A breach notice says your name, date of birth, and Social Security number were exposed. There is no sign of misuse yet, and you want to make sure no one can file a tax return as you next spring.
Why the IP PIN is the strongest move against tax fraud
Tax-related identity theft works because the IRS generally processes the first return it receives for a given Social Security number and pays the refund before it can cross-check every employer wage report. A criminal who has your name, date of birth, and SSN — exactly the combination most breach notices describe — can file early in the season, claim a refund, and have it sent to their own account or address. You find out when your own e-filed return is rejected as a duplicate, and untangling it can take months.
The Identity Protection PIN closes that door. It is a six-digit number known only to you and the IRS, and once you are enrolled, any federal return filed under your SSN without the current year’s PIN is rejected. A stolen SSN is no longer enough on its own. Unlike a credit freeze, which you may want to lift periodically, an IP PIN protects a channel you use once a year and otherwise leave alone, so there is little downside to having one.
The program used to be limited to confirmed victims. It is now open to anyone with a Social Security number or an Individual Taxpayer Identification Number who can verify their identity, which is why enrolling proactively after a breach makes sense.
Who in your household can get one
Each person listed on a return who has their own SSN or ITIN can obtain their own IP PIN. On a joint return, if both spouses have enrolled, both PINs go on the return. If only one spouse has one, only that PIN is entered.
Parents and legal guardians can request an IP PIN for a dependent. This matters after a breach at a school, a pediatric practice, or a health plan, because a child’s SSN is a common target for fraudulent returns that claim the child as a dependent or report wages the child never earned. A dependent’s IP PIN is entered on your return in the dependent section, and on related forms such as the child and dependent care credit form and the earned income credit schedule when they apply.
The three ways to enroll, fastest first
The quickest route is an IRS Online Account. If you do not have one, you register and verify your identity through the IRS’s identity-verification process, then open the Profile tab and enroll in the IP PIN program. The PIN is issued immediately and shown on screen.
If you cannot complete online verification, and your adjusted gross income on your last filed return is below the threshold the IRS sets each year — for recent years, $84,000 for individuals or $168,000 for married filing jointly — you can file Form 15227 by mail or fax. The IRS then calls you to verify your identity, and mails the IP PIN. Because this route involves a mailed PIN, start it well before you need to file.
If neither works, you can make an appointment at a Taxpayer Assistance Center and verify your identity in person with documents. The IRS mails the PIN within about three weeks of the appointment.
Continuous versus one-time enrollment
When you enroll online you choose between continuous enrollment, which keeps you in the program for the current year and every future year, and one-time enrollment, which covers only the current calendar year and then opts you out automatically.
After a breach, continuous enrollment is usually the right choice. A stolen SSN does not expire, and the risk of a fraudulent return persists for years, not one season. You can opt out later through your online account if you were never an actual victim and decide you no longer want it.
The mid-November to mid-January gap
The IP PIN is generally viewable in your online account from mid-January through mid-November. During the roughly two-month gap at the turn of the year, the online tool is down for maintenance while the IRS prepares the next filing season.
That timing matters. If you learn about a breach in late November or December, you may not be able to enroll online until January. Plan for it: set a reminder to enroll as soon as the tool returns, and in the meantime use Form 15227 if you are eligible. Do not assume you have missed your chance for the year — the PIN you get in January still protects that year’s return.
How the PIN is issued and renewed each year
A new IP PIN is generated every calendar year. How you receive it depends on how you got into the program.
If the IRS enrolled you because you were a confirmed victim of tax-related identity theft, it mails you a CP01A notice with the new PIN each year, usually from late December into January. If you opted in yourself and obtained your PIN online, no CP01A is mailed — you retrieve the new PIN from your online account each year before you file.
Put a January reminder on your calendar to log in and get the current year’s number. Using last year’s PIN will cause a rejection.
