Imagine this: you sit down in February to file your tax return, expecting a refund, and hit submit — only to have the IRS reject it. Someone has already filed a return using your Social Security number and claimed your refund. You are now facing months of paperwork, identity verification, and waiting while the IRS sorts out which return is really yours.
This is not a rare nightmare. The IRS stopped $7 billion in fraudulent refunds across 2024 and 2025, and during the 2025 filing season alone it suspended more than 13 million returns for additional review. Identity thieves file early, claim bogus refunds, and leave the real taxpayer to prove who they are — a process that has left many victims waiting many months for refunds they were owed.
The good news: there is a free, simple lock you can put on your tax account right now. It is called an Identity Protection PIN, or IP PIN — a six-digit number that only you and the IRS know. Without it, nobody can e-file a federal return using your Social Security number. Here is how it works, how to get one, and the mistakes that trip people up every filing season.
What an IP PIN Is (and What It Isn't)
An IP PIN is a six-digit number the IRS assigns to you to verify your identity when you file your federal tax return. Think of it as a second password layered on top of your Social Security number: even if a thief has your SSN, name, and address, they cannot e-file a return in your name without your current IP PIN.
A few things it is not:
- It is not the same as the five-digit e-file signature PIN you may have created when filing electronically. That self-selected PIN just signs your return; the IP PIN proves you are the rightful owner of the SSN on it.
- It does not protect your state return by itself. It applies to your federal return. (You do not enter it on your state return — more on that below.)
- It does not expire after one use within the year. You reuse the same IP PIN for every federal filing you make during that calendar year, including an extension-related return or an amended return.
Most importantly: a new IP PIN is issued every calendar year. The number you used last year will not work this year. Each January, you retrieve a freshly generated PIN and use that one for the filing season ahead.
Who Can Get an IP PIN
Anyone with a valid Social Security number or Individual Taxpayer Identification Number who can verify their identity can opt in — you do not need to have been a victim of identity theft. The opt-in program has been open nationwide for years, and confirmed identity-theft victims are enrolled automatically.
There are three groups to know about:
Voluntary opt-ins (most readers)
If you have never had tax identity theft, you can still get an IP PIN purely as prevention. This is the smartest use of the program: it costs nothing, takes minutes through an online account, and closes the easiest door a thief can walk through.
Confirmed identity-theft victims
If the IRS has confirmed you are a victim of tax-related identity theft and resolved your case, you automatically receive a new IP PIN by mail each year on a notice called the CP01A, typically sent from mid-December through early January. You do not need to reapply — but you do need to watch the mail and keep the notice somewhere safe.
Spouses and dependents
If you file jointly, both spouses need their own IP PINs, and both numbers go on the joint return. A return missing either spouse's PIN will be rejected when e-filed.
Dependents can have IP PINs too, and this matters more than it used to. Since returns for 2024 onward, the IRS accepts a second e-filed return claiming an already-claimed dependent as long as the primary taxpayer on the second return includes a valid IP PIN — a change designed to unblock legitimate filers caught in dependent disputes. If a dependent was ever issued an IP PIN, that dependent's PIN must appear on any e-filed return claiming them (including on Form 2441 and the Earned Income Credit schedule). Dependents age 18 and over can request their own PIN through an IRS online account; for children under 18, a parent requests it on their behalf (see below).
How to Get Your IP PIN: Three Ways
Option 1: Your IRS online account (fastest)
The preferred method is the Get an IP PIN tool inside your IRS online account. It displays your PIN immediately — no waiting for the mail. If you do not have an account yet, you will create one and pass identity verification first, which typically involves photo ID and a live selfie or equivalent verification steps. Once inside, the IP PIN section of your profile page shows your current number each January.
Do this in January, before filing season heats up. The tool refreshes with the new year's PIN in early January; grabbing it early means it is on hand when you or your preparer files.
Option 2: Form 15227 by mail/phone
If your adjusted gross income is below $84,000 ($168,000 for married filing jointly) and you cannot or prefer not to use the online tool, you can submit Form 15227, Application for an Identity Protection Personal Identification Number. The IRS uses the phone number on the form to call and verify your identity before issuing the PIN. Expect this route to take weeks rather than minutes, so file the application well before you plan to file your return.
Option 3: In-person at a Taxpayer Assistance Center
If the other routes do not work for you, schedule an appointment at a local Taxpayer Assistance Center (call 844-545-5640 or use the IRS office locator). Bring identity verification documents — the IRS is strict about this, and showing up without the right documents means a wasted trip.
For a dependent under 18 requested in person, bring your own identity documents plus two of the dependent's documents, such as a birth certificate showing name, date of birth, and city of birth, and the dependent's Social Security card. A written statement with the dependent's full name, the parent or guardian's full name, address, and date of birth is also required — check the current IRS document list before your appointment so you arrive complete.
