The most frightening place for identity theft to occur is around your tax return. You typically find out when someone else has filed a tax return using your Social Security number — and likely claimed a refund. But sometimes the Internal Revenue Service will catch the fraud first, or at least they will notify you that they suspect fraud. You’ll receive Letter 5071C, asking you to verify your identity and tax return information with a link to the IRS online tool. Or Letter 4883C will give you a toll-free number to call.

But they will not call or text you to tell you about suspected fraud. A call like that is almost certainly a scam!

When you respond to the IRS request for identity verification, you’ll need a copy of your prior year’s return. If you cannot verify through this process, you’ll be sent to an IRS office for personal verification. It’s the start of a nightmare that takes a long time to unravel. While it is going on, you won’t be able to file your current return, and of course you won’t receive your justified refund. There’s a slightly different process if you are the one who learns you’re the victim of tax-related identity theft. Then you must file IRS Form 14039, the Identity Theft Affidavit. Then the investigation process can take months.

An ounce of prevention

We’ve all gotten used to two-factor identification — those annoying codes texted to you by your bank to confirm your identity. But that extra layer of protection is important to make sure you’re not defrauded. As long as your phone SIM card is secure (read my recent column on SIM card fraud at TerrySavage.com), the two-factor authentication will protect you.

The IRS has its own form of identity protection called the IP PIN — a six-digit number that is uniquely assigned to you (a new PIN each year), which you must use in all communications and when filing your return. The PIN allows you to access your private IRS online account, where you can find previous year’s tax forms, and W-2 forms and 1099s. In fact, you must open an IRS Online Account first in order to get the PIN — unless you have been a victim of tax fraud, in which case the IRS will automatically assign you a PIN each year.

The process

To open an IRS Online account, go to www.IRS.gov and in the search box on the home page, put the words “create online account.” That will take you to a page that gives instructions. Your first step to opening an IRS account is to create an ID.me account — which grants secure access to multiple government websites.

You’ll see a box telling you to “sign in” to your online account. Click on that box, even if you don’t already have an account. That is the start of the process. You’ll have a choice of signing in using your ID.me credentials or an opportunity to create an ID.me credential. If you’re just starting out, follow that “create” link. Once you’ve established ID.me, you can create, or access, your IRS Online account. It’s complicated but secure.

Every year in January, you should go into your account, navigate to your profile information and then scroll down and follow the prompts to enroll in the IP PIN program. You’ll be given your unique six-digit pin for that year.

If you have minor children, enroll their name and Social Security number in the IP PIN program. You can’t do it online, but must mail IRS Form 15227 to the IRS.

Guard your IP PIN

The IRS never calls or texts asking for your PIN. Period. You should guard this secret number, sharing it only with your tax preparer. Be sure to enter the PIN on all tax filings, whether paper or online.

It’s one more step — a free one — to guard against the nightmare of identity theft. More than 10 million taxpayers already have their 2025 IP PIN. It’s time to sign up. And that’s the Savage Truth.

Terry Savage is a registered investment adviser and the author of four bestselling books, including “The Savage Truth on Money.” Terry responds to questions on her blog at TerrySavage.com.