IRS Identity Protection PIN: How to Obtain and Use It

The IRS Identity Protection PIN (IP PIN) is a six-digit number issued by the Internal Revenue Service to verified taxpayers as a barrier against fraudulent federal tax return filings. This page covers the program's scope, the enrollment mechanism, the scenarios in which an IP PIN applies, and the decision logic that determines eligibility and appropriate use. Tax-related identity theft remains one of the most reported categories of identity fraud in the United States, making the IP PIN one of the most structurally significant tools in the federal identity protection framework.

Definition and scope

The IP PIN is a taxpayer authentication credential administered under the IRS Identity Protection PIN Program, formally described in IRS Publication 5367 and supported by the agency's broader tax fraud prevention infrastructure. Its singular function is to confirm that a tax return bearing a taxpayer's Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) was filed by the legitimate account holder, not an impersonator.

The program operates under the authority of the IRS, which is itself governed by the Internal Revenue Code (Title 26, U.S. Code). The IP PIN is distinct from other IRS authentication mechanisms — it is not a password, not a login credential for IRS online accounts, and not a substitute for an SSN or ITIN. It functions exclusively as a filing-year authentication token attached to a specific federal return submission.

Eligibility is national in scope. As of the 2021 filing year, the IRS opened voluntary enrollment to all taxpayers who can verify their identity through the IRS online portal — a shift from the earlier model in which IP PINs were issued only to confirmed tax identity theft victims. The program covers individual Form 1040 filers, including Forms 1040-NR, 1040-SR, and 1040-PR.

How it works

The IP PIN is regenerated annually. A taxpayer enrolled in the program receives a new six-digit PIN each January for use in the upcoming filing season. The PIN must be entered on the federal tax return — paper or electronic — before the IRS will process the submission. A return submitted without the correct IP PIN for that tax year is rejected.

The enrollment and retrieval process follows a structured sequence:

  1. Identity verification — The taxpayer creates or accesses an IRS online account at IRS.gov and completes identity proofing through ID.me, the third-party identity verification service contracted by the IRS for this function.
  2. IP PIN issuance — Upon successful verification, the IRS assigns a six-digit IP PIN visible within the taxpayer's online account.
  3. Annual retrieval — Because the PIN changes each January, returning enrollees must retrieve the new PIN from their IRS account before filing. The IRS also mails a CP01A notice containing the current-year IP PIN to taxpayers who are assigned one through the victim-recovery pathway.
  4. Return filing — The IP PIN is entered in the designated field on the return. Tax preparation software platforms and professional preparers are required to include it in the electronic transmission.
  5. PIN loss protocol — If the PIN is lost, it can be recovered through the IRS online account or by calling the IRS Identity Protection Specialized Unit at 1-800-908-4490. Filing a paper return without the PIN remains a fallback, subject to additional IRS verification delays.

Taxpayers with dependents should note that each individual listed on a return who has been issued an IP PIN — including qualifying children — must have their respective PIN included on the same return.

Common scenarios

Confirmed tax identity theft victims represent the original and most direct use case. When the IRS identifies a fraudulent return filed under a taxpayer's SSN, the agency automatically enrolls the victim in the IP PIN program and issues a CP01A notice. This pathway is documented in IRS Publication 4535, the agency's identity theft resource for affected taxpayers.

Voluntary enrollees represent the expanded program population. Any taxpayer who can verify identity through the IRS portal may opt in, regardless of whether fraud has occurred. This is the recommended posture for individuals whose personal data has been exposed in a data breach or whose information appears on the dark web.

Dependent protection is a distinct scenario. Parents or guardians who enroll can also request IP PINs for dependents — most commonly minor children — to prevent fraudulent returns that claim those dependents. This intersects with the broader concern documented under child identity theft, where SSNs of minors are exploited precisely because the fraud may go undetected for years.

Professional tax preparers operating under Circular 230 are responsible for correctly transmitting IP PINs provided by clients. A preparer who files without a client-provided PIN — or who submits an incorrect PIN — triggers IRS rejection regardless of the return's accuracy.

Decision boundaries

The IP PIN program addresses one specific threat vector: fraudulent federal return filing using a stolen SSN or ITIN. It does not protect against state income tax fraud, which is governed by individual state revenue agencies. Taxpayers concerned about state-level tax fraud must consult their state's department of revenue, as state-level IP PIN equivalents vary — some states operate analogous programs, others do not.

The IP PIN also does not prevent identity theft in non-tax contexts. It provides no protection against account takeover fraud, synthetic identity theft, or fraudulent credit applications. Taxpayers requiring broader coverage should evaluate complementary tools such as a credit freeze and fraud alert or identity protection services.

A taxpayer who opts into the IP PIN program cannot easily disenroll. The IRS does not currently offer a self-service disenrollment mechanism; once enrolled voluntarily, participation continues. Confirmed victims are enrolled permanently through the victim-recovery track and cannot remove themselves from the program.

The IP PIN applies to federal individual returns only — it does not extend to business filings, employment tax returns, or estate and trust returns. Business owners concerned about business identity theft must address those exposures through separate IRS programs and entity-level controls.

References

Explore This Site

Regulations & Safety Regulatory References Tools & Calculators Password Strength Calculator