You file your taxes. The IRS rejects your return. Someone already filed using your Social Security number. Or maybe a 1099 form shows up in January for a job you never had. Both are tax identity theft. Both start with the same nine digits.
In the first three quarters of 2025, over 31,000 Americans reported this kind of theft to the FTC. That's a 61% jump from four years before. Gig work is growing fast, and that makes a stolen SSN easier to misuse than ever.
Two ways criminals use a stolen SSN at tax time
Refund fraud. A criminal files your taxes before you do. They make up fake income and deductions. Then they send a big refund to a prepaid card. Months later, your real return bounces as a duplicate.
Employment identity theft. Someone uses your SSN to pass a job background check, often to drive for a gig app. Their income gets reported to the IRS under your name. Then you get a tax bill for money you never earned.
In early 2026, a man in Los Angeles got a 1099-K form from Uber. It showed $2,317 in income. He had never driven for Uber. Someone had used his stolen identity to pass Uber's background check and earn money under his name. It took weeks of back-and-forth before Uber fixed the form to show zero.
If this happens to you, fixing it takes time. The National Taxpayer Advocate's report to Congress says the average case takes 21 months to resolve. That's almost two years without the refund you may need now.
Why this keeps getting worse
You don't need a brand-new leak for this to happen. In 2024, Canada's Interior Health Authority confirmed an old data breach. The stolen records were decades old: Social Insurance Numbers, addresses, and birth dates from 2003. The data had been sold on Telegram since 2017, for about $1,000 a batch. Fraudsters used the stolen numbers to file fake tax returns and set up fake companies. Interior Health later said, “Due to the age of the data and its broad scope, IH was not able to accurately confirm where the information came from.” Some victims didn't learn their CRA account was hacked until 2020, three years after the data was first sold.
Old data doesn't expire. A record stolen in 2009 can still fund tax fraud today. That's why it's worth checking if your data is out there, whether you made the news this year or not.
Ask the IRS for an Identity Protection PIN. It's a 6-digit code that changes every year. Once you sign up, the IRS rejects any return that doesn't include your current PIN. Criminals can't file without it.
If you're already a victim:
- File Form 14039. If your e-file gets rejected, fill out the IRS Identity Theft Affidavit and mail it with your paper return.
- Demand a corrected 1099. Contact the company that issued it and ask for an amended form showing zero income.
- Check your IRS transcript. Your Wage and Income Transcript shows exactly what's reported under your SSN.
Was your SSN in a breach tied to your email?
Our free scan shows which known breaches contain your email and whether identity data was exposed alongside it.
Run the Free Breach Scan →