How to verify your identity with the IRS

Every route below is gated on which letter the IRS sent you, so before you do anything else, read the number in the corner of the page. The IRS internal manual for the Taxpayer Protection Program sets out the family: letter 4883C, letter 5071C, letter 5447C, letter 5747C, and the 6330C and 6331C variants issued in place of 4883C and 5071C respectively. There are also two letters you only see later in the process — letter 6167C, sent when the documentation you supplied was incomplete or invalid, and letter 5216, the final notice issued when a taxpayer has not been able to authenticate after repeated attempts.

Letter 5071C, which the IRS titles Potential Identity Theft with Online Option, is the common one and the friendliest. It points you at an online tool and, alternatively, at a phone number. Letter 6331C is its pilot equivalent and behaves the same way. If this is the letter on your table, you can probably resolve the whole thing tonight without speaking to anyone.

Letter 4883C, titled Potential Identity Theft, has no online option at all. It instructs you to call the Taxpayer Protection Program hotline shown on the letter itself. There is no published general number that substitutes for it, and the ordinary IRS helpline cannot complete this authentication for you. Letter 6330C is the pilot version of the same thing.

Letter 5747C, Potential Identity Theft In Person Appointment, is the most restrictive and the least common — the Taxpayer Advocate Service describes it as rarely used. It requires you to attend a Taxpayer Assistance Center in person, and the IRS states plainly that the taxpayer must be present at the appointment to authenticate their identity. A representative may come with you, but not instead of you.

Letter 5447C, Potential Identity Theft Outside the U.S., is what the IRS issues when the return was filed from a foreign address. The IRS internal manual notes it allows thirty days for receipt, reflecting international post, and the taxpayer-facing page for the CP5447 series lists online, phone, mail and the Document Upload Tool as ways to respond. If you are overseas, this is the letter that will find you.

One naming wrinkle catches people out. The IRS has been migrating these letters into a CP-numbered notice series, so the pages describing them now read CP5071 series and CP5447 series rather than 5071C and 5447C alone. The letter in your hand may say either. Treat CP5071, CP5071C, CP5071F and 5071C as the same instruction, and follow whatever routes are printed on your own copy rather than what a page describing a neighbouring variant says.

The underlying trigger is the same in every case: a Form 1040-series return was filed under your Social Security number or ITIN and the IRS wants confirmation before going further. It is not an audit and not a penalty notice.

If your letter is a 5071C, 6331C or a CP5071-series notice, the online tool is the fastest route and it is available around the clock. Go to IRS.gov/VerifyReturn — type it yourself rather than following a link from an email — and sign in or create an account. The IRS is explicit that you should only use this service if you received one of the letters that offers it; the tool is not a general-purpose identity check anyone can walk into.

Have the paperwork open before you start. The IRS asks for the Form 1040-series return for the tax year named in the letter, in its original or amended form; a prior-year return for a different year if you filed one and can lay hands on it; and the supporting documents behind those returns — Forms W-2, Forms 1099, Schedule C, Schedule F and so on. You will also want a valid government-issued photo ID, which the account creation step requires in any event.

There is a trap in the middle of this process that catches a great many people. Verifying your identity and verifying your return are two separate stages, and finishing the first does not finish the job. The IRS warns that if you do not see the questions about your tax return after your identity has been confirmed, you must return to the page and sign in again to complete them. People who stop at the identity step believe they have responded and then wait months for a return that has not moved.

Anyone under eighteen cannot use the online service. The IRS instructs minors to contact it directly instead, which in practice means the phone route or, if the letter directs it, an in-person appointment. The same age floor applies to creating the underlying IRS.gov account, so there is no way around it by making the account first.

If you did not file the return described in the letter, the tool has a path for that too — it lets you tell the IRS that someone may have attempted to file using your information. Never verify a return you did not submit in the hope of moving things along.

Once you have completed both stages, stop and let the machinery work. The IRS asks you to wait two to three weeks after using the service before checking your refund status, and says it may take up to nine weeks to process the return after verification. It also notes that if you verified your return through this service, you do not need to complete Form 14039, the Identity Theft Affidavit, unless the IRS specifically tells you to.

Screenshot the confirmation screen before you close the tab. If you later need to show a Taxpayer Advocate that you responded, a dated image of the completion page is the only evidence this route produces.

Letter 4883C and letter 6330C offer no online option. The instruction is to call the Taxpayer Protection Program hotline shown in the letter, and the number printed on your own copy is the one to use. Do not substitute the general IRS individual line on 800-829-1040 — that line handles ordinary account questions and cannot complete this authentication, and calling it simply costs you the wait.

