IRS Scams and the IRS Identity Protection PIN Explained

Tax season is prime time for criminals. They send fake IRS texts, leave threatening voicemails and file false tax returns using stolen Social Security numbers. Some of the tricks are obvious. Others look very official.

This guide explains how the Internal Revenue Service (IRS) says it contacts taxpayers, how to spot and report an impersonator, and how an Identity Protection PIN (IP PIN) can stop someone from filing a return in your name. Everything here is based on IRS guidance, and tax rules can change, so confirm details on IRS.gov for your situation.

How the IRS Says It Contacts You

According to the IRS, the first contact is normally a letter or notice sent by mail. The agency says it does not:

• send unexpected or unsolicited text messages;
• start contact by email, text message or social media;
• send messages asking for personal or financial information, especially about a tax refund.

The IRS may call after it has mailed a notice, for example to confirm an appointment or discuss a scheduled audit. It says it does not leave pre-recorded, urgent or threatening messages, and does not demand that you call back or face a warrant for your arrest. It also says neither the IRS nor its authorized private collection agencies will ask you to pay with prepaid cards or gift cards.

Common IRS Scam Patterns

The IRS lists several warning signs. A call, email, text or letter could be a scam if it is unexpected, rushes or threatens you, offers refunds, credits or deductions, asks for personal or financial information, or tells you to pay now or else. Specific tricks include:

• Phishing emails and texts that point to fake websites posing as IRS tools. The IRS says all its links go to irs.gov, so watch for near-matches and unusual addresses.
• Fake social media accounts that contact people about a bill, grant or refund. The IRS says it does not send direct messages on social media.
• Threats of arrest or deportation and refusal to let you question or appeal the amount.
• Bad tax advice on social media that encourages people to claim credits they do not qualify for. The IRS warns that such advice can mislead you about credits and refunds.
• Fake letters in the mail. The IRS has warned about fraudulent letters that send people to a website imitating IRS.gov. If in doubt, do not use QR codes or links in a letter you did not expect.
• Scams aimed at older adults, in which callers pose as the IRS, Social Security or Medicare and ask for payment by wire transfer, gift cards or cryptocurrency.

What to Do With a Suspicious Message

The IRS lists where to report fake IRS, Treasury or tax-related emails and messages. Fake IRS texts follow the same pattern as other fake text messages and delivery scams.

Emails

The IRS says not to reply, click links or open attachments. Send the message to phishing@irs.gov with the subject line "IRS", following the IRS instructions for attaching the original email so its header details are preserved, and then delete it. The IRS also directs people to report to the Treasury Inspector General for Tax Administration (TIGTA).

Text messages

Do not reply, click links or open attachments. The IRS asks you to send the sender's number, the message contents, your own number and the date, time and time zone to phishing@irs.gov with the subject line "Text", and then delete the original. You can also forward the text to 7726 (SPAM) to help your wireless provider spot similar messages, and report it to the FTC.

Calls

Record the number, hang up, and report it to TIGTA. The IRS lists 800-366-4484 for the TIGTA hotline. To check whether a real notice is genuine, use the IRS online account or the IRS website for common letters, or contact IRS customer service using details from IRS.gov, not from the message.

What an IP PIN Is

An Identity Protection PIN is a six-digit number that helps prevent someone else from filing a tax return using your Social Security number (SSN) or individual taxpayer identification number (ITIN). The IRS says it is known only to you and the IRS and helps verify your identity when you file, electronically or on paper. The IRS explains how to get an Identity Protection PIN on IRS.gov.

The IRS says anyone with an SSN or ITIN who can verify their identity can enroll, even if not required to file a return, and that parents and guardians can request one for dependents. Your online account is the fastest route.

How to Get an IP PIN

1. Use your IRS online account. Go to IRS.gov yourself, sign in or register (registration includes identity verification), and request the IP PIN in the IP PIN section of your profile.
2. If you cannot verify online, the IRS describes alternatives that take longer. Taxpayers under certain income thresholds can file Form 15227 online and receive a phone call to verify identity, with the PIN arriving by mail. Others can make an appointment at a Taxpayer Assistance Center and bring identification. Check the IRS page for current requirements.
3. Note the under-18 rule. The IRS says anyone under 18 requesting a PIN must use one of the alternative enrollment options instead of the online route.

How to Use and Protect Your IP PIN

• The IP PIN is valid for one calendar year and a new one is generated each year. The IRS says it is generally viewable in your online account starting in mid-January through mid-November.
• Enter the six digits when your tax software asks, or give it to your trusted tax professional when you are ready to sign and submit. It is used on returns such as Form 1040.
• A missing or incorrect IP PIN causes an e-filed return to be rejected or a paper return to be delayed until verified.
• Do not reveal it to anyone else. The IRS states that it will never ask for your IP PIN, and that any call, email or text asking for it is a scam.
• If you lose it, use the IRS page on lost or missing IP PINs. The IRS specifically says not to file Form 15227 for a replacement.

