URGENT: REVIEW YOUR BUSINESS EIN, PAYROLL ACCESS, AND IRS NOTICES BEFORE FRAUD DISRUPTS YOUR NEXT FILING.
Quick Review: Business identity theft can involve a fraudulent return filed under a company’s EIN or employee SSNs used in payroll-related fraud. Warning signs include rejected returns, unexpected payroll notices, unfamiliar wage letters, and refunds sent to unknown accounts. Businesses should contact the IRS, secure payroll access, document the incident, and notify affected employees.
A New Channel for Evaluating Tax Identity Protection
A fraudulent tax filing under a business’s Employer Identification Number, or EIN, can be difficult to detect. The first warning may not arrive as a cybersecurity alert. It may appear when a legitimate business return is rejected, an unexpected payroll notice arrives, or an employee receives an IRS letter about wages from a company they left.
This type of tax identity theft differs from personal identity theft in several important ways. An EIN is used in ordinary business transactions and may appear on invoices, tax forms, vendor records, and public filings. Employee Social Security numbers also move through payroll providers, human resources systems, benefits platforms, and tax preparation workflows.
When criminals gain access to this information, they may file fraudulent business returns, submit false payroll forms, create fictitious employees, redirect refunds, or use employee SSNs to file individual tax returns. The result can include delayed filings, incorrect wage records, employee distress, IRS notices, and a lengthy recovery process.
How Employer Identity Fraud Happens
Business identity fraud generally involves misuse of information connected to the company, its tax accounts, or its employees. Criminals may obtain this information through phishing, compromised email accounts, data breaches, malicious insiders, exposed documents, or unauthorized access to payroll systems.
Several schemes are especially relevant to employers:
- Fraudulent business returns: A criminal files a return under the company’s EIN before the legitimate return is submitted.
- False payroll filings: A criminal submits Forms 941, 940, W-2, or other employment-related forms that the business did not prepare or authorize.
- Fictitious employees: False workers are added to payroll records, creating unfamiliar wage or withholding activity.
- Refund redirection: A refund is requested or sent to a bank account that does not belong to the company.
- Employee SSN misuse: Stolen W-2 or payroll data is used to file fraudulent individual returns or create other false records.
- Account takeover: An attacker changes the business address, payroll account information, authorized users, or electronic filing access.
The IRS explains that employers generally remain responsible for employment tax obligations even when a payroll service provider prepares or files returns on the employer’s behalf. Outsourcing payroll can streamline administration, but it does not remove the need for access controls, independent review, and account monitoring.
How Business EIN Fraud Differs From Personal Tax Identity Theft
Personal tax identity theft usually centers on an individual’s SSN or Individual Taxpayer Identification Number. Business identity fraud may involve an EIN, company formation details, payroll credentials, employee records, and tax professional or vendor access.
The differences matter for three reasons.
First, an EIN is commonly shared during legitimate business activity. It may appear on Forms W-9, invoices, loan documents, payroll records, and government filings. This wider exposure can make it difficult to determine when the number was obtained or how it was misused.
Second, business tax records may involve multiple people and systems. A company may use a payroll service provider, accounting firm, human resources platform, benefits administrator, tax preparer, and financial institution. Each connection can create another access point.
Third, the consequences can affect both the company and its workforce. A fraudulent business return may disrupt the employer’s account, while stolen W-2 data may create separate tax identity problems for current and former employees.
Warning Signs That a Business EIN May Be Misused
A business should investigate unexpected IRS or payroll activity promptly. A single notice can result from an administrative error, a transposed number, or normal processing. However, unexplained activity should not be ignored.
Common warning signs include:
- A legitimate business return is rejected. The electronic filing may be rejected because the IRS already has a return on file for the same tax period.
- An unexpected payroll notice arrives. The IRS may send a notice about an unfiled Form 941, Form 940, balance due, or other employment tax obligation the business does not recognize.
- Employees receive unfamiliar wage letters. Current or former employees may receive IRS correspondence about wages reported by a company or business unit where they never worked.
- A refund is directed to an unfamiliar account. The business may discover that a refund request includes bank information no one authorized.
- A notice references an unfamiliar EIN. An owner may receive correspondence about a business that the company never formed or an EIN it never requested.
- An amended return appears without authorization. The IRS account may show an amended filing that the business did not submit.
- Routine IRS correspondence stops arriving. An unauthorized address change may divert notices away from the business.
- Payroll records contain unfamiliar workers or changes. New employees, modified direct deposit details, or altered tax withholding information may indicate compromised access.
What to Do After Discovering Possible EIN Misuse
A structured response can help the business preserve evidence and streamline communication with the agencies and vendors involved.
1. Confirm the Activity
Review the notice, rejected return, payroll report, or IRS account information carefully. Compare the information with internal records and ask the payroll provider or tax professional whether the filing was submitted through an authorized process.
Preserve copies of notices, filing acknowledgments, rejection messages, suspicious emails, access logs, bank records, and relevant payroll reports. Do not delete potentially important evidence.
2. Contact the IRS Business and Specialty Tax Line
Call the IRS Business and Specialty Tax Line at 800-829-4933. The line is generally available Monday through Friday from 7 a.m. to 7 p.m. local time. The business should use contact information obtained directly from IRS.gov and be prepared to complete the IRS identity-verification process.