The IRS is candid about the narrowness of this line: it handles identity and tax return verification only, and no other tax information is available through it. Do not ring it to ask where your refund is, to set up a payment plan or to query a notice about a different year. The assistor genuinely cannot see or do those things, and asking will not change that.

Assemble the same pack you would need online before dialling, because you will be asked to read from it under time pressure. That means the letter itself, the Form 1040-series return for the year in the letter, a prior-year return for a different year if you have one, and the supporting documents for each — Forms W-2 and 1099, Schedule C, Schedule F and the rest. Expect questions drawn from figures on those documents rather than a simple recitation of your address.

Timing matters at the front of this process too. The IRS internal manual allows fourteen days for a taxpayer at a domestic address to receive the letter and thirty days where the address is foreign, which is the reason 5447C recipients get a longer runway. If your letter is undated in your memory or arrived in a stack of post, work from the date printed on it rather than the day you noticed it.

If the call cannot resolve it, the IRS may escalate you rather than close you out. The Taxpayer Advocate Service notes that where identity cannot be verified by phone, the IRS may require an in-person appointment at a local office instead. That is not a punishment; it is the next channel, and it is the one described in the following section. The internal manual also identifies a high-risk authentication category that carries enhanced procedures, so some cases are always going to take more than one contact.

There is a hearing-accessible route: the IRS publishes a TTY/TDD number on 800-829-4059 alongside its individual assistance line on 800-829-1040, both open 7am to 7pm local time. Neither replaces the number on your letter, but both help once the identity issue is behind you.

Write down the date, the time, the assistor's name or badge number and what you were told. A contemporaneous note is what turns a vague complaint into something the Taxpayer Advocate Service can act on.

Letter 5747C leaves you one option: an appointment at a Taxpayer Assistance Center. The letter carries a toll-free number for booking, and the IRS says you must call to schedule ahead of time — Taxpayer Assistance Centers work by appointment and turning up hoping to be seen is not a plan. To find the office nearest you, the IRS runs an office locator at apps.irs.gov, reachable from its Contact your local IRS office page.

The identification standard at the counter is higher than online. The IRS asks for two original forms of identification: a current government-issued photo ID such as a driver's license, state ID or passport, plus one more from a published list that includes a Social Security card, a tribal membership document, a car title, a voter registration card, a mortgage statement, a lease agreement, a utility bill showing your current address, a birth certificate, or school records for anyone under twenty-four. Bring your taxpayer identification number as well.

Bring the tax paperwork too, not just the ID. The 5747C guidance asks for the letter, the Form 1040-series return named in it, prior-year returns where available, and the supporting documents behind them. The appointment is meant to settle both halves of the question — that you are who you say you are, and that the return in the system is the one you filed.

The presence requirement is absolute. The IRS states that the taxpayer must be present at the appointment to authenticate their identity, though an authorised representative may accompany you. A spouse, an adult child or an accountant cannot go in your place, which is worth knowing before you book a day off work for someone else.

If you did not file the return, do not book the appointment first. The 5747C guidance tells you to contact the Taxpayer Protection Program hotline listed on the letter immediately to report that the return is not yours. That conversation redirects the case entirely and saves you a trip.

The consequence of doing nothing is stated bluntly on the letter and repeated by the IRS: without a response, it will not be able to process your tax return, issue a refund or credit any overpayment. The nine-week processing estimate after verification applies to this route as it does to the others, so an appointment three weeks out is effectively three weeks added to the whole timetable. Book the earliest slot you can physically attend rather than the most convenient one.

Taxpayer Assistance Centers also perform in-person authentication for the separate purpose of issuing an Identity Protection PIN. Ask about both while you are there rather than making two visits.

The single most important consequence to understand is that nothing moves until you respond. The Taxpayer Advocate Service puts it plainly: the IRS will not process the return and will not issue the refund until the taxpayer responds to the letter and completes the authentication process. There is no automatic release after a waiting period, no threshold below which the hold quietly lapses, and no benefit whatsoever in waiting to see whether the refund turns up anyway.

The scale is not small. TAS reported that the IRS suspended processing of more than 1.9 million tax returns during the 2024 filing season pending identity verification. That number reframes the letter: this is mass screening, not a personal accusation, and the queues behave accordingly.

If you never respond, the return does not sit patiently forever. The IRS internal manual for the Taxpayer Protection Program states that where the taxpayer fails to respond or cannot authenticate successfully, the return cannot be posted and may be archived or deleted from the system depending on where in the processing cycle it sits. That is a genuinely bad outcome: the filing effectively ceases to exist, and you are back to submitting the return again from scratch with all the delay that implies.

