Working With the IRS After Tax Identity Theft: What to Do

One of the most common, well-documented mistakes taxpayers make when dealing with tax identity theft is filing IRS Form 14039, the Identity Theft Affidavit, when they didn’t actually need to. If the IRS sent you an identity-verification notice or letter, don’t automatically file Form 14039. The IRS specifically instructs taxpayers who receive these notices to follow the verification process described in the correspondence instead. Form 14039 is intended for victims who need to report identity theft through that separate process.

Filing Form 14039 on top of that doesn’t speed anything up; it creates a duplicate that the IRS simply attaches to the case file it already opened, adding processing time without changing the outcome. That single piece of confusion, not knowing which of two genuinely different starting points applies to your situation, is worth clearing up before anything else, because the two paths require completely different first moves. 

This guide walks through both in full, plus what happens afterwards, how to get professional representation if your case is complex, how to escalate a stalled case, and the specific complications self-employed filers run into that a general guide won’t cover.

Which Path Applies to You

Problem	You Received an IRS Letter	You Discovered It Yourself
What triggered this	The IRS’s own fraud detection flagged a return and sent Letter 5071C, 4883C, 5447C, or 5747C	Your e-file was rejected as a duplicate, unfamiliar wages appeared on your wage transcript, or you received an unrelated notice about income you didn’t earn
What to do first	Respond directly to the letter using the method it specifies, do not file Form 14039	File Form 14039 (or Form 14039-B for business/EIN identity theft)
Does the IRS verification process start?	Yes. Your response tells the IRS whether you filed the return in question and allows it to continue processing the case	No, filing the affidavit is what formally opens it
Common mistake	Filing Form 14039 anyway, “just in case”	Not filing anything and assuming the IRS will notice on its own

This is IdentityBastion’s practical routing guide, built directly from current IRS and Taxpayer Advocate guidance, not a formal IRS document, but the first decision that determines everything else in this process.

Path A: You Received an IRS Identity Verification Letter

The IRS uses several distinct letters depending on your specific situation, and the response method differs meaningfully between them, check the letter code in the top corner carefully before doing anything.

Letter 5071C is the most commonly issued version and offers the fastest resolution path: online verification at idverify.irs.gov, available seven days a week, typically taking 15–20 minutes. You’ll need a government-issued photo ID and an email address, since the IRS uses ID.me for identity proofing. A phone option is also listed on the letter if you’d rather not use the online tool. 

Letter 5071C, now also appearing in the newer CP5071 notice format, generally directs taxpayers to the IRS online verification service or the phone option provided in the correspondence (IRS).

Letter 4883C requires a phone call, no online option is available for this specific letter. Calls must happen during business hours with a Taxpayer Protection Program agent. If phone contact isn’t working, you can get an appointment for in-person Taxpayer Assistance.

Letter 5747C provides an in-person option only, and is used sparingly, if you receive this one specifically, you’ll need to schedule a Taxpayer Assistance Center visit rather than resolving it online or by phone (IRS).

Letter 5447C is the version sent to taxpayers with a foreign address, offering phone and mail verification options rather than the online tool (IRS).

Regardless of which letter you receive, tespond as soon as possible and follow the deadline and instructions stated in your specific notice or letter. The IRS warns that it cannot process the return until the required identity verification is completed.

If you did file the return referenced in the letter, verifying your identity confirms that and lets processing continue normally. If you didn’t file it, telling the IRS that through the same channel, online tool or phone call is what actually opens your identity theft case. At that point, you’re done with the intake step. No separate Form 14039 filing is needed or recommended.

Path B: You Discovered Tax Identity Theft Without Receiving a Letter

Some cases surface differently, your e-file gets rejected as a duplicate before any letter arrives, you notice wages on your IRS wage and income transcript that you never earned, or you receive an unrelated IRS notice referencing income or a return that isn’t yours. In this scenario, no letter has told you what to do yet, which means the responsibility to initiate the process falls on you.

File Form 14039, the Identity Theft Affidavit. As of 2026, the current Form 14039 can be completed online through the IRS’s digital form system, or submitted using the mailing address or fax number provided with the form (IRS Form).

Form 14039’s Section B is narrowly scoped to three specific scenarios: a fraudulent federal tax return filed under your SSN, a fraudulent dependent claim, or fraudulent use of your SSN or ITIN for employment purposes, the mechanism behind Social Security-based identity theft covered in our general identity theft guide. If your situation doesn’t fit one of these three categories, a different IRS process may apply instead of this specific form.

If the identity theft is business-related rather than personal, tied to your EIN instead of your SSN, the correct form is Form 14039-B, a separate document scoped specifically to business identity theft. This distinction matters directly for freelancers who’ve made the switch covered in our SSN vs. EIN guide. Business identity theft involving an EIN uses Form 14039-B rather than the individual Form 14039

What Happens After Either Path

Once a case is formally open, whether through a denied verification letter or a filed 14039, it moves into the IRS’s Identity Theft Victim Assistance (IDTVA) unit for investigation. It’s worth being precise about timelines here, since two very different numbers get used depending on what stage is being described. 

After you complete verification, the IRS says it may take up to nine weeks to process the return. A full identity theft investigation, once fraud is actually confirmed and a case is genuinely open, is the process our companion article on the effects of tax identity theft covers in detail, averaging close to two years as of the most recent National Taxpayer Advocate reporting, a dramatic gap from the IRS’s own stated 120-day target.

