus—avoid stacking full suites. TotalAV, McAfee, and Avast are other on-site comparison options.
4. If a refund already went to the thief
IRS processes for fraudulent refunds take time. Continue following notice instructions, keep proof of your filing, and use IdentityTheft.gov. Ask your tax professional only if they are a preparer you chose—not a cold Facebook “refund recovery” service.
FAQ
Does a rejected e-file always mean identity theft?
It is a major warning sign when the IRS says a return already exists for your SSN. Follow IRS duplicate-filing / identity-theft steps rather than guessing.
Is this the same as W-2 phishing?
W-2 phishing steals wage data that can enable tax fraud later. This article covers what to do after a fraudulent return is already in the system.
Will an IP PIN fix last year’s stolen refund automatically?
An IP PIN helps protect future filings. Resolving an already-filed fraudulent return still requires IRS identity-theft procedures.
Should I pay a private “tax identity thief recovery” firm upfront?
Be extremely cautious. Start with free IRS and IdentityTheft.gov paths; watch for the same advance-fee patterns as fake credit repair.
If you still want a paid suite
Avoiding what to do if your tax return was already filed by a thief does not require paid antivirus. Careful habits and official support paths are a valid buy-nothing stack. If you want multi-device paid protection later, use only these on-site paid links: TotalAV (paid link), Norton (paid link), Bitdefender (paid link), McAfee (paid link), Avast (paid link).