LIMITED-TIME OFFER: 3 MONTHS FREE, USE CODE 90 FREE TRIAL
Quick Review: An unauthorized IRS Online Account sign-in does not automatically mean a fraudulent return was filed. However, account changes, transcript requests, payment activity, or altered profile details may signal broader IRS identity theft. Secure the account, preserve evidence, contact the IRS, and monitor related records promptly.
A New Channel for Evaluating Tax Identity Protection
Discover how IRS-focused monitoring can provide visibility into suspicious account activity and tax-record changes through Tax Guardian’s consumer protection resources.
An Unauthorized Sign-In Is a Serious Warning
Discovering that someone accessed an IRS Online Account without permission can be unsettling, particularly when the account still appears normal. A taxpayer may not see an obvious fraudulent return immediately, and some changes may surface only when a refund is delayed, a notice arrives, or a tax professional reviews an unfamiliar record.
An unauthorized sign-in is also different from a fraudulently filed tax return. A fraudulent return means someone used a taxpayer’s information to submit a return or claim a refund. An account takeover, by contrast, means someone gained access to the online account itself. That access could allow a person to:
- Change an address or other profile information.
- Request or download sensitive tax transcripts.
- Add or alter bank-account information for payments or refunds.
- Review tax balances, notices, payment plans, or filing details.
- Change account settings, recovery information, or authentication methods.
- Use information from the account to support additional identity theft.
These actions may be silent. An unfamiliar login does not prove that a return was filed, but it should be treated as a possible security incident until the account and related records have been reviewed.
Step 1: Sign In Directly and Document What Is Visible
The taxpayer should access the account by typing IRS.gov into the browser or using a trusted bookmark. Links in unexpected emails, text messages, or social media messages should not be used.
Before changing or deleting information, the taxpayer should preserve evidence. Screenshots and notes can help the IRS understand what happened later. The record should include:
- The date and time the unauthorized access was discovered.
- IRS emails or notifications about password resets or sign-ins.
- Unfamiliar profile details, addresses, phone numbers, or email addresses.
- Unexpected payments, payment plans, refund information, or account balances.
- Unknown transcript requests or downloads.
- Unfamiliar returns, income information, notices, or tax-year activity.
The IRS Online Account may not provide a complete security log that identifies every person who viewed the account. Therefore, a taxpayer should review every available section rather than relying only on a sign-in notification.
Step 2: Change the Password and Secure Connected Accounts
The IRS advises taxpayers who suspect identity theft to update the Online Account password and make it complex and unique. The new password should not be reused for email, banking, payroll, tax-preparation software, or other services.
The taxpayer should also:
- Confirm that the recovery email address and phone number belong to the taxpayer.
- Review the multifactor authentication method and remove unfamiliar options.
- Enable multifactor authentication if it is not already active.
- Change the password for the email account associated with the IRS account.
- Enable multifactor authentication on email, banking, and other sensitive accounts.
- Scan the device if the taxpayer clicked a suspicious link or opened an unexpected attachment.
Email security is especially important because control of an email account can allow an attacker to reset passwords for multiple services. If the same password was used elsewhere, it should be replaced immediately.
Step 3: Contact the IRS Identity Protection Specialized Unit
The IRS identity theft phone number for identity verification and related assistance is 800-908-4490. The IRS lists this number for taxpayers who need help with identity theft concerns. Representatives generally operate Monday through Friday, from 7 a.m. to 7 p.m. local time. International callers can use 267-941-1000, with hours listed by the IRS in Eastern Time.
When contacting the IRS, the taxpayer should clearly explain that the IRS Online Account was accessed without authorization. The taxpayer should ask what steps are needed to secure or review the account and what documentation may be required.
The IRS Identity Protection Specialized Unit is not the same as the general tax-account line. The IRS guide states that the identity-protection number cannot provide refund status or general tax-account answers. For ordinary tax-account questions, the IRS lists 800-829-1040.
Only numbers published on IRS.gov or printed on a verified IRS notice should be used. An unsolicited caller claiming to be from the IRS should not receive a password, multifactor authentication code, Social Security number, bank information, or payment.
Step 4: Request an Identity Protection PIN
An Identity Protection PIN, commonly called an IP PIN, is a six-digit number known to the taxpayer and the IRS. It helps prevent another person from filing a federal tax return using the taxpayer’s Social Security number or Individual Taxpayer Identification Number.
The fastest way to request an IP PIN is through the taxpayer’s secured IRS Online Account. Taxpayers who cannot establish an online account may have other options, including Form 15227 or an in-person appointment at an IRS Taxpayer Assistance Center, depending on eligibility.
An IP PIN does not repair an account takeover or remove unauthorized activity from IRS records. It is a separate protective measure that helps verify the taxpayer during the federal return-filing process. The number should not be shared except with a trusted tax professional when a return is being prepared and submitted.
Step 5: Review Tax Transcripts for Unknown Activity
Tax transcripts can reveal information that does not appear obvious from the main account screen. The taxpayer should review available records for unfamiliar filing activity, income documents, account changes, or other information connected to the Social Security number.