During this investigation, expect the IRS to require documentation establishing your identity and your actual tax situation, and expect the process can involve multiple verification, documentation and processing steps, which means delays at one stage can affect the overall timeline sequentially, which is part of why any delay on your end compounds rather than runs in parallel.

Getting Professional Representation

For a complex or significantly delayed case, hiring representation is worth considering, but it’s worth knowing who’s actually allowed to represent you before the IRS directly. For broad representation before the IRS, the main practitioner categories are attorneys, CPAs and enrolled agents. Some other individuals, including certain unenrolled return preparers, have limited representation rights under specific conditions.

If you do hire a Circular 230 practitioner, having them file Form 2848 alongside your identity theft paperwork lets them communicate with the IRS on your behalf, follow up on status, and handle correspondence. A valid Form 2848 allows an authorized representative to communicate with the IRS and receive specified tax information and notices on your behalf, though it doesn’t change the IRS’s own underlying processing timeline.

Escalating a Stalled Case

If your case sits without movement for an extended period and you’re experiencing genuine financial hardship as a result- a held refund you need for basic expenses, for instance, the Taxpayer Advocate Service (TAS) exists specifically to intervene in cases like this. TAS is an independent organization within the IRS, and you can request their involvement through Form 911, Request for Taxpayer Advocate Service Assistance. 

TAS can sometimes expedite a case showing genuine hardship, though it’s worth setting realistic expectations: given the current case volume, hundreds of thousands of taxpayers in the identity theft queue at once, TAS has its own capacity constraints and isn’t a guaranteed fast-track for every case.

Complications Specific to Self-Employed Filers

Filing your current-year return while a prior-year case remains open. An open identity theft case from a previous year doesn’t necessarily block you from filing your current return, but it can complicate it, particularly if the fraudulent activity affected figures the IRS uses as a baseline for your current filing.

Quarterly estimated payment calculations getting thrown off. Many self-employed taxpayers calculate estimated payments using a “safe harbor” based on the prior year’s tax liability. If a prior-year tax liability is disputed, don’t assume the figures on an unresolved return are correct for planning purposes. A tax professional can help determine how to calculate current-year estimated payments while the issue is being resolved.

EIN-based identity theft requiring an entirely separate form and process. As covered above, Form 14039-B, not the standard individual affidavit, applies if the fraud specifically touched your EIN rather than your personal SSN, which is a distinction general tax identity theft advice frequently glosses over.

Proving income to a lender or new client while a case is open. This effect is covered in depth in our companion article on the practical impact of tax identity theft, worth reviewing specifically if you need documented income for anything time-sensitive while your case works through the IDTVA queue.

What Actually Helps, and What It Doesn’t

Action	Solves	Doesn’t Solve
Checking the exact letter code before responding	Ensures you follow the correct process instead of wasting time on the wrong one	Doesn’t speed up the IRS’s own processing once you’ve responded correctly
Responding by the deadline stated in your notice or letter	Reduces the risk of avoidable delays in the verification process	Doesn’t change how long the underlying investigation itself takes
Filing Form 14039 or 14039-B only when actually needed (not after already denying a return via a verification letter)	Prevents creating a duplicate that adds processing time without benefit	Doesn’t resolve a case faster than the IRS’s own investigation timeline
Hiring a Circular 230 practitioner with Form 2848 for a complex case	Reduces your own burden of tracking and following up	Doesn’t change the IRS’s underlying processing capacity or timeline
Requesting Taxpayer Advocate Service help via Form 911 for genuine hardship cases	Can sometimes expedite a stalled case with real financial hardship	Isn’t guaranteed, given TAS’s own capacity relative to current case volume

Common Mistakes in the IRS Recovery Process

Filing Form 14039 after already denying a fraudulent return through a verification letter. This is the single most common, well-documented mistake covered at the top of this article, it doesn’t speed anything up and adds an unnecessary duplicate to your file.

Missing the 30-day response window on a verification letter. Since the clock starts from the letter’s print date, not when you actually see it, delays in checking your mail translate directly into lost response time.

Assuming any tax preparer can represent you directly with the IRS. Only Circular 230 practitioners, CPAs, enrolled agents, and attorneys, can file Form 2848 and communicate with the IRS on your behalf; a general preparer without one of these credentials has more limited standing.

Confusing individual and business identity theft forms. Using Form 14039 for EIN-based business fraud, or vice versa, routes your case through the wrong process entirely and requires correction before it can actually move forward.

FAQs: Working With the IRS After Tax Identity Theft

Bottom Line: Working With the IRS After Tax Identity Theft

The single most valuable thing to get right in this entire process is figuring out which starting point actually applies to you, an IRS letter you respond to directly, or a self-discovered situation requiring you to file Form 14039 or 14039-B yourself. Getting that wrong doesn’t just waste a little time; it can add weeks to a process that, once a genuine case is open, already averages close to two years.

Beyond that first decision, the highest-leverage moves are procedural rather than dramatic: respond within 30 days, use the correct form for personal versus business identity theft, and consider a Circular 230 practitioner or a Taxpayer Advocate Service request if your case is complex or stalled with real financial hardship attached.

What to Do Next

Tax identity theft is one specific type of fraud with its own dedicated government process, but the broader protective steps, like freezing your credit, apply regardless of which type of identity theft you’re dealing with. Our guide covers exactly how that works for a freelancer specifically.