Tax refund fraud starts long before a return is ever filed: a thief only needs a Social Security number and a few other identifying details to submit a fraudulent return in someone else’s name and claim the refund before the real taxpayer files. A free, six-digit code from the IRS closes that door almost entirely, yet the program remains widely underused among retirees who assume that protection is either automatic or unnecessary once they are no longer working.
What an Identity Protection PIN actually does
An Identity Protection PIN, or IP PIN, is a six-digit number known only to the taxpayer and the IRS, used to verify identity when filing a federal return, according to the IRS’s official IP PIN program page. Once enrolled, any electronically filed return must include the correct IP PIN or it will be automatically rejected, and any paper return without the correct code will be delayed while the IRS manually verifies the filer’s identity. That single requirement is what blocks the most common form of refund fraud, in which a criminal files first using a stolen Social Security number, before the legitimate taxpayer ever submits their own return.
Free retirement updates: Social Security and Medicare change every year, and nobody sends you a memo. Our free Retirement Shield newsletter breaks down what changed and what to do. Get it free in your inbox.
Who can get one, and why it matters for anyone retired
Anyone with a Social Security number or an individual taxpayer identification number who can verify their identity is eligible to enroll, the IRS page states — the program is no longer limited to confirmed identity-theft victims, as it once was. Retirees can be attractive targets for this specific fraud because they often file relatively simple, predictable returns built around Social Security and pension income, and because a refund claim tied to a retiree’s Social Security number can sit unnoticed longer if the retiree files later in the season or uses a paid preparer who does not immediately flag a rejection.
How to enroll, with or without an online account
The fastest enrollment path is the IRS’s Get an IP PIN tool, where a taxpayer completes an identity-verification check and the six-digit PIN appears on screen immediately, with no waiting period. For taxpayers who cannot verify their identity online, the IRS offers Form 15227 as an alternative — available to filers whose adjusted gross income on their last return was below $84,000 for individuals or $168,000 for married couples filing jointly — which triggers a phone-based identity check followed by a mailed PIN within four to six weeks, according to the IRS’s IP PIN FAQ page. Taxpayers who cannot use either path can instead schedule an in-person identity check at a local Taxpayer Assistance Center, bringing a government-issued photo ID and one additional form of identification; a parent or legal guardian can request an IP PIN for a dependent 18 or older or under 18 the same way, using two forms of the dependent’s own identification such as a birth certificate or Social Security card. The online enrollment tool also offers a choice most first-time users miss: continuous enrollment keeps the taxpayer in the program automatically every year, while one-time enrollment covers only the current calendar year and lapses on its own unless renewed. Someone who joined voluntarily and has never been a confirmed identity-theft victim can also leave the program later through the same online-account profile page, though the FAQ notes the change takes up to 72 hours to process before a return can be filed without the PIN — taxpayers who were automatically enrolled after a confirmed identity-theft case do not have that self-service option and stay in the program.
What separates the IP PIN from reporting a theft that already happened
The IP PIN is a prevention tool, and it should not be confused with the form the IRS uses to investigate a theft that has already occurred. Tax-related identity theft specifically means someone used a stolen Social Security number to file a fraudulent return and claim a refund, and the IRS’s own filters catch most of those attempts automatically — a taxpayer in that situation typically receives a letter (5071C, 4883C, or, after a data breach, 5747C) asking them to verify their identity, and the IRS is explicit that no Form 14039 is needed once one of those letters has arrived. Form 14039, the Identity Theft Affidavit, is reserved for taxpayers who suspect their Social Security number has been used fraudulently but have not received one of those letters — warning signs include an e-filed return rejected as a duplicate, a dependent’s Social Security number already claimed on someone else’s return, an unrequested tax transcript arriving in the mail, or an IRS notice about wages from an employer the taxpayer never worked for. Anyone who has already confirmed that kind of fraud, or who simply wants to close off the possibility before it happens, can request an IP PIN either way — but the IRS’s own guidance frames the affidavit and the PIN as two different tools for two different moments: one reports theft, the other prevents it.
The renewal step that trips people up every year
An IP PIN is valid for only one calendar year, and the IRS generates a new one automatically each January for everyone enrolled — meaning last year’s PIN will not work on a return filed this season. Taxpayers who enrolled online can retrieve the current year’s PIN by logging back into their IRS online account; those who were enrolled after a confirmed identity-theft case, rather than voluntarily, instead receive a mailed CP01A notice each year with the new code. The IRS is explicit that it will never call, email, or text asking for an IP PIN, and treats any such request as a scam attempt, since the agency already has the number on file and has no legitimate reason to ask a taxpayer to provide it.
Losing or misplacing the current year’s IP PIN does not require refiling Form 15227; the IRS instead offers a separate retrieval process through the online account or a reissue by mail, and using the wrong or an outdated PIN on a return produces the same rejection or delay as leaving it off entirely.
This article was researched and drafted with the assistance of AI and reviewed by The Financial Wire editorial team.
More Financial Reading
- Bank statements: how long to keep them and when to toss them
- Adding someone to your bank account: tax traps and smart moves
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