The IRS explains that transcripts can be accessed through the Online Account by selecting Tax Records and then Transcripts. Relevant records may include:
- Tax Return Transcripts, which show most line items from a filed return.
- Wage and Income Transcripts, which show information reported by employers and financial institutions.
- Tax Account Transcripts, which show account activity and adjustments.
- Record of Account Transcripts, which combines return and account information.
A taxpayer who sees an unfamiliar item should save a copy or screenshot and report it to the IRS. If an online transcript request cannot be processed because of possible identity theft, the IRS says the resulting message or letter should provide instructions for obtaining the record.
The transcript phone service, 800-908-9946, is different from the IRS identity theft phone number. It is intended for transcript requests and should not replace reporting unauthorized account access to the Identity Protection Specialized Unit.
Step 6: Consider a Credit Freeze and Broader Identity Review
An IRS account compromise may expose information that could be useful beyond tax fraud. The taxpayer should consider placing a free credit freeze with Equifax, Experian, and TransUnion. A freeze can restrict access to a credit file and make it more difficult for someone to open new credit accounts in the taxpayer’s name.
The taxpayer should also review:
- Bank and credit-card statements.
- Social Security earnings records.
- Health insurance and benefits accounts.
- Payroll or employer records.
- State tax accounts.
- Email forwarding rules and recovery settings.
The IRS recommends using IdentityTheft.gov for broader identity-theft recovery steps. Financial institutions should be contacted directly through official websites or statements if an unfamiliar account or transaction appears.
When Form 14039 May Apply
A taxpayer should not automatically file Form 14039, Identity Theft Affidavit, solely because someone signed in to an IRS Online Account. The form is generally relevant when the facts involve tax-related identity theft, such as a return filed using the taxpayer’s information, a fraudulent dependent claim, or another situation described by the IRS.
The IRS may direct a taxpayer to file Form 14039, or the taxpayer may use it to report certain suspected tax-related identity theft that the IRS does not already have on file. The IRS also states that many taxpayers should not file the form if they have already submitted it, received an IRS notice with different instructions, or are using the IRS Identity and Tax Return Verification Service.
The most important step is to follow the instructions that apply to the specific incident. A login compromise and a fraudulent return are related risks, but they are not automatically the same event.
Where Tax Guardian Fits
Traditional credit monitoring may not show what is happening inside a taxpayer’s IRS records. Tax Guardian is designed to monitor IRS accounts and transcripts for suspicious activity, including certain filing, income, and account-related signals, and to provide alerts when activity is detected.
Depending on the plan, Tax Guardian may also provide access to recovery support for eligible issues. It does not replace the IRS, an accountant, tax professional, attorney, or law-enforcement agency, and it does not claim to prevent tax identity theft.
Taxpayers can review available plans and features on the Tax Guardian plans and pricing page. The value of IRS-focused monitoring is visibility: suspicious activity may become known sooner, giving the taxpayer an opportunity to investigate and begin the appropriate recovery process.
Frequently Asked Questions
Does an unfamiliar IRS Online Account sign-in mean someone filed a tax return?
No. An unauthorized sign-in does not by itself prove that a fraudulent return was filed. It does mean the account should be secured and reviewed for unknown returns, transcript requests, profile changes, payment activity, or other suspicious records.
What is the IRS identity theft phone number?
The IRS Identity Protection Specialized Unit phone number is 800-908-4490. International callers can use 267-941-1000. Taxpayers should verify current hours and instructions on IRS.gov before calling.
Should a taxpayer immediately file Form 14039 after an unauthorized login?
Not necessarily. Form 14039 is generally used for specific tax-related identity-theft situations or when the IRS directs the taxpayer to file it. An unauthorized login should first be documented, reported to the IRS, and evaluated based on what the account and transcripts show.
Can a credit freeze protect an IRS Online Account?
A credit freeze can help restrict new-credit applications, but it does not secure an IRS Online Account. The taxpayer must change the IRS password, secure the email account, confirm multifactor authentication, contact the IRS, and review tax records separately.
A More Informed Response to IRS Account Takeover
An unauthorized IRS Online Account access should be treated as an early warning, not dismissed because no fraudulent return is immediately visible. Securing credentials, preserving evidence, contacting the IRS, requesting an IP PIN, reviewing transcripts, and considering a credit freeze creates a practical response sequence.
The IRS identity theft guide for individuals provides the official starting point for reporting, recovery, and prevention resources. Acting promptly can streamline communication with the IRS and help the taxpayer identify whether the incident involved only account access or broader tax-related identity theft.
Disclaimer: Tax Guardian Software Solutions provides access to legal services offered by the Tax Guardian Network. None of the above corporate entities, nor its officers, employees, or sales associates directly or indirectly provide legal services, representation, or advice. Any forms provided are not legal advice and should not be construed as such. You should consult with a lawyer to confirm the form meets your needs. Use of this website and the services is subject to Tax Guardian Software Solutions terms of service and data protection addendum.
© 2025–2026 Tax Guardian. America’s First Tax Identity Protection Suite™.