Ask the IRS to review the business account, confirm the filings or notices involved, and explain the next required steps. The business should record the date, time, representative’s name or identification information when available, and any reference number provided.
3. Complete Form 14039-B When Appropriate
The Form 14039-B, Business Identity Theft Affidavit, is used when a business, trust, estate, or tax-exempt organization’s name or EIN was used to submit fraudulent tax returns or Forms W-2.
The IRS identifies several situations that may require this form, including:
- A duplicate-return rejection for the same filing period
- A notice about a return the business did not file
- A notice about Forms W-2 filed with the Social Security Administration that the business did not submit
- A balance due the business does not owe
- A notice for a business that never applied for the EIN
The form must be signed and submitted with the requested supporting documentation. Incomplete forms or missing documents may delay processing. Businesses should follow the current filing instructions on the official Form 14039-B page.
4. Secure Payroll and Vendor Access
Contact the payroll provider, accounting firm, tax preparer, and other vendors with access to business tax or employee information. Request an investigation of access logs, recent changes, submitted forms, and bank account instructions.
The business should also:
- Reset administrator, payroll, email, and tax-filing passwords.
- Require multifactor authentication, which uses an additional verification method beyond a password.
- Remove former employees and unnecessary vendors from administrative access.
- Review user permissions and limit access according to job responsibilities.
- Verify bank account, address, and employee master-file changes through an independent channel.
- Preserve audit logs before systems overwrite older records.
- Confirm that payroll filings and deposits match the company’s internal records.
5. Notify Affected Employees
If W-2 or employee SSN information was exposed, the business should notify affected current and former employees promptly. Employees may need to review their IRS accounts, request an Identity Protection PIN, consider a credit freeze or fraud alert, and follow guidance from the Federal Trade Commission.
The IRS instructs businesses to report W-2 data loss by emailing dataloss@irs.gov with the subject line “W2 Data Loss.” Businesses should not attach employee SSNs, W-2s, or other sensitive personally identifiable information. The report should include the business name, EIN, contact information, summary of the incident, and approximate number of affected employees.
The business should also review state reporting requirements and consider filing a complaint with the FBI’s Internet Crime Complaint Center. Legal counsel, an incident-response specialist, or a qualified tax professional may be appropriate depending on the scope of the incident.
Where Identity Theft Protection Services Fit
Identity theft protection services can provide an additional monitoring and alert layer, but they do not replace IRS reporting, payroll security, or professional response procedures.
Tax Guardian focuses on monitoring IRS account activity for suspicious changes, filings, wage-related activity, and other signals associated with tax identity misuse. Depending on the selected plan and eligibility requirements, the service may provide alerts by text or email and recovery support when a concern requires follow-up.
Tax Guardian does not claim to prevent tax identity theft. Its role is to help provide visibility into suspicious IRS activity and streamline the response process. Employer-sponsored options may also help organizations make tax-focused monitoring available to eligible employees, subject to plan terms and enrollment requirements.
Businesses considering a service should review:
- Which IRS activity is monitored
- Whether employee-sponsored enrollment is available
- How alerts are delivered
- What support is available after an alert
- Which individuals qualify for coverage
- Applicable privacy practices, limits, exclusions, and terms
Companies can learn more about Tax Guardian’s identity theft protection services and review related information about IRS account transcripts.
Frequently Asked Questions
Can someone file a tax return using a company’s EIN?
Yes. A criminal may use a business name and EIN to submit a fraudulent business return, payroll form, amended return, or refund request. A rejected legitimate return or an unexpected IRS notice may be the first indication.
What form should a business use to report EIN-related tax identity theft?
A business generally uses Form 14039-B, Business Identity Theft Affidavit, when its name or EIN was used for fraudulent tax returns or Forms W-2. The business should review the current IRS instructions and include all required documentation.
Is the employer responsible if a payroll provider filed the fraudulent form?
Employers generally remain responsible for employment tax filing and payment obligations even when a third-party payroll provider performs those functions. The employer should contact the provider immediately, review authorization and access records, and coordinate with the IRS.
What should employees do if their W-2 information was stolen?
Affected employees should follow IRS identity theft guidance, review their tax accounts, consider an Identity Protection PIN, and evaluate whether a fraud alert or credit freeze is appropriate. The employer should provide timely notice and avoid sending employee SSNs through unsecured channels.
A Stronger Employer Response Starts With Visibility
Business EIN misuse can affect more than a single tax return. It can create incorrect payroll records, expose employee SSNs, redirect refunds, and force a company to coordinate with the IRS, payroll providers, financial institutions, state agencies, and affected workers.
The most effective response combines prompt verification, accurate IRS reporting, secure payroll access, employee communication, and ongoing attention to tax-account activity. Identity theft protection services can add visibility and alerts, while official IRS procedures and qualified professional guidance remain essential to recovery.
IRS source: Report Identity Theft for a Business
Disclaimer: Tax Guardian Software Solutions provides access to legal services offered by the Tax Guardian Network. None of the above corporate entities, nor its officers, employees, or sales associates directly or indirectly provide legal services, representation, or advice. Any forms provided are not legal advice and should not be construed as such. Readers should consult a qualified attorney or tax professional regarding their specific circumstances. Service availability, eligibility, coverage, limits, exclusions, and terms are subject to change.
© 2025-2026 Tax Guardian. America’s First Tax Identity Protection Suite™.
