Tax Identity Theft: What It Is and How It Is Reported

Last updated October 7, 2026 · 1,488 words · Identity Theft

Tax identity theft is the use of another person's Social Security number to file a tax return or claim a refund that is not owed. It is reported to the IRS on Form 14039 and to the Federal Trade Commission through IdentityTheft.gov, and it often leaves no trace on a credit report.

This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.

Key takeaways

Tax identity theft is the use of a taxpayer identification number, usually a Social Security number, to file a false return, claim a refund, or obtain employment.
Reporting runs on two tracks: an FTC report at IdentityTheft.gov and IRS Form 14039, the Identity Theft Affidavit.
A fraudulent tax return usually leaves no entry on a credit report, because no credit account is opened and no inquiry is recorded.
An initial fraud alert lasts 1 year and an extended fraud alert lasts 7 years; a security freeze is free to place, temporarily lift, or remove under federal law.
The FCRA gives consumers a free credit report from each nationwide agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com.

Tax identity theft is a form of identity theft in which someone uses another person's Social Security number to file a tax return and claim a refund that is not owed to them. It is handled differently from credit-account fraud, because the record at the center of the event is a federal tax account rather than a credit file. The Internal Revenue Service operates a dedicated identity theft program, and an affected taxpayer can report the event to the IRS on Form 14039 and to the Federal Trade Commission through IdentityTheft.gov.

What tax identity theft is

The core of the offense is the misuse of a taxpayer identification number, usually a Social Security number and in some cases an Individual Taxpayer Identification Number, to impersonate someone in a filing with the IRS. The person committing the fraud generally has the victim's name, number, and date of birth, and may also hold prior-year return details. Two broad patterns appear in these cases.

Refund fraud. A fraudulent return is filed early in the filing season, claiming a refund and directing it to an address or account the filer controls. The real taxpayer usually learns about it later, when an electronically filed return is rejected as a duplicate or when an IRS notice arrives.
Employment-related misuse. Someone uses the number to obtain work rather than to claim a refund. Nothing is visible at first, and the pattern often surfaces when the IRS matches wage records to a return and finds income the taxpayer never earned.

The IRS describes both patterns, along with the notices it issues, on its Identity Theft Central pages. The broader category of identity theft, including account takeover and new-account fraud, is covered in the site's identity theft hub.

How the IRS screens returns and flags an account

Returns are screened before refunds are released. When two returns arrive with the same taxpayer identification number, the duplicate generally stops the second one and the account is flagged. From there the IRS may ask the filer to verify identity online, by telephone, or by mail, and it may request a police report or a completed Form 14039 as part of the record.

The steps and their order depend on when each return was filed and on what the account records show, so a single fixed sequence does not apply to every case. The IRS publishes the process it follows, and the notices involved, on Identity Theft Central rather than committing to one universal schedule.

Why tax identity theft can be invisible on a credit report

A fraudulent tax return does not by itself create a credit account. No lender is involved, no inquiry is recorded, and no balance appears on a file held by Equifax, Experian, or TransUnion. That is the central difference between tax-related identity theft and new-account fraud, and it is why a credit report review alone may not surface a tax problem.

Situation	Record mainly affected	Typical visible trace
Fraudulent refund return	Federal tax account	IRS notice or a rejected electronic return; usually nothing on a credit report
Employment-related misuse of a number	Payroll and tax records	IRS notice about unreported income; sometimes no trace at all
New credit account opened in a consumer's name	Credit file at Equifax, Experian, or TransUnion	Hard inquiry and a new account on the credit report

Reading a credit file accurately means knowing what belongs there. The site's guide to credit reports explains what each section contains, and credit check covers how consumers review their own files.

How tax identity theft is reported

Reporting runs on two parallel tracks: a consumer protection track handled by the Federal Trade Commission, and a tax administration track handled by the IRS.

IdentityTheft.gov. A report filed at IdentityTheft.gov collects the details of the event, produces a recovery plan, and, once the details are complete, an Identity Theft Report that institutions accept as documentation of the event.
IRS Form 14039. The Identity Theft Affidavit tells the IRS that a return has been or may be filed using someone else's identity. The form and its filing conditions are published at IRS.
Responses to IRS notices. Notices about a duplicate return, a refund, or unreported income generally carry a reference number and a stated response channel, and the account record is updated through that channel.
Credit reporting agencies, when credit was also affected. If an account was opened as well, Equifax, Experian, and TransUnion each accept fraud alerts and security freezes. The site's credit freeze page explains how those tools work.
Documentation. The FTC process and the IRS process both rely on records: the Identity Theft Report, IRS notices, copies of returns, and notes on dates and names of anyone contacted.