Store the PIN in your password manager, protected by a strong master password and two-factor authentication, instead of a photo or an email to yourself.

If You Think Someone Filed in Your Name

Signs can include an e-filed return rejected because one was already filed, or an IRS letter about income or a return you did not submit. The IRS says most people do not need to file Form 14039 (Identity Theft Affidavit). Do not file it if the IRS already sent you a letter or notice, if you already filed it through IdentityTheft.gov, if you use the IRS Identity and Tax Return Verification Service, or if the identity theft is not tax-related. Do file it if the IRS tells you to, if you cannot use that verification service, or if you want to tell the IRS about possible tax-related identity theft it does not have on file, for example after a data breach. Start at the IRS identity theft guide on IRS.gov, follow any IRS letter promptly, and also report at IdentityTheft.gov. Our guides on credit freezes and identity theft recovery explain the wider steps.

Frequently Asked Questions

Does the IRS ever send texts?

The IRS says it sends texts only with your permission. Unsolicited texts are a red flag.

What if a tax preparer asks for my IP PIN?

The IRS says it should be known only to your tax professional, and only when you are ready to sign and submit your return. Give it to your own preparer for filing, never to a caller or a message.

Can I pay the IRS with gift cards?

No. The IRS says neither it nor its authorized collection agencies will ask for payment with prepaid or gift cards. Its payments page lists the legitimate ways to pay.

Can children get an IP PIN?

Parents and guardians can request one for dependents, using one of the alternative enrollment options for anyone under 18.

Will an IP PIN stop every scam?

No. It is aimed at fraudulent returns filed with your SSN or ITIN. It does not stop phishing, scams or fraud in other areas.

Related Guides

• Zelle, Venmo and Cash App Scams: What to Do If You Paid
• Identity Theft Recovery Steps: What to Do First
• Credit Freeze vs. Fraud Alert: How to Lock Your Credit

Conclusion

The best defense against tax scams is knowing how the IRS actually works. It starts with a mailed notice, does not threaten arrest, and does not demand gift cards. Report imposters to phishing@irs.gov and TIGTA, and get an IP PIN to protect your SSN from fraudulent filings. Keep the PIN private, reuse nothing, and verify anything doubtful directly through IRS.gov.

Tax season is prime time for criminals. They send fake IRS texts, leave threatening voicemails and file false tax returns using stolen Social Security numbers. Some of the tricks are obvious. Others look very official.

This guide explains how the Internal Revenue Service (IRS) says it contacts taxpayers, how to spot and report an impersonator, and how an Identity Protection PIN (IP PIN) can stop someone from filing a return in your name. Everything here is based on IRS guidance, and tax rules can change, so confirm details on IRS.gov for your situation.

How the IRS Says It Contacts You

According to the IRS, the first contact is normally a letter or notice sent by mail. The agency says it does not:

• send unexpected or unsolicited text messages;
• start contact by email, text message or social media;
• send messages asking for personal or financial information, especially about a tax refund.

The IRS may call after it has mailed a notice, for example to confirm an appointment or discuss a scheduled audit. It says it does not leave pre-recorded, urgent or threatening messages, and does not demand that you call back or face a warrant for your arrest. It also says neither the IRS nor its authorized private collection agencies will ask you to pay with prepaid cards or gift cards.

Common IRS Scam Patterns

The IRS lists several warning signs. A call, email, text or letter could be a scam if it is unexpected, rushes or threatens you, offers refunds, credits or deductions, asks for personal or financial information, or tells you to pay now or else. Specific tricks include:

• Phishing emails and texts that point to fake websites posing as IRS tools. The IRS says all its links go to irs.gov, so watch for near-matches and unusual addresses.
• Fake social media accounts that contact people about a bill, grant or refund. The IRS says it does not send direct messages on social media.
• Threats of arrest or deportation and refusal to let you question or appeal the amount.
• Bad tax advice on social media that encourages people to claim credits they do not qualify for. The IRS warns that such advice can mislead you about credits and refunds.
• Fake letters in the mail. The IRS has warned about fraudulent letters that send people to a website imitating IRS.gov. If in doubt, do not use QR codes or links in a letter you did not expect.
• Scams aimed at older adults, in which callers pose as the IRS, Social Security or Medicare and ask for payment by wire transfer, gift cards or cryptocurrency.

What to Do With a Suspicious Message

The IRS lists where to report fake IRS, Treasury or tax-related emails and messages. Fake IRS texts follow the same pattern as other fake text messages and delivery scams.