Using the PIN on your return, and fixing a rejection
The IP PIN is used only on federal Forms 1040, 1040-SR, 1040-NR, 1040-PR, 1040-SS, and 1040-X. Your tax software prompts you for it; a paper return has a box for it near the signature line. It is not used on an extension request (Form 4868) or on state returns.
If an e-filed return is rejected for a missing or incorrect IP PIN, retrieve the correct current-year PIN from your online account and re-file. If you cannot get it online and did not receive a mailed one, the IRS has a dedicated line to reissue it after identity verification, generally within about 21 days — which may push you to file on paper if the deadline is close. A return filed on paper with the correct PIN still processes; it is just slower.
What the IP PIN does not do
The IP PIN protects your federal tax return and nothing else. It does not stop new credit accounts — that is a credit freeze. It does not monitor your identity or alert you to misuse. It does not protect your state tax return, and several states run their own PIN or identity-verification programs, so if your SSN was exposed, check your state revenue department’s site for an equivalent.
Treat the IP PIN as one layer. After an SSN breach, the fuller response is a credit freeze at the three nationwide bureaus, a review of your credit reports, an IP PIN for federal taxes, and — if wages you did not earn ever appear — a check of your Social Security earnings record.
The IRS will never ask for it
The IRS states plainly that it will never ask for your IP PIN. Any phone call, email, or text asking you to confirm or provide it is a scam, and these spike during filing season and right after publicized breaches.
You enter the PIN yourself, into your tax software or on your paper return. No legitimate tax preparer needs you to read it to them over the phone before you have engaged them, and the IRS does not call to "verify" it.
How an IP PIN compares to a credit freeze and a fraud alert
People sometimes assume one of these three tools covers the others. It does not — each blocks a different door, and after an SSN breach the realistic goal is to use all three together, not to pick one.
- IP PIN — blocks a fraudulent federal tax return filed under your SSN. Free. Renews every calendar year. Does nothing for new credit accounts.
- Credit freeze — blocks a new loan or credit card from being opened using your SSN at a nationwide bureau. Free. Stays until you lift it. Does nothing for tax returns.
- Fraud alert — tells a lender to verify your identity before opening credit; weaker than a freeze because verification is the lender's judgment call, not a hard block. Free, but only lasts one year unless you are an identity theft victim (then seven years).
Frequently asked questions about the IP PIN
- What happens if I lose my IP PIN in the middle of filing season? Retrieve the current one from your IRS Online Account. If you cannot access the account, call the IRS's dedicated IP PIN reissue line; verification and reissue generally take about three weeks, which can mean filing on paper if a deadline is close.
- Does having an IP PIN change my refund or make me more likely to be audited? No. It only adds a matching step before your return is accepted; it does not affect how your return is processed or reviewed once it is in the system.
- Can someone with an ITIN instead of an SSN get one? Yes — the program covers anyone who can verify their identity with either an SSN or an ITIN, which matters for a household where not everyone has a Social Security number.
- What if my spouse refuses to enroll? Enter only the PIN of the spouse who has one. A joint return still requires the correct PIN for every spouse who is enrolled, but an unenrolled spouse simply has no PIN field to fill in.
- Does an employer or bank ever need my IP PIN? No. It is used only on the federal tax forms listed above. Anyone else asking for it — including someone claiming to be from the IRS — is not a legitimate request.
Worked example: an SSN in a breach, no misuse yet
A payroll vendor writes in October that your name, date of birth, and SSN were exposed. Nothing has happened yet. You freeze your credit at all three bureaus that week. Then you open an IRS Online Account, verify your identity, and enroll in the IP PIN program with continuous enrollment. The PIN appears on screen; you store it with your tax documents, not in an email.
In January you log back in, retrieve the new year’s PIN, and give it to your tax preparer to enter, or type it into your software. Your return is accepted. If a criminal had tried to file under your SSN in between, their return would have been rejected for lack of the PIN, and you would have kept your normal refund timeline. You set a recurring January reminder so this becomes a one-minute annual task.