What Form 14039 does

Form 14039 is the affidavit the IRS uses to document that a tax account has been affected. It asks for identifying details, a description of what happened, and often supporting documents such as a police report or a copy of the notice received. The IRS notes that the form can accompany a paper return when an electronic return has been rejected as a duplicate, and that in some situations the agency asks that the form not be filed because the account is already flagged. Those conditions are set out on the IRS's Form 14039 page.

Filing the affidavit does not by itself resolve a tax account, and it does not replace a police report where one exists. It is one part of a record that the IRS, and sometimes other institutions, review together.

Fraud alerts, security freezes, and credit files

Where credit activity is also involved, the Fair Credit Reporting Act provides specific tools. Section 605A of the FCRA, at 15 U.S.C. section 1681c-1, covers fraud alerts; section 605B, at 15 U.S.C. section 1681c-2, covers the blocking of information that resulted from identity theft when a consumer submits an identity theft report.

Tool	What it does	Duration under federal law
Initial fraud alert	Signals to creditors that identity verification is expected before new credit is opened	1 year
Extended fraud alert	Longer alert that generally requires an identity theft report	7 years
Security freeze	Restricts access to the credit file for most credit decisions	Free to place, temporarily lift, or remove

A freeze and an alert are separate tools with different effects, and a freeze does not appear on a credit report as an account or an inquiry. Monitoring services watch for changes to a file over time; the site's credit monitoring page describes what those services typically track and what they do not.

How credit reports and scores treat the aftermath

Most credit scores, including FICO and VantageScore, use a range of 300 to 850. FICO publishes approximate factor weights: payment history about 35%, amounts owed about 30%, length of credit history about 15%, new credit about 10%, and credit mix about 10%. VantageScore uses its own weighting and does not publish fixed percentages. A tax identity theft event is not one of those factors, because tax filings are not reported to credit bureaus.

What can matter is downstream activity. If a fraudulent account was opened, its payment record, balance, and inquiry appear like any other credit activity. Hard inquiries typically remain on a credit report for 2 years. Most negative information, including late payments, stays for 7 years; a Chapter 7 bankruptcy stays for 10 years and a Chapter 13 bankruptcy for 7 years. The mechanics of scoring are set out in the guides to how credit scores are calculated and FICO versus VantageScore, and the site's credit score hub collects the related material.

Under the FCRA, enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003, consumers have the right to a free credit report from each nationwide agency every 12 months; the three agencies currently provide free reports weekly through AnnualCreditReport.com. A credit reporting agency generally must investigate a dispute within 30 days, and that period can extend to 45 days if the consumer provides additional information during the initial 30-day window. The Consumer Financial Protection Bureau, created by the Dodd-Frank Act in 2010 and operating since 2011, supervises consumer financial markets and accepts complaints about credit reporting.

Records that support the process

Both the FTC process and the IRS process depend on documentation. Useful records include the Identity Theft Report from IdentityTheft.gov, a police report where one was filed, IRS notices and the account reference numbers they carry, copies of the returns actually filed, and a dated log of contacts with agencies, creditors, and the IRS. Keeping these together means the same set of records can be reused if a second institution asks for proof of the event.

Tax identity theft usually surfaces through a tax notice or a rejected return rather than through a credit file, and it is documented on Form 14039 and at IdentityTheft.gov. This page is published for education only and is not financial advice.

Compare three-bureau credit scores and reports from a single place. Educational links, disclosed below.

Three Bureau Credit Scores and Reports

CreditMonitored.com may earn a commission from partner links at no additional cost to you.

Frequently asked questions

What is tax identity theft?

It is the use of someone else's taxpayer identification number, usually a Social Security number, to file a tax return, claim a refund, or obtain employment. The IRS handles these cases through its identity theft program, and the event is documented on Form 14039 and reported at IdentityTheft.gov.

How does a person find out that a tax return was filed in their name?

Two common signals are an electronically filed return rejected as a duplicate and an IRS notice about a return, a refund, or unreported income that the taxpayer does not recognize. Because no credit account is opened, a credit report often shows nothing.

What is Form 14039 used for?

Form 14039, the Identity Theft Affidavit, documents for the IRS that a return has been or may be filed using another person's identity. The IRS publishes the form, the situations in which it is filed, and the situations in which the agency asks that it not be filed.

Does tax identity theft appear on a credit report?

Not by itself. A fraudulent tax return creates no account and no inquiry, so it generally leaves no entry on a file held by Equifax, Experian, or TransUnion. If a fraudulent credit account was also opened, that account and its hard inquiry, which typically remains for 2 years, can appear.

How long do fraud alerts last?

An initial fraud alert lasts 1 year. An extended fraud alert lasts 7 years and generally requires an identity theft report. A security freeze is a separate tool and is free to place, temporarily lift, or remove under federal law.

Where is tax identity theft reported?

To the Federal Trade Commission at IdentityTheft.gov, and to the IRS on Form 14039. The IRS also processes responses to its own notices about the affected tax account.