The U.S. Internal Revenue Service (IRS) said this week that beginning in 2021 it will allow all taxpayers to apply for an identity protection personal identification number (IP PIN), a single-use code designed to block identity thieves from falsely claiming a tax refund in your name. Currently, IP PINs are issued only to those who fill out an ID theft affidavit, or to taxpayers who’ve experienced tax refund fraud in previous years.
Tax refund fraud is a perennial problem involving the use of identity information and often stolen or misdirected W-2 forms to electronically file an unauthorized tax return for the purposes of claiming a refund in the name of a taxpayer.
Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.
Many of the reasons why refund fraud remains a problem have to do with timing, and some of them are described in more detail here. But the short answer is the IRS is under tremendous pressure to issue refunds quickly and to minimize “false positives” (flagging legitimate claims as fraud) — even when it may not yet have all of the information needed to accurately distinguish phony filings from legitimate ones.
One way the IRS has sought to stem the flow of bogus tax refund applications is to issue the IP PIN, which is a six-digit number assigned to eligible taxpayers to help prevent the use of their Social Security number on a fraudulent income tax return. Each PIN is good only for the tax year for which it was issued.
But up until now, the IRS has restricted who can apply for an IP PIN, although it has over the past few years issued them proactively to some taxpayers as part of a multi-state experiment to determine if doing so more widely might reduce the overall incidence of refund fraud.
The IRS says it will make its Get IP PIN tool available to all taxpayers in mid-January. Until then, if you haven’t already done so you should plant your flag at the IRS by stepping through the agency’s “secure access authentication” process.
Creating an account requires supplying a great deal of personal data; the information that will be requested is listed here.
The signup process requires one to validate ownership of a mobile phone number in one’s name, and it will reject any voice-over-IP-based numbers such as those tied to Skype or Google Voice. If the process fails at this point, the site should offer to send an activation code via postal mail to your address on file.
From IRS
* You must pass a rigorous identity verification process.
* Spouses and dependents are eligible for an IP PIN if they can pass the identity proofing process.
How to get an IP PIN
If you’re a confirmed identity theft victim, we will mail you an IP PIN on a CP01A Notice if your case is resolved prior to the start of the next filing season.
If you’re volunteering for the IP PIN Opt-In Program you should use the online Get an IP PIN tool. If you don’t already have an account on IRS.gov, you must register to validate your identity. Before you register, read about the secure access identity authentication process. Note:
* An IP PIN is valid for one calendar year.
* You must obtain a new IP PIN each year.
* The IP PIN tool is generally unavailable mid-November through mid-January each year.
Excellent tips for the successful IP PIN process, specifically when it is unavailable.
I’ve seen some mention of people having trouble getting the site to validate their cell number. I had the same problem using an AT&T number that I’ve had for many years now. The solution for me was to enter the number the way that AT&T shows it when logging into their website, using [.] as the separator. S0 123-456-7890 would be entered as 123.456.7890. That has gotten me and others past that step.
Thanks for this. Wish I’d known. I ended up settling for the postal mail activation. Takes longer but I guess it’ll get done.
IRS site is crashing with errors. Probably can’t handle the volume of traffic. Crashes at different pages even with the same info.
Also, the “one-time use code” doesn’t change if you try several times to register. Super genius….
Interestingly, Firefox with privacy (adblock, etc) addons seemed to have caused this. Used a “bare” (no addons) Chrome and everything worked ok.
I noticed that as well. I think it only changes once per day…
A couple questions.
Is the IP PIN necessary if you use a commercial tax preparer (e.g., H&R Block) to file your returns?
Will the system accept overseas mobile phone numbers if you’re a US taxpayer living abroad.
My husband has started the process for planting his IRS flag. He’s the top name on the tax forms so that made sense. Is there any point (or is it indeed possible?) in me also getting an ID?
Thanks, Brian, for this and for all you do. You’re much braver than I.
Mary,
Yes, even as the second SSN on a joint return, you want to have an ID pin. Until your joint return is accepted, a bad actor could file under your SSN.
The IRS says it will make its Get IP PIN tool available to all taxpayers in mid-January.
That assertion is not true if one lives outside the USA.
Non-residents cannot even register for online access to submit their tax returns or access their own tax records. It’s impossible because one needs a US cellphone to receive an SMS as part of the registration process. Many (most?) citizens who reside overseas will not have a US cellphone.
A more elegant solution to this problem is adjusting your withholding to make your refund as small as possible.
“There are things we don’t know we don’t know.”
Donald Rumsfeld
The scammer doesn’t care about the size of your refund or even if you file your taxes. The scammer uses your personal information to file for a refund. That’s it. There’s nothing elegant about any of it.
If you’re not owed a refund, then it’s the government’s problem. Just send a paper return and let them sort it out.
Spent 20 minutes figuring out why my passwords kept getting rejected. Turns out that not only does ‘-‘ not only not count as a special character (which is fine, it is not listed as one), but any password with a ‘-‘ will get rejected
Brian,
Thanks for the actionable article. My experience may be worthwhile to others. The IRS process starts with normal things and asks if you have or have not filed a tax return in the last seven years. If so, enter the EXACT address. (This was out of date for me, with no option to enter a new address) The process failed when my mobile number was unable to be verified.
The failure was due to the mobile phone account address not matching the last tax filing address. Even looking at a work around, I’m prevented from access through the normal channels (requesting a letter) because it would be sent to a 7 year old address.
My only recourse is to call them to negotiate, settle in for a hour plus hold time and hope for the best.
In conclusion, I did order my report from the National Consumers Telecom and Utilities Exchange, and am interested in the outcome.
You should take part in a contest for one of the finest blogs on the web.
I will recommend this site!
I created an IRS account on December 6 and selected the option to get my PIN via snail mail (my phone is not in my name). Here is is, 12/21, and still no PIN in the mail. I take it this is par for the course with the IRS.