What to Do If Someone Used Your EIN

Short answer: First, work out which problem you have. Either someone is misusing your real EIN (fake returns, wage reports, credit applications), or an EIN was created in your name that you never requested. Contact the relevant institution or state agency, and follow IRS guidance if the matter involves fraudulent tax filings or an EIN assigned to a business you never requested. Keep copies of everything.

Among the situations where the IRS says to file Form 14039-B, the Business Identity Theft Affidavit, is receiving a notice about a business you never applied for. That one line captures why EIN problems confuse people. The notice often arrives with no explanation, and the fix depends on what actually happened (IRS).

If you freelance, run an LLC, or file as a sole proprietor, your EIN may be on W-9s in dozens of client inboxes. This guide covers what “someone used my EIN” can mean, the nine steps in order, when the affidavit is the wrong tool, and what to expect. [SSN vs EIN risks for freelancers]

Two Different Problems With One Name

“Someone used my EIN” describes two situations that need slightly different handling. Mixing them up is how people end up on hold with the wrong department.

Problem	Your real EIN was misused	An EIN was created in your name
What happened	Someone used a number you legitimately hold	A new EIN exists that you never requested
How you find out	IRS notice about returns or wages you didn’t report, a creditor call, a business credit alert, a state registry change	An IRS letter (such as a CP 575) or notice about a business you never formed
Main risk	Fake filings, fraudulent credit, tax mismatches	A shell business used for fraud, fake wage reports, or loans under your name
First move	Confirm with the IRS what was filed under your EIN	Confirm no one you know requested it, then report
Shared steps	Form 14039-B, credit checks, state registry check, documentation	Same

Why it matters: your real EIN can be reached through documents you shared. A new EIN in your name usually means someone obtained your personal identifiers, often your SSN, and that points to personal-side protection too (see Step 7).

Rule Out Legitimate Requesters First

Before assuming fraud, check for an innocent explanation. The IRS notes that people receive EIN letters they didn’t personally request for ordinary reasons. Ask:

• Your spouse or business partner: did either apply for a business, partnership, or trust?
• Your accountant or bookkeeper: did they open an EIN on your behalf for a new entity?
• A bank, lender, or executor: estates, trusts, and some account types trigger EIN applications.
• An association or organization you belong to: some groups obtain numbers tied to a responsible party.

If someone legitimate requested it, the issue may be resolved with a quick conversation. If no one did, treat it as fraud.

The Nine Steps: What to Do If Someone Used Your EIN

Step 1: Gather your documents

Collect your original EIN confirmation (CP 575 or a 147C verification letter), any IRS notice about the suspicious number, recent business tax filings, and bank and credit statements. Write down dates, notice numbers, and what each document says.

You can also reach the IRS Business & Speciality Tax Line, which the Taxpayer Advocate Service lists as 800-829-4933. Confirm the current number and hours on IRS.gov before calling (IRS).

Step 2: File Form 14039-B

Form 14039-B is the IRS Business Identity Theft Affidavit. It tells the IRS your business identity may have been compromised so it can review the issue and take appropriate action. File it online through the IRS process (which uses ID.me verification), or follow the mail or fax instructions on your notice or the form . Use the method the IRS directs for your situation.

Don’t guess at fax numbers or addresses from old web pages. Take them from the current form or notice.

Step 3: Respond to any IRS notice directly

If the IRS sent a notice, follow its instructions and attach your affidavit and supporting documents where it tells you to. A notice has its own deadline and reply path. A standalone affidavit does not replace the response a notice asks for.

Step 4: Check your business credit

Business credit files are separate from personal credit reports. Look at the major business credit bureaus, Dun & Bradstreet, Experian Business, and Equifax Business, for accounts, inquiries, or addresses you don’t recognize. Some reports are free to view; others require an account or fee.

Look for new tradelines, unfamiliar addresses, or changed business names. Dispute any fraudulent item with the bureau in writing.

Step 5: Check your state business registry

Fraudsters sometimes change registered-agent or address details on a real business at the Secretary of State, then use the altered record for fraud. State guidance from NASS, Colorado, Ohio, and California covers this scheme.

Search your business name on your state’s registry. If anything changed that you didn’t authorize, contact the state office and ask for certified copies of the filing history before you correct anything. Save copies of the current record and any suspicious filings before requesting corrections. Ask the state office what certified or official records it can provide.

Step 6: Notify banks and creditors

Tell any bank, lender, or vendor involved in the fraud, in writing, and ask for their fraud-department process. If government-backed loans are involved (for example, SBA programs), report potential fraud to the SBA Office of Inspector General as well. Confirm the correct channel for your case on SBA.gov.