Emails

The IRS says not to reply, click links or open attachments. Send the message to phishing@irs.gov with the subject line "IRS", following the IRS instructions for attaching the original email so its header details are preserved, and then delete it. The IRS also directs people to report to the Treasury Inspector General for Tax Administration (TIGTA).

Text messages

Do not reply, click links or open attachments. The IRS asks you to send the sender's number, the message contents, your own number and the date, time and time zone to phishing@irs.gov with the subject line "Text", and then delete the original. You can also forward the text to 7726 (SPAM) to help your wireless provider spot similar messages, and report it to the FTC.

Calls

Record the number, hang up, and report it to TIGTA. The IRS lists 800-366-4484 for the TIGTA hotline. To check whether a real notice is genuine, use the IRS online account or the IRS website for common letters, or contact IRS customer service using details from IRS.gov, not from the message.

What an IP PIN Is

An Identity Protection PIN is a six-digit number that helps prevent someone else from filing a tax return using your Social Security number (SSN) or individual taxpayer identification number (ITIN). The IRS says it is known only to you and the IRS and helps verify your identity when you file, electronically or on paper. The IRS explains how to get an Identity Protection PIN on IRS.gov.

The IRS says anyone with an SSN or ITIN who can verify their identity can enroll, even if not required to file a return, and that parents and guardians can request one for dependents. Your online account is the fastest route.

How to Get an IP PIN

1. Use your IRS online account. Go to IRS.gov yourself, sign in or register (registration includes identity verification), and request the IP PIN in the IP PIN section of your profile.
2. If you cannot verify online, the IRS describes alternatives that take longer. Taxpayers under certain income thresholds can file Form 15227 online and receive a phone call to verify identity, with the PIN arriving by mail. Others can make an appointment at a Taxpayer Assistance Center and bring identification. Check the IRS page for current requirements.
3. Note the under-18 rule. The IRS says anyone under 18 requesting a PIN must use one of the alternative enrollment options instead of the online route.

How to Use and Protect Your IP PIN

• The IP PIN is valid for one calendar year and a new one is generated each year. The IRS says it is generally viewable in your online account starting in mid-January through mid-November.
• Enter the six digits when your tax software asks, or give it to your trusted tax professional when you are ready to sign and submit. It is used on returns such as Form 1040.
• A missing or incorrect IP PIN causes an e-filed return to be rejected or a paper return to be delayed until verified.
• Do not reveal it to anyone else. The IRS states that it will never ask for your IP PIN, and that any call, email or text asking for it is a scam.
• If you lose it, use the IRS page on lost or missing IP PINs. The IRS specifically says not to file Form 15227 for a replacement.

Store the PIN in your password manager, protected by a strong master password and two-factor authentication, instead of a photo or an email to yourself.

If You Think Someone Filed in Your Name

Signs can include an e-filed return rejected because one was already filed, or an IRS letter about income or a return you did not submit. The IRS says most people do not need to file Form 14039 (Identity Theft Affidavit). Do not file it if the IRS already sent you a letter or notice, if you already filed it through IdentityTheft.gov, if you use the IRS Identity and Tax Return Verification Service, or if the identity theft is not tax-related. Do file it if the IRS tells you to, if you cannot use that verification service, or if you want to tell the IRS about possible tax-related identity theft it does not have on file, for example after a data breach. Start at the IRS identity theft guide on IRS.gov, follow any IRS letter promptly, and also report at IdentityTheft.gov. Our guides on credit freezes and identity theft recovery explain the wider steps.

Frequently Asked Questions

Does the IRS ever send texts?

The IRS says it sends texts only with your permission. Unsolicited texts are a red flag.

What if a tax preparer asks for my IP PIN?

The IRS says it should be known only to your tax professional, and only when you are ready to sign and submit your return. Give it to your own preparer for filing, never to a caller or a message.

Can I pay the IRS with gift cards?

No. The IRS says neither it nor its authorized collection agencies will ask for payment with prepaid or gift cards. Its payments page lists the legitimate ways to pay.

Can children get an IP PIN?

Parents and guardians can request one for dependents, using one of the alternative enrollment options for anyone under 18.

Will an IP PIN stop every scam?

No. It is aimed at fraudulent returns filed with your SSN or ITIN. It does not stop phishing, scams or fraud in other areas.

Related Guides

• Zelle, Venmo and Cash App Scams: What to Do If You Paid
• Identity Theft Recovery Steps: What to Do First
• Credit Freeze vs. Fraud Alert: How to Lock Your Credit

Conclusion

The best defense against tax scams is knowing how the IRS actually works. It starts with a mailed notice, does not threaten arrest, and does not demand gift cards. Report imposters to phishing@irs.gov and TIGTA, and get an IP PIN to protect your SSN from fraudulent filings. Keep the PIN private, reuse nothing, and verify anything doubtful directly through IRS.gov.