The IRS Identity Protection PIN: how to get one and why it is worth five minutes

Tax-related identity theft usually looks like this: someone with your name and Social Security number files a return early in the season, claims a refund, and is paid before you file. When your real return arrives, the IRS rejects it as a duplicate and you spend months proving who you are.

The Identity Protection PIN closes that gap. Once you have one, any federal return filed under your SSN or ITIN must include it. In the IRS's words, "An incorrect or missing IP PIN will result in the rejection of your e-filed return or a delay of your paper return until it can be verified." A thief without the PIN gets nowhere.

It is free, it is optional, and you can get one "even if you are not required to file a tax return", which matters for retirees, students and children whose numbers sit unused. The source for everything on this page is the IRS's Get an identity protection PIN page.

There are three routes. Use the first one you can.

1. Online, through your IRS account (fastest)

Sign in to your IRS Online Account at IRS.gov (or create one; that means verifying your identity with the IRS's sign-in provider) and request the PIN in the IP PIN section of your profile page. Your PIN shows on screen. Adults only: the IRS says anyone under 18, and parents requesting a PIN for a dependent under 18, must use one of the other two routes.

2. Form 15227, if you cannot verify online

If you cannot set up an online account, you can submit Form 15227, Application for an Identity Protection Personal Identification Number. The IRS's income limit is an adjusted gross income on your last filed return below $84,000 for individuals or $168,000 for married filing jointly. You need a valid SSN or ITIN and access to a phone: the IRS calls you on the number you give to check your identity, then mails the PIN, usually within four to six weeks. After that it arrives by mail every year.

3. In person, at a Taxpayer Assistance Center

If neither works, or your income is over the Form 15227 limit, book an appointment at a local IRS Taxpayer Assistance Center. Bring one federal or state photo ID plus one other form of identification. For a dependent, bring your own two documents and two for the child, such as a birth certificate and Social Security card. The PIN is mailed, usually within three weeks, and then every year after.

• Tax software asks for it during e-filing. If someone prepares your return, give it to them only when you are ready to sign and submit.
• It goes on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS, on paper as well as electronic returns, and on any prior-year return you file during that calendar year.
• The PIN is valid for one calendar year. A new one is generated each year. If you enrolled online, the IRS does not mail it: sign in again, and it shows on your profile, generally from mid-January to mid-November.

Do not file Form 15227 again; that form is only for new enrolments. Instead, per the IRS page Didn't receive or lost your IP PIN:

1. Sign in to your IRS Online Account and open your Profile page. The current PIN is shown there.
2. If you cannot use the online account, call the IRS on 800-908-4490 (Monday to Friday, 7 a.m. to 7 p.m. local time). If you verify your identity with the assistor, the PIN is mailed within 21 days to the address the IRS has on file.
3. A minor's lost PIN cannot be retrieved online; call to have it reissued by mail.
4. Reissue by mail is not available during the IRS's end-of-year maintenance period, normally November to mid-January, or in the first calendar year you enrolled. In that case you can mail a paper return without the PIN; the IRS will check it, and your refund will be slower.

Filing electronically without a PIN you have been assigned gets the return rejected.

Signs include an e-filed return rejected as a duplicate, an IRS letter about a return you did not file, or a W-2 or 1099 from an employer you never worked for. The IRS's identity theft guide for individuals sets out the order:

1. If you got an IRS letter, follow its instructions first. It may send you to the IRS identity verification service.
2. Otherwise, check whether you need Form 14039, the Identity Theft Affidavit. The IRS says most people do not: skip it if you already filed it or reported through IdentityTheft.gov, if the IRS has already written to you, or if the theft is not tax-related.
3. Keep filing your returns and paying tax as normal, on paper if e-filing is blocked.
4. Get an IP PIN for the following years.
5. Check with your state tax agency. States have their own process.

Tax fraud is often one part of wider identity theft. Report it at IdentityTheft.gov to get a recovery plan, and see our guide to what to do if your identity is stolen. This page is general information, not tax or legal advice.