Step 7: Protect the personal side

An EIN problem often has a personal-identity component. Consider:

• Credit freezes at Equifax, Experian, and TransUnion (free under federal law) 
• An IRS Identity Protection PIN for your personal return
• Social Security’s “Block Electronic Access” if you don’t want online access to your record (SSA)

Note that there’s no federal “business credit freeze” equivalent, so Step 4’s monitoring is your main business-credit control.

Step 8: Keep your EIN information current

Make sure the IRS has your correct business address and responsible party. Form 8822-B is the IRS form for a change of address or responsible party for a business (Form 8822-B). Update it if something was altered, once the investigation is documented.

Step 9: Document everything

Keep a log: who you contacted, when, what they said, and reference numbers. Save copies of every form and letter. If this escalates to a dispute, your timeline is your strongest asset.

When Not to File Form 14039-B

The IRS says the affidavit is not for every EIN-related problem. If your EIN or business information was exposed in a data breach but you see no tax impact (no notices, no mismatched filings), the IRS does not want an affidavit for exposure alone. In that case:

• Monitor your business credit and tax account.
• Watch for IRS notices.
• File the affidavit only if misuse shows up.

This mirrors the personal-side rule: exposure is a risk, not a crime in progress.

How EINs Get Misused: Five Vectors

1. Fraudulent returns and wage reports. A thief files a business or payroll return under your EIN, or reports wages in your business’s name. You find out through an IRS notice or a mismatch with your own filings. Closes it: check IRS notices promptly and review your business tax account.

2. State registry hijacking. Someone alters your registered agent or address on file with the state, then uses the record to look legitimate to lenders and vendors. Closes it: periodically look up your business on the Secretary of State site.

3. Credit and account fraud. Using your business name and EIN, a thief applies for trade credit, cards, or loans. Closes it: watch business credit files and respond quickly to vendor or collection inquiries.

4. A new EIN in your name. With your personal identifiers, someone applies for an EIN and builds a shell business. Closes it: protect your SSN, freeze personal credit, and use an IP PIN.

5. Business impersonation. Someone poses as your business to invoice clients or redirect payments. Closes it: tell clients how you’ll communicate payment changes and verify bank-detail changes by phone.

For freelancers, the usual exposure point is the W-9, which can carry your name, address, and either an SSN or EIN [identity theft risks of sharing W-9 forms].

What Each Step Does and Doesn’t Solve

Action	What It Solves	What It Doesn’t Solve
Form 14039-B	Flags your IRS business account so the IRS can protect it and review filings	Doesn’t fix credit damage, state registry changes, or creditor disputes
Business credit monitoring	Reveals fraudulent tradelines and inquiries	Doesn’t stop applications from being made
State registry check	Catches altered agent or address records	Doesn’t address federal tax issues
Personal credit freeze	Helps prevent new personal credit accounts by restricting access to your credit report	Doesn’t freeze business credit files
IRS IP PIN	Helps prevent someone from filing a fraudulent federal tax return using your SSN or ITIN	Doesn’t protect business filings
Paid monitoring service	Can shorten time to detection	Many policies exclude business or self-employment losses (see our analysis)

[Is identity theft protection worth it for freelancers]

Common Mistakes

1. Filing the affidavit on top of replying to an IRS notice. If you got a notice, answer the notice as instructed. Don’t treat the affidavit as a substitute.
2. Skipping the “who requested it?” check. A spouse, partner, or accountant is a common innocent source of an unexpected EIN letter.
3. Checking only personal credit. Business credit is a separate file at separate bureaus.
4. Correcting the state record before saving evidence. Get certified copies of filing history first.
5. Phoning in, then relying on memory. Without a written log, you can’t prove what was said.
6. Assuming an EIN means you’re protected from SSN exposure. Many people still have personal identifiers in the mix. Handle both sides.

FAQ: What to Do If Someone Used Your EIN

Bottom Line: What to Do If Someone Used Your EIN

Start by identifying which problem you have: a misused real EIN or a new EIN you never requested. Rule out legitimate explanations, file Form 14039-B when misuse is real, respond to any IRS notice directly, then check business credit and your state registry. Lock down the personal side with a freeze and an IP PIN, and keep a written record of every step.

For most freelancers, the lasting fix is reducing how often your SSN and EIN travel by email and by form.

What to Do Next

Business identity theft often falls outside what consumer protection plans cover. Before you decide whether a paid service is worth it, see what bureau-sponsored insurance summaries actually exclude for self-employed and business losses.