Every January, criminals race to file fraudulent tax returns before real taxpayers do. Their weapon is stolen personal data, often purchased in bulk from dark-web marketplaces that sell Social Security numbers alongside names, dates of birth, and W-2 details. The Treasury Inspector General for Tax Administration has documented billions of dollars in fraudulent refunds flowing out of the IRS in recent years, and the agency’s own fraud filters, while improved, still catch many bogus filings only after they have entered the pipeline.
But there is a tool that stops a fraudulent return before it is even processed, and most taxpayers still do not know it exists.
The Identity Protection PIN, or IP PIN, is a free six-digit code the IRS assigns to any individual who requests one. When you include that code on your federal return, the IRS validates it before accepting the filing. No correct PIN, no processing. A thief who has your Social Security number but lacks your PIN gets a rejection notice instead of your refund.
Since January 2021, the program has been open to every filer with a Social Security number or Individual Taxpayer Identification Number. Before that expansion, only confirmed identity-theft victims could enroll. That means all of the roughly 160 million people who file individual federal returns each year, according to IRS filing-season statistics, can now opt in voluntarily.
How to get an IP PIN (the actual steps)
The fastest route takes about five minutes through the IRS online IP PIN tool. Here is what the process looks like as of the 2026 filing season:
- Create or sign in to your IRS Online Account. You will verify your identity through ID.me or an existing IRS credential. Have a government-issued photo ID and a phone or computer with a camera ready.
- Request your IP PIN. Once verified, the tool generates a unique six-digit number on screen. Write it down or store it in a password manager immediately.
- Enter the PIN on every federal return you file. Your tax software will prompt you for it, or your preparer will ask. The PIN goes on Form 1040 (or the relevant variant) in the designated field near the signature section.
Filers who cannot complete online identity verification have two alternatives:
- In person: Visit a Taxpayer Assistance Center with a photo ID and one additional identification document such as a passport or birth certificate. Staff will verify your identity on site and issue the PIN.
- By mail: Taxpayers with adjusted gross income of $79,000 or less can submit Form 15227 and verify by phone. The PIN then arrives by postal mail, so expect this path to take several weeks.
One detail that trips people up: the PIN changes every calendar year. The IRS automatically generates a new one before each filing season and makes it available through your online account, typically by mid-January. If you enrolled by mail or in person, the new PIN arrives in a CP01A notice, usually in December or January. Losing that notice means calling the IRS or visiting a Taxpayer Assistance Center, which during peak season can mean significant wait times.
Why the IRS and its independent advisors push this tool so hard
The Electronic Tax Administration Advisory Committee, an independent panel that advises the IRS on electronic filing and security, has called the IP PIN the “number one security tool” available to individual taxpayers. That assessment appeared in ETAAC’s annual report to Congress, which evaluates the full range of IRS authentication and fraud-prevention options before issuing formal recommendations.
The IRS itself has been unusually direct. Its public guidance urges all taxpayers to enroll as a preventive measure, not just those who have already been victimized. The reasoning is simple: a PIN validated at the point of filing creates a barrier that stolen personal data alone cannot clear.
That distinction matters. Most IRS fraud defenses operate on the back end, flagging suspicious returns after they have already entered the processing queue. The IP PIN works at the front gate. A return submitted electronically without the correct code is rejected outright. A paper return missing the PIN triggers additional screening that delays processing by weeks or months. Either way, the fraudulent filing does not sail through.
What the IP PIN does not protect against
The program guards against one specific threat: someone filing a fraudulent federal income tax return using your Social Security number or ITIN. It does not cover:
- State tax returns. Most states run separate filing systems. A handful have their own identity-protection programs, but the federal IP PIN applies only to returns filed with the IRS.
- Credit fraud. A thief who opens a credit card or loan in your name is committing a different category of identity theft. The IP PIN has no bearing on credit applications.
- Employment fraud. If someone uses your SSN to get a job, the resulting wage reports can trigger IRS notices and complicate your own filing, but the IP PIN does not prevent the initial misuse of your number by an employer.
Taxpayers who enroll should still freeze their credit with Equifax, Experian, and TransUnion, monitor their reports through AnnualCreditReport.com, and use strong, unique passwords on financial accounts. The IP PIN is one layer of defense, not a complete shield.
Common concerns and what to expect
“What if I lose my PIN?” If you enrolled online, log back into the IRS IP PIN tool. The system displays your current-year PIN on screen. If you enrolled by mail and lost the CP01A notice, you will need to call the IRS or visit a Taxpayer Assistance Center. During filing season, that can mean long hold times, so retrieving it early is worth the effort.
“Can my tax preparer handle this?” Yes. Share the PIN with your preparer or enter it yourself if you use consumer tax software. The preparer includes it on the return before submission. Do not share it with anyone who is not authorized to file on your behalf, and be wary of anyone who asks for it by phone, email, or text. The IRS will never initiate contact to request your IP PIN.
“Should I get one for my kids?” Dependents are a frequent target for identity thieves precisely because children rarely file returns, so fraud can go undetected for years. The IRS allows parents and guardians to obtain IP PINs for dependents claimed on their returns. Each dependent’s PIN must be included when that person is listed on the filer’s return. Given that a child’s stolen SSN can circulate for a decade before anyone notices, this is one of the more underused features of the program.
“Can I opt out once I enroll?” Once you receive an IP PIN for a given tax year, you must use it on that year’s return. The IRS does not currently offer a formal opt-out mechanism. However, if you simply do not retrieve a new PIN the following year, the system may not generate one automatically for online enrollees. The safest approach is to treat enrollment as an ongoing commitment.
“Does it work with amended returns or extensions?” Yes. Any federal return filed under your SSN or ITIN, including amended returns on Form 1040-X, requires the current-year IP PIN. Filing an extension (Form 4868) does not require the PIN because it is not a tax return, but the actual return filed later will.
A transparency gap worth noting
For all the IRS’s encouragement, the agency has not published detailed statistics on how many taxpayers have enrolled, how enrollment has grown year over year, or how many fraudulent returns the IP PIN has intercepted. That absence makes it difficult to measure the program’s real-world impact at scale. Both TIGTA and the Government Accountability Office have examined IRS identity-theft programs broadly, but granular IP PIN performance data remains internal as of June 2026.
The lack of public metrics does not undermine the program’s design. The mechanism is documented in the Internal Revenue Manual: a return cannot clear processing without the correct code. But taxpayers and researchers who want hard evidence of how many filings the PIN has actually blocked will not find it in any public IRS report.
Five minutes now or months of cleanup later
Resolving tax-related identity theft after the fact is notoriously slow. The National Taxpayer Advocate has repeatedly flagged resolution times as unacceptably long in annual reports to Congress, with many cases stretching well beyond a year. During that period, legitimate refunds are frozen, and victims must navigate IRS identity-verification procedures that rely on paper correspondence and phone lines with hold times that can exceed an hour.
The IP PIN does not eliminate every risk, and the IRS could do far more to publicize the program and release the performance data that would let outside analysts evaluate it. But the tool is free, it is backed by the agency that processes every federal return, and it is endorsed by the independent committee that evaluates IRS security options. For any taxpayer who files a federal return, spending five minutes on enrollment is one of the simplest steps available to keep someone else from collecting a refund in your name.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
