IRS Identity Protection PIN: How to Obtain and Use It
The IRS Identity Protection PIN (IP PIN) is a six-digit number issued by the Internal Revenue Service to protect taxpayers from fraudulent federal tax return filings. This reference covers the program's scope, the enrollment and annual renewal mechanism, the conditions under which the IP PIN is triggered or voluntarily requested, and the boundaries that determine eligibility and applicability. The IP PIN sits at the intersection of tax administration and identity theft response — understanding its structure is essential for affected taxpayers, tax professionals, and identity theft recovery specialists.
Definition and scope
The IRS Identity Protection PIN is a six-digit code that serves as an authentication credential specific to federal tax return filing. When an IP PIN is active on an account, the IRS will reject any electronically filed return — or flag any paper return — that does not include the correct PIN. The program is administered by the Internal Revenue Service under authority derived from the IRS's broader taxpayer identity theft protection mandate.
The IP PIN is distinct from other IRS account identifiers, including the Taxpayer Identification Number (TIN) and Electronic Filing PIN. It functions exclusively as a one-filing-season authentication layer and expires at the end of each calendar year, requiring annual reissuance.
The program covers three categories of participants:
- Confirmed identity theft victims — taxpayers whose Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) has been used in a fraudulent return, identified by IRS records or reported via IRS Form 14039 (Identity Theft Affidavit).
- Proactive voluntary enrollees — taxpayers who enroll through the IRS IP PIN Opt-In Program, available to any taxpayer who can verify identity through the IRS's online portal.
- IRS-assigned recipients — taxpayers selected by the IRS based on indicators of potential compromise, who receive a CP01A notice containing the IP PIN each January.
Dependents' SSNs can also be protected by an IP PIN, which is particularly relevant when a child's SSN has been compromised in a data breach or tax fraud scheme. See the identity theft providers section for service categories addressing dependent-related tax fraud.
How it works
The IP PIN operates on an annual cycle coordinated with the federal tax filing calendar. The IRS issues or reissues each PIN in January of the filing year, and the PIN is valid for returns filed in that calendar year only.
Enrollment and retrieval process:
- Identity verification — Enrollment requires identity proofing through the IRS's online account portal at IRS.gov, which uses ID.me for identity verification as of the 2021 portal transition. Verification requires a valid photo ID, SSN or ITIN, email address, and a mobile device.
- IP PIN issuance — Upon successful enrollment or automatic assignment, the taxpayer receives a six-digit PIN tied to the primary taxpayer's SSN or ITIN.
- Return filing — The IP PIN is entered on Form 1040 (and related variants) in the designated field before submission. Tax software and tax professionals must include the PIN to pass IRS electronic validation.
- Annual renewal — The PIN expires after December 31 of the issuance year. A new PIN is generated in January for the next filing year, accessible via the IRS online portal, the IRS2Go mobile app, or the CP01A notice mailed to confirmed victims.
Taxpayers who lose their IP PIN can retrieve it through the IRS online account, by calling the IRS Identity Protection Specialized Unit at 1-800-908-4490, or — if no other method is available — by filing a paper return without the PIN and accepting the IRS's manual verification process, which introduces processing delays of up to 12 weeks (IRS Publication 5367).
Common scenarios
Tax-related identity theft response: A taxpayer receives an IRS CP01A notice because a fraudulent return was filed using their SSN. The IRS automatically assigns an IP PIN and mails it each January. The taxpayer must use the PIN for all subsequent filings until notified otherwise.
Voluntary enrollment before theft occurs: A taxpayer whose personal information was exposed in a data breach — such as the 2017 Equifax breach affecting approximately 147 million individuals (FTC Consumer Information on the Equifax Breach) — proactively enrolls in the IP PIN Opt-In Program to block any fraudulent filing before it occurs.
Dependent SSN protection: A parent discovers a dependent child's SSN was used on an unfamiliar tax return. The parent files IRS Form 14039 on behalf of the dependent and requests an IP PIN covering the child's identifier.
Tax professional involvement: A tax preparer or Enrolled Agent working with an identity theft victim must obtain the client's IP PIN before electronic submission. Failure to include the PIN will result in IRS rejection of the e-filed return. Tax professionals operating under IRS Circular 230 are expected to maintain client IP PIN documentation as part of identity verification procedures.
For professional categories involved in identity theft recovery filings, the identity-theft-provider network-purpose-and-scope page covers the sector structure for enrolled practitioners and recovery specialists.
Decision boundaries
IP PIN vs. IRS Form 14039: The IP PIN and the Identity Theft Affidavit (Form 14039) serve different functions. Form 14039 initiates an IRS investigation and flags an account as compromised; the IP PIN is the resulting protective credential. Filing Form 14039 does not automatically generate an IP PIN — the IRS investigation must conclude and an assignment must be made, or the taxpayer must separately enroll through the opt-in program.
Voluntary vs. assigned PIN holders:
| Characteristic | Assigned (CP01A) | Voluntary Opt-In |
|---|---|---|
| Trigger | Confirmed fraud or IRS risk flag | Taxpayer choice |
| Delivery | CP01A mailed notice | Online portal retrieval |
| Reversibility | Managed by IRS | Taxpayer can unenroll |
| Coverage scope | Primary SSN/ITIN | Primary SSN/ITIN and eligible dependents |
State tax returns: The IRS IP PIN applies exclusively to federal returns. State tax authorities operate independent identity protection programs. As of 2023, states including California, Georgia, and Ohio had established their own state-level IP PIN or identity verification programs, administered through their respective state revenue agencies — not the IRS.
Electronic vs. paper filing: An IP PIN is required on both electronic and paper returns when the taxpayer has an active PIN. Omitting the PIN from a paper return does not cause automatic rejection but triggers IRS manual review and processing delays. The IRS strongly advises electronic filing with the IP PIN to reduce processing friction.
Taxpayers seeking to understand how the IP PIN fits within broader identity theft recovery workflows can reference the how-to-use-this-identity-theft-resource page for navigating professional service categories in this sector.