How to Use It When You File
E-filing
Your tax software or preparer will have a specific field for the Identity Protection PIN — search the software for "IP PIN" if you cannot find it. Every person on the return who has a PIN needs theirs entered: you, your spouse, and any dependent who was issued one. One wrong or missing digit and the return bounces back with a rejection.
Filing on paper
Enter each PIN in the boxes marked "Identity Protection PIN" in the signature area of Form 1040. Note the quirk: on a paper return, you enter PINs for the primary and secondary taxpayers but not for dependents. A paper return with a wrong or missing taxpayer PIN is not rejected outright, but it goes into manual validation — which means a much longer wait for any refund.
Extensions and amended returns
Do not put your IP PIN on Form 4868 (the automatic extension request) or on your state tax return — neither expects it. Do include it when you file an amended federal return for a year in which the PIN applies.
Prior-year returns
If you are filing a prior-year return during the current calendar year, use the IP PIN issued for the current year, not the year the return covers. The PIN authenticates you, right now — it is not tied to the tax year on the form.
What Happens If Something Goes Wrong
Your e-filed return was rejected for a missing or wrong IP PIN
First, read the reject code: it tells you whose PIN is the problem — yours, your spouse's, or a dependent's. Retrieve the correct current-year PIN (through your online account is fastest) and resubmit. If the reject says a dependent needs a PIN you never knew about, that dependent was likely issued one automatically after a past identity issue — retrieve or request it rather than filing around it.
You lost your PIN or never received the CP01A notice
Retrieve it through your online account profile page. If you cannot use the online route, the IRS has a phone retrieval process — but note that a minor dependent's lost PIN cannot be retrieved online and must be reissued by phone. Build in lead time; do not discover this the night of April 14.
Someone already filed using your SSN
File Form 14039, the Identity Theft Affidavit, and be prepared for a long resolution — this is exactly the ordeal the IP PIN prevents. Once your case is resolved as confirmed identity theft, you will be enrolled for automatic annual PINs. Victims should also consider freezing credit with the major bureaus and reviewing IRS transcripts for unfamiliar activity.
You opted in but your PIN never arrived
Opt-in participants who chose the online route do not get a mailed CP01A notice at all — the PIN lives in the online account, retrievable each January. If you expected mail and got none, check your online account first before assuming something failed.
Common Mistakes That Cause Rejections Every Year
- Using last year's PIN. The single most common error. The number changes every January; confirm you have the current one before filing.
- Only entering one spouse's PIN on a joint return. Both spouses' PINs are required. Coordinate early — this is the mistake that turns a 15-minute filing into a week of back-and-forth.
- Sharing the PIN too widely. Give it only to the IRS and your trusted tax preparer. The IRS will never call, email, or text asking for your IP PIN — anyone who does is running a scam.
- Assuming your preparer can get it for you. Tax professionals cannot obtain IP PINs on behalf of clients. You must retrieve your own and hand it over.
- Forgetting dependents' PINs on e-filed returns. If a dependent was issued a PIN, every e-filed return claiming them needs it, including the childcare and earned-income forms.
- Entering the PIN on forms that don't take it. Extension requests and state returns are the usual victims. Keep the PIN for the federal return itself.
IP PIN Scams to Watch For
Because the PIN is valuable, criminals impersonate the IRS to steal it. Remember the rule: the IRS initiates contact about IP PINs by mail (the CP01A notice), never by an unsolicited call, email, or text demanding the number. Treat any such request as fraud, do not engage, and report it. And store the PIN the way you would store a password — not on a sticky note on the return draft, not in an unencrypted email to your preparer.
Why This Matters for Your Bookkeeping
Tax identity theft does not just delay a refund — it contaminates your financial records. A fraudulent return in your name can trigger months of notices, force you to reconcile IRS transcripts against your own books, and leave you unsure which numbers the IRS actually has on file for estimated payments and withholding. Business owners have it worse: untangling a personal identity-theft case while trying to close the books, make quarterly estimated payments, and keep payroll filings clean is miserable.
Keeping clean, complete, and reconcilable financial records all year is what lets you respond fast if anything looks wrong — you can document your real income, trace every estimated payment, and hand your preparer or the IRS a coherent story instead of a shoebox. When your books already tie out to your bank statements and your filed forms, spotting an unfamiliar transcript entry takes minutes instead of weeks. If you keep your ledger in plain text, the documentation shows how to structure accounts so income and estimated payments reconcile cleanly, and the dashboard makes it easy to scan balances for anything that does not belong.
Simplify Your Financial Management
As you protect your tax account with an IP PIN and keep your records audit-ready, maintaining clear financial records is essential. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
