Why Tax Season Is Prime Time for Identity Theft
1 Jul 2026 · 4 min read · Comments
Tax season is the one time of year when nearly every American sends their full identity details — SSN, employer, income, bank account — through digital systems. Criminals plan their entire year around it.
Why Tax Season Is Open Season
Between January and April, the IRS processes hundreds of millions of returns. Criminals know this. Tax season is the one time of year when nearly every American sends their full name, Social Security number, employer, income, and bank account details through digital systems — and criminals have built an entire parallel industry around intercepting it.
According to the IRS, tax-related identity theft is consistently one of the most common forms of identity fraud reported in the United States. In 2023, the IRS flagged over a million suspicious returns before they were processed.
The Two Main Attacks
1. Filing a return in your name before you do. If a criminal has your SSN (bought from a data breach), they can file a fraudulent return early in the season claiming a large refund. Your real return gets rejected when you file because the IRS already received one with your SSN. Resolving this takes months.
2. W-2 phishing targeting employers. Criminals send spoofed emails to HR or payroll staff, impersonating the CEO or a senior executive, requesting all employee W-2 forms "urgently." If the employee complies, hundreds or thousands of SSNs go to criminals in a single email.
File Early
The most effective individual defence is to file your return as early as possible — ideally as soon as your W-2 and other tax documents arrive in late January. A fraudulent return can only be filed in your name once. If you file first, the criminal's attempt will be rejected. If they file first, yours will be.
Get an IRS Identity Protection PIN
The IRS offers a free Identity Protection PIN (IP PIN) — a six-digit number known only to you and the IRS. When you include it on your return, the IRS won't accept any return with your SSN that doesn't include that PIN. It's the closest thing to a credit freeze for your tax identity.
Apply at irs.gov/identity-protection-pin. You'll need to verify your identity online. Once enrolled, you receive a new PIN each January. Keep it safe — without it, filing your return becomes more complicated.
Tax Scam Calls and Emails
The IRS does not:
- Call you demanding immediate payment
- Email you requesting personal information
- Threaten arrest or deportation for unpaid taxes
- Ask for payment via gift cards or wire transfer
- Demand you pay without the opportunity to question or appeal
All IRS correspondence begins with a letter by mail. If someone contacts you by phone or email claiming to be the IRS, it's a scam.
If You're Already a Victim
If your return is rejected because one was already filed, or if you receive a notice about income you didn't earn: complete IRS Form 14039 (Identity Theft Affidavit), file a police report, report to the FTC at identitytheft.gov, and contact the three credit bureaus to freeze your credit. Expect the resolution process to take 6-18 months.
Early filing + an IRS IP PIN closes most of the individual risk. The data broker angle — your SSN and address circulating in databases that feed criminal operations — is a separate layer worth addressing before next tax season.