Missing the window is not the same as being locked out permanently. Respond as soon as you can regardless of how long ago the letter arrived, and if the return has already been deleted, re-file and expect it to be screened again. Keep the original letter either way.

Two later letters signal that the process has stalled rather than finished. Letter 6167C is issued when the documentation you supplied was incomplete or invalid, which usually means a fixable problem — the wrong year's return, an unreadable copy, a document that does not match the name on file. Letter 5216 is the final notice, issued once when a taxpayer has not been able to authenticate after repeated attempts. Receiving either means the ordinary channels have run out and it is time to escalate.

The other thing that will not move is the refund tracker. The IRS publishes normal timings for Where's My Refund — status within 24 hours of e-filing a current-year return, within three days for a prior-year e-file, and four weeks after a paper filing — but a return held for identity verification is outside that pattern entirely. Checking it daily tells you nothing. Wait the two to three weeks the IRS asks for after you verify, and only then start looking.

If more than thirty days have passed beyond normal processing time and you are getting nowhere, that delay is itself a qualifying criterion for Taxpayer Advocate Service help. So is a case where the IRS has missed its own stated deadline, or where repeated interim responses have arrived without resolution. Those thresholds are published by TAS and are the closest thing this process has to a formal escape hatch.

Say so immediately and by the route your letter specifies. Every one of these letters has a branch for the taxpayer who did not file — the online tool has a path for reporting that someone may have attempted to file using your information, and the 4883C and 5747C guidance tells you to notify the IRS immediately because you may be a victim of identity theft. Speed matters here in a way it does not on the ordinary branch.

Do not file Form 14039, the Identity Theft Affidavit, on top of that. This is counterintuitive and it is the most commonly wasted step in the whole process. The IRS states directly that if you receive letters 5071C, 4883C or 5747C there is no need to file a Form 14039 — you should follow the instructions in the letter instead. The same guidance says not to file it if you have already used, or been told to use, the Identity and Tax Return Verification Service.

Form 14039 exists for the cases where no letter arrived. The IRS lists them: your e-filed return is rejected because a duplicate return has already been filed under your Social Security number; someone has used your dependent's number on another return without permission; you receive tax transcripts you did not request; your software confirms an account was created or accessed in your name without your knowledge; the IRS contacts you about income or wages from an employer you never worked for; or an Employer Identification Number has been assigned to you when you never applied for one. In those situations the form is the right instrument, and it can be filed online at IRS.gov, printed and mailed or faxed, or completed at the Federal Trade Commission's IdentityTheft.gov, which transfers it electronically to the IRS.

Once the IRS accepts that a fraudulent return exists, the case goes to the Identity Theft Victim Assistance organisation. IDTVA works out whether the theft touches one tax year or several, deals with every issue arising from the fraudulent return including whether other victims are named on it, makes sure your genuine return processes, removes the confirmed fraudulent return from your tax records, and finally marks your account with an identity theft indicator.

Be realistic about how long that takes. The IRS says it generally resolves these cases within 120 days but acknowledges that the real figure has been far higher — it has published an average of 580 days to resolve identity theft cases, a consequence of pandemic-era inventory. Treat 120 days as the design target and the longer figure as the planning assumption, and check the IRS page for the current position rather than relying on either number here.

The IRS also asks you not to make it worse. Do not submit duplicate copies of Form 14039 and do not ring for case status updates, because both add work to the queue that is holding your case. If you filed a paper return because e-filing was rejected, keep the proof of postage and let it run.

There is a compensation of sorts at the end. Confirmed victims are enrolled in the Identity Protection PIN programme automatically and receive a new six-digit PIN each year, which is the single most effective protection against a repeat. The IRS also advises victims to change the password on their IRS Online Account to something complex and unique, to keep records of every communication, to keep filing normally, and to contact their state tax agency separately — state revenue departments run their own systems and are not told about your federal case.

This is a different failure with a different owner. To sign in to your tax information on IRS.gov you need an account with ID.me, a private identity verification provider the IRS uses as its credential partner. Account creation is a two-part process: you set up the credential first — an email address, a password of at least eight characters, and a multifactor method such as an authenticator app, a biometric unlock or a phone that can receive texts — and then you verify your identity once.

The verification step asks for your Social Security number or ITIN and a valid government-issued photo ID, meaning a driver's license, a state ID, a passport or a passport card. In practice that means photographing the document and, for the self-service route, taking a selfie the system can match against it. The Taxpayer Advocate Service describes the two ways through: a self-service photo option, or a live video chat with an agent where the automated match fails.

