An e-filed tax return without the right six-digit code gets rejected before a human ever reviews it. That rejection is the entire point of the IRS Identity Protection PIN — one of the few tax security and identity theft recovery tools that actually stops the next fraud attempt instead of just documenting the last one, which matters more than it sounds once you've lived through tax-season fraud and IRS phone scams the way my family did.
Most recovery steps work backward — a police report, an FTC affidavit, a fraud alert on your credit file — because they're responding to theft that already happened. A PIN requirement on your tax return works forward: nobody can file electronically in your name without it, full stop, not even a scammer holding your Social Security number and birthdate.
What an IP PIN Actually Locks Down
The mechanics are almost insultingly simple. The IRS assigns a six-digit number tied to your Social Security number, and any return that shows up without the matching code gets bounced automatically, the same way your bank blocks a card swipe from a city you've never visited. It's not a subscription that emails you after the fact and it's not a brochure promise; it's closer to changing the locks after you already know someone has a copy of your old key (no matter what the marketing copy for monitoring services likes to imply).
Binder-keepers end up liking this part more than almost any other fraud defense, since it doesn't depend on a human reading your file correctly under deadline pressure. It's just code-in or rejected, no interpretation required, no waiting on hold to find out which category your case falls into.
Who Qualifies — and Who Gets Enrolled Without a Choice
Anyone with a Social Security number and the ability to verify their identity online can request an IP PIN voluntarily, and that's worth doing before anything goes wrong, not after. Confirmed identity theft victims don't get a choice in the matter: once the IRS has processed your Form 14039 — the Identity Theft Affidavit, and I've written more about what comes next in Beyond the Binder: What Really Happens After You File That Identity Theft Report — and confirmed someone tried to file in your name, you're placed in the program permanently. There's no opting back out once you're flagged, which is either comforting or unsettling depending on the day.
Email matters here more than people expect, since it's usually the recovery channel for every other account tied to your identity. A dark-web scan I ran afterward came back clean — zero hits — but only because I'd already moved my father onto a new email address first; the old one was still floating around attached to the account tied to whatever identity theft had already started, and no scan was going to un-leak that.
How Do You Actually Apply for One?
The fastest route is the IRS's online Get an IP PIN tool, which requires verifying your identity through ID.me: a photo of your driver's license, followed by a live selfie (yes, a selfie, for the IRS) so the system can match your face to the ID. People find this step unsettling the first time, and it should feel a little strange, since you're handing a government contractor biometric data, after all. If ID.me rejects you, or you'd rather skip facial verification entirely, Form 15227 is available to filers under a certain income threshold, and anyone can book an in-person appointment at a Taxpayer Assistance Center and walk out with a PIN the same visit.
Identity verification by phone is its own special kind of frustrating, for what it's worth. I once tried to freeze my father's Experian file over the phone and got stuck at the security-question stage, because he genuinely didn't remember the street he grew up on or the make of his first car — questions pulled from decades-old records, not questions he'd ever answered himself before. I've written more about the lessons from protecting my parents' identity elsewhere, but the short version is: the IRS's online verification avoids that particular trap only because it swaps one kind of friction (memory) for another (a selfie most people would rather not take).
The Timing Trap Nobody Warns You About
Here's the part most how-to guides skip. If you've just filed Form 14039 because someone already tried to file a return in your name, requesting an IP PIN online too soon can backfire. The open fraud case and the new PIN request don't talk to each other cleanly while a human reviewer is still working the case manually, and the result is sometimes a verification loop that stalls your legitimate refund instead of protecting it.
Think of it like changing the locks on your front door while a locksmith is still inside finishing the old job; nobody ends up with a key that actually works. If your fraud case is still open, it's worth waiting for the IRS's written acknowledgment of that case before pushing the online PIN request through, or at least asking a tax professional whether your specific situation is ready for it. This isn't the kind of thing to guess your way through; a CPA who deals with IRS fraud cases regularly will know faster than a government phone line will tell you, and getting the sequence wrong can cost you months.
Renewing It Every Single Year
The PIN isn't a one-time download. The IRS regenerates a new six-digit number every year, available again through the online portal each January, and the old one stops working the moment the new one is issued. Lose track of it before you file, and retrieving it means logging back into the portal and going through identity verification again — which, if you've already sat through the ID.me selfie process once, is not a step anyone looks forward to repeating.
None of this replaces the separate process of actually filing a return after a confirmed theft, which has its own paperwork trail and its own waiting periods — that's a longer story on its own.
Fitting the PIN Into the Rest of Your Fraud Defense
A credit freeze and a fraud alert do something different from an IP PIN — they stop new accounts from opening in your name, where the PIN stops a fraudulent tax return specifically, and you genuinely need both, not one instead of the other. The same goes for dark web monitoring: it'll tell you if a password or account number leaked somewhere, but it has no visibility into what the IRS is doing with your Social Security number, which is exactly the blind spot that cost me real stress after my own card was cloned at a gas pump and used for an online furniture order I never placed — which ties into why my free credit alerts weren't enough for us in the first place.
These tools don't cancel each other out, and skipping one because you already pay for another is how gaps happen. A freeze keeps new credit from opening in your name, monitoring tells you when something has already leaked, and the IP PIN is the one piece that specifically keeps a tax refund from walking out the door under someone else's signature. If you've had any contact with the IRS about fraud already, that's the one to set up first — it's also the one with a hard deadline attached every single filing season, since a new code gets issued, and expected, every year.