Nobody wants to think about criminals rifling through their financial life, but tax return fraud has turned into one of the biggest headaches facing American taxpayers. The IRS flagged over a million returns for possible identity theft back in 2023 alone—returns worth roughly $6.3 billion in fraudulent refunds. Those numbers keep climbing.
The whole scheme runs on stolen Social Security numbers. A thief gets someone's SSN from a data breach, a phishing scam, or a crooked employee at a medical office. That nine-digit number is really all they need. With a Social Security number and basic biographical details scraped from public records, a criminal can slap together a tax return and file it before the real taxpayer even thinks about gathering their W-2s.
The fraudulent return typically claims a refund. Sometimes a modest one, sometimes wildly inflated with invented income and fake withholdings. The criminal directs that refund to a prepaid debit card or a bank account they control. Money hits the account, they drain it, and they move on to the next victim.
Legitimate taxpayers discover the problem when they sit down to file and the IRS rejects their return. The system already shows a filing under that Social Security number. Suddenly an ordinary person finds themselves tangled in a bureaucratic mess that, according to the Taxpayer Advocate Service, takes an average of nineteen months to sort out.
The Timing Gap That Criminals Love
Tax season opens in mid-January. Employers have until late March to submit wage information to the IRS. That window—roughly ten weeks—gives fraudsters room to operate. They file fast, grab refunds, and vanish before the IRS receives the data needed to verify anything. The agency has tightened its filters over the years, catching more suspicious returns before refunds go out, but criminals adapt just as quickly.
Stolen Data Comes From Everywhere
Data breaches at major corporations have dumped hundreds of millions of Social Security numbers onto black markets. Healthcare systems, retailers, credit bureaus, government agencies—the list of compromised organizations grows yearly. But high-tech hacking isn't the only source.
Phishing remains disturbingly effective. Emails and texts dressed up to look like official IRS communications trick people into handing over personal information. The messages warn about unpaid taxes or promise refunds, creating enough panic that recipients click links and enter sensitive data without thinking.
Children make attractive targets too. Their Social Security numbers sit unused for years. Criminals buy infant SSNs on dark web marketplaces and file fraudulent returns knowing nobody will notice until that child grows up and applies for student loans. Parents rarely check whether someone filed taxes using their eight-year-old's identity.
Business Identity Theft Happens Too
Fraudsters don't limit themselves to individual returns. Stealing or fabricating Employer Identification Numbers allows criminals to file business tax returns claiming substantial refunds. Business taxation runs complicated enough that these schemes sometimes escape detection longer than individual fraud cases.
Criminals behind business identity theft often create fictitious employees or inflate deductions to generate large refund claims. Some schemes involve filing amended returns for prior years, banking on the fact that businesses may not monitor correspondence about tax years they consider closed.
Social Media Scams Keep Evolving
A newer twist involves bad tax advice spreading across social media platforms. Influencers promote supposed loopholes or secret credits the IRS doesn't want people knowing about. Some schemes encourage filing for credits that don't exist or that the filer clearly doesn't qualify for—things like fuel tax credits claimed by people who don't own farms or commercial vehicles.
The IRS has cracked down hard on fraudulent claims, but viral misinformation spreads faster than corrections. Taxpayers who follow this advice face audits, penalties, and demands to repay refunds they never should have received.
The IRS Identity Protection PIN Makes a Real Difference
The IRS assigns something called an Identity Protection PIN to confirmed victims of tax-related identity theft. Once a case gets resolved, the agency automatically mails a CP01A notice each January containing a new six-digit IP PIN for that year. The number works like a password—when someone files a return using that Social Security number, the IRS checks whether the correct IP PIN accompanies it. Wrong number or missing number means the return gets rejected.
Criminals who have stolen a Social Security number cannot file successfully without also having the current year's IP PIN. The IRS generates fresh PINs annually, so even if a thief somehow obtained last year's number, it becomes worthless come January.
Taxpayers who haven't been victimized can also voluntarily opt into the program through their IRS online account. The protection works the same either way—anyone trying to file a fraudulent return hits a wall without that six-digit code.
Basic Precautions Matter
Filing early cuts off the window criminals rely on. A return already in the system blocks any subsequent filing attempt. Strong passwords on tax software accounts prevent unauthorized access. Shredding documents before throwing them away keeps dumpster divers empty-handed.
Any unsolicited contact claiming to come from the IRS deserves heavy skepticism. The agency sends letters through postal mail—not phone calls demanding immediate payment or emails requesting personal data.
Businesses need written security plans covering client data storage and protection. The IRS requires professional preparers to maintain these safeguards.
Victims Face a Long Road
Someone who discovers fraud on their account needs to file a paper return along with Form 14039, the Identity Theft Affidavit. The IRS assigns these cases to a specialized unit, but resolution takes time—often well over a year. Beyond the delayed refund, victims frequently discover broader identity compromise requiring credit freezes and ongoing monitoring.
Tax return fraud shows no signs of slowing down, unfortunately. Criminals keep refining their methods while stolen data circulates freely online. Protective steps taken now—especially the IP PIN program—keep taxpayers from becoming easy marks in a system where easy marks get hit first. Contact your CPA today to learn more about protecting your tax return.
by Kate Supino