You must be eighteen or older to create the account, which is why the return-verification tool also refuses under-eighteens. There is no parental workaround at the account level.

When verification fails — and it fails routinely for people with thin credit files, recent name changes, prepaid phone numbers or no US-issued photo ID — the IRS points to two things. The first is the option to get your information without signing in, offered as a link at the point where a service asks you to authenticate. The second is the ID.me help centre, which handles troubleshooting for the credential itself. Neither the IRS nor ID.me can simply wave you through.

The practical workaround worth knowing is the transcript. Almost everything people open an Online Account to see — adjusted gross income, what the IRS holds for a given year, whether a return posted — is available on a tax transcript, and transcripts can be obtained without an online credential. The IRS offers transcript by mail, which arrives in five to ten calendar days at the address on your latest return, an automated phone line on 800-908-9946, and Form 4506-T for the full range of transcript types.

Understand what you lose that way. The Online Account also carries digital copies of IRS notices, five years of payment history, the ability to create or revise a payment plan, balances by tax year, information returns such as W-2s and certain 1099s, and audit status for some correspondence audits. Transcripts give you the record, not the ability to act.

Critically, an ID.me failure does not block the return verification described earlier in this guide. If your letter offers a phone route or an in-person appointment, those channels do not require an online credential at all. People who cannot verify with ID.me sometimes conclude they cannot verify with the IRS, and that is not true — it just means the online lane is closed to them.

The durable fix is an Identity Protection PIN. It is a six-digit number known only to you and the IRS that prevents anyone else from filing a return using your Social Security number or ITIN, and anyone with an SSN or ITIN who can verify their identity may enrol — you do not have to have been a victim first. Parents and legal guardians can request one for a dependent.

There are three ways in. The fastest is your IRS Online Account, where the IP PIN sits in the profile section. If you cannot establish an account and your adjusted gross income is below the published threshold — the IRS currently sets it at $84,000 for individuals and $168,000 for joint filers, figures that are revised — you can file Form 15227, after which the IRS calls the number on the form to validate your identity and posts the PIN within four to six weeks. The third route is in-person authentication at a Taxpayer Assistance Center, which typically produces a PIN by post within about three weeks.

An IP PIN lasts one calendar year and a new one is generated each year. If the IRS enrolled you because identity theft was confirmed, it mails a CP01A notice with the new number annually; if you enrolled yourself, you retrieve it online each year. Lose it and you retrieve it from your Online Account profile, or call 800-908-4490 from the United States, or 267-941-1000 from abroad, and a verified caller has the PIN posted within twenty-one days.

Two timing traps sit in that system. You cannot have a PIN reissued by post if you only enrolled during the current calendar year, or if you ask during the annual maintenance period that typically runs from November to mid-January. In those situations the IRS says you may file a paper return without the PIN, accepting that this will delay the refund while it verifies you by other means.

Now the scams, because this letter is imitated more than almost any other. The IRS states that it never emails without your permission, does not send text messages without your permission, never sends direct messages by social media, and never calls to demand payment now, threaten arrest or inform you of a refund. A genuine identity verification request arrives on paper. If the first you hear of it is an email, a text or a message on a social platform, it is not the IRS.

Report the fakes rather than only deleting them. Suspicious emails go to [email protected] with a subject line naming what they impersonate. Suspicious texts should be forwarded to 7726, which is SPAM on a keypad and which lets your carrier block similar messages, and then reported to [email protected] with the sender's number, your number, the message contents and the date and time. Impersonation scams can also be reported to the Treasury Inspector General for Tax Administration on 800-366-4484 and to the Federal Trade Commission at reportfraud.ftc.gov.

When the process genuinely stalls, the Taxpayer Advocate Service is the independent organisation inside the IRS that exists for exactly this. It takes cases where you face economic harm — losing your home, being unable to buy food, pay utilities or keep transport to work — and cases of systemic burden, which includes a delay of more than thirty days beyond normal processing time, repeated interim responses without resolution, a missed IRS deadline, or a failure of IRS systems or procedures. Call 877-777-4778, or submit Form 911 by email, by fax to 855-828-2723, or by post to the TAS office in Florence, Kentucky.

If you need representation rather than advocacy and cannot pay for it, Low Income Taxpayer Clinics represent people in disputes with the IRS free of charge or for a nominal fee. Eligibility runs to 250 per cent of the federal poverty guidelines — for 2026 the Taxpayer Advocate Service gives $39,900 for a single person in the contiguous United States — and clinics are listed in IRS Publication 4134 and through the LITC finder on the TAS website. They are independent of the IRS, which is the point.