IRS Identity Theft Protection and IP PIN Program
The IRS Identity Theft Protection program and its centerpiece tool — the Identity Protection Personal Identification Number (IP PIN) — represent the federal government's primary administrative mechanism for shielding taxpayers from fraudulent return filings. This page covers the program's scope and legal grounding, the mechanics of how an IP PIN is issued and used, the circumstances that most commonly trigger enrollment, and the decision rules that determine who qualifies or is required to participate. For a broader orientation to IRS programs and taxpayer obligations, see IRS Authority.
Definition and scope
Tax-related identity theft occurs when a third party uses a stolen Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) to file a fraudulent federal return and claim a refund before the legitimate taxpayer files. The IRS received more than 1.1 million identity theft affidavits (Form 14039) from taxpayers in fiscal year 2022 alone (IRS Data Book 2022), illustrating the scale of the problem the IP PIN program directly addresses.
The Identity Protection PIN is a 6-digit number assigned annually by the IRS. Its statutory and operational basis sits within the IRS's broader authority under the Internal Revenue Code to protect the integrity of the tax filing system. Administratively, the program is governed by guidance published in the Internal Revenue Manual (IRM) under IRM Part 25.23, which covers Identity Protection and Victim Assistance.
The program operates on a calendar-year cycle. Each IP PIN is valid for a single tax year and must appear on any federal return — Form 1040, 1040-SR, or 1040-NR — filed under that SSN or ITIN. A return submitted without the correct IP PIN will be rejected by IRS e-file systems or flagged for additional processing if submitted on paper.
Two distinct enrollment pathways exist:
- Confirmed victim enrollment — Taxpayers who have experienced tax-related identity theft and received IRS confirmation (typically via Letter 5071C, 4883C, or a CP notice) are automatically enrolled in the IP PIN program.
- Voluntary opt-in enrollment — Since 2021, the IRS has made the IP PIN program available to any taxpayer who can verify their identity through the IRS online portal (IRS IP PIN Tool), regardless of whether fraud has previously occurred.
How it works
The IP PIN is generated each January and made available through the IRS's secure online account. Taxpayers who cannot access the online portal may retrieve their PIN by calling the IRS directly or, in limited cases, by filing Form 15227 if their adjusted gross income is at or below a specific threshold that qualifies them for telephone assignment.
The operational sequence each filing year runs as follows:
- The taxpayer retrieves the PIN through IRS Online Account or IRS correspondence.
The PIN itself is never stored on the return after processing — it functions solely as an authentication token for that filing cycle. Dependents listed on a return can also be assigned IP PINs if their SSNs have been compromised; the IP PIN for each dependent is entered in a separate field on the primary filer's return.
Spouses filing jointly each require their own IP PIN if both are enrolled. A joint return missing one spouse's IP PIN will be rejected.
Common scenarios
Three circumstances account for the overwhelming majority of IP PIN enrollments:
Fraudulent return already filed. A taxpayer attempts to e-file and receives rejection code IND-515 or IND-516, indicating the IRS has already accepted a return bearing their SSN for that tax year. The taxpayer must file Form 14039 (Identity Theft Affidavit) and submit a paper return. The IRS Identity Protection Specialized Unit (IPSU) investigates, and upon resolution the taxpayer is enrolled in the IP PIN program going forward.
IRS-issued identity verification letter. The IRS mails a letter — most commonly Letter 5071C, which directs the taxpayer to an online identity verification portal, or Letter 4883C, which requires a phone call — when its filters detect a potentially suspicious return. Successful verification through either channel results in IP PIN issuance for the following filing year.
Proactive voluntary enrollment. A taxpayer whose SSN has appeared in a data breach notification or dark web alert, but who has not yet experienced a fraudulent IRS filing, uses the IRS's Get an IP PIN tool to enroll before any fraud occurs. This pathway became available nationally in 2021 (IRS news release IR-2021-09).
Decision boundaries
The IP PIN program intersects with — but is operationally distinct from — adjacent IRS processes. Understanding these boundaries prevents procedural errors.
IP PIN vs. e-file PIN: An e-file PIN is a self-selected 5-digit number used as a signature alternative on electronically filed returns. It does not authenticate identity against a fraud database. An IP PIN is IRS-assigned, 6 digits, rotates annually, and functions as an anti-fraud credential. The two are not interchangeable.
IP PIN vs. Identity Theft Affidavit (Form 14039): Filing Form 14039 is the reporting mechanism when fraud is suspected or confirmed. Receiving an IP PIN is the prevention mechanism that follows. Form 14039 does not itself generate an IP PIN; it initiates an investigation that may result in IP PIN enrollment after the case is resolved.
IP PIN vs. Taxpayer Advocate intervention: If an IP PIN is lost, misplaced, or the online tool is inaccessible close to a filing deadline, the Taxpayer Advocate Service can assist in escalating retrieval, but the Taxpayer Advocate does not independently issue or override IP PINs. The PIN must be obtained from the IRS directly.
Opt-out rules: Once enrolled as a confirmed identity theft victim, a taxpayer cannot voluntarily leave the IP PIN program. Voluntary opt-in participants who enrolled through the online portal may choose not to renew, but any enrolled SSN remains subject to IP PIN validation requirements for the current filing year even if the taxpayer later changes their preference.
Taxpayers who file amended tax returns using Form 1040-X for an IP PIN-enrolled year must include the IP PIN that was active during the original filing year of the return being amended — not the IP PIN current at the time the amendment is submitted.
The IRS also separately notes that IRS data security and privacy controls govern how IP PINs are stored, transmitted, and protected within IRS systems, distinct from the taxpayer-facing enrollment process described above.