Signs Your Tax Preparation Profile Is Being Targeted Before Filing Season Opens

Tax-season fraud starts long before the IRS begins accepting returns. Criminals use the quiet weeks leading up to filing season to probe tax software logins, harvest personal information, and position themselves to file a fake return in your name on day one. Recognizing the earliest signs can save you weeks of stress and help you keep your refund, identity, and privacy intact.

Why scammers target you before filing opens

Fraudsters thrive on being first. If they can create or take over your tax preparation profile ahead of you, they can submit a fraudulent return early and route the refund to their accounts. They gather the data they need—from past breaches, data brokers, phishing emails, and reused passwords—then test it quietly while you’re not watching.

Early warning signs your tax prep profile is in the crosshairs

Watch for these signals in the weeks before filing opens. A single odd event might be benign, but two or more in close succession strongly suggests targeting.

1) Unexpected password resets or security alerts

• You receive “Password changed,” “Security settings updated,” or “New device signed in” emails from tax preparation services you use—or used years ago.
• Login alerts reference locations, browsers, or times that don’t match your activity.
• Reset links arrive even though you didn’t request them.

Action: Do not click links in the alert email. Instead, go directly to the provider’s site, sign in from a trusted device, and review recent activity and sessions. Change your password and enable multi-factor authentication (MFA) if not already enabled.

2) One-time passcodes (2FA codes) you didn’t request

• Unsolicited SMS or email verification codes from your tax software or the IRS Identity Protection PIN portal.
• Multiple code messages in short succession, suggesting automated login attempts.

Action: Assume someone is trying to authenticate as you. Immediately change your password, rotate your MFA method (e.g., from SMS to an authenticator app), and revoke any “remembered devices.”

3) New account verification emails from unfamiliar tax services

• “Confirm your account” messages from tax brands you never signed up for.
• “Welcome” emails followed by requests to complete your profile.

Action: Do not click. Delete or mark as phishing. Criminals may be testing whether your email is active or creating accounts with your details.

4) Suspicious activity with old or dormant accounts

• Tax software you last used years ago shows recent logins or security questions changed.
• Archived returns are accessed or downloaded without your knowledge.

Action: If you no longer use an account, sign in and delete it or remove stored data if possible. At minimum, update the password and ensure MFA is enabled.

5) Mail oddities: notices you weren’t expecting

• IRS mail about an online account being created or accessed that you didn’t initiate.
• State tax agency letters requesting identity verification outside filing season.
• Prepaid debit cards or banking mailers you didn’t request, possibly tied to refund routing.

Action: Real mail from the IRS arrives in an official envelope. Follow instructions to contact the IRS using the phone number listed on the notice (not a number in an email). If you suspect fraud, initiate Identity Theft Affidavit Form 14039 as directed by the IRS.

6) Phishing that is oddly specific to your tax life

• Emails or texts that use the exact name of your tax software, accountant, or bank, urging “pre-season verification.”
• Spoofed domains (e.g., “intuit-support.com” instead of the official site) and shortened links.

Action: Hover over links, verify sender domains, and sign in only from bookmarks or the official app. Report phishing to the provider and delete the message.

7) Data broker listings with tax-relevant details

• Your full name, current address, former addresses, and year of birth exposed on people-search sites.
• Employment history and relatives listed, aiding knowledge-based verification guesses.

Action: Remove or suppress your profiles on major data broker sites. Reducing exposed personal data makes it harder for criminals to pass verification and social-engineer support agents.

8) Sudden bank or credit monitoring pings

• New account inquiries, attempted account openings, or micro-deposits without your action.
• Alerts about address or phone number changes on existing accounts near tax season.

Action: Freeze your credit with all three bureaus and review alerts closely. Criminals often set up drop accounts to receive fraudulent refunds.

How attackers get in: the common playbook

Understanding attacker methods helps you block them efficiently:

• Credential stuffing: Reusing the same email and password across sites lets breached logins unlock your tax account.
• Phishing and MFA fatigue: Tricking you into sharing credentials or spamming 2FA prompts until you approve one by accident.
• Account recovery abuse: Guessing or finding answers to security questions from public data, social media, and data brokers.
• Support social engineering: Calling customer support with your exposed details to reset access.
• Device seeding: Adding a “trusted device” before you notice, then bypassing some security checks later.

Immediate steps if you notice warning signs

Act fast and stack your defenses in the order below. The goal is to stop access, remove attacker footholds, and reduce the surface area of your personal information.

1. Secure your tax software accounts now. Sign in from a trusted device and:
   • Change the password to a unique 16+ character passphrase.
   • Enable MFA using an authenticator app or security key; avoid SMS if possible.
   • Review account activity, connected apps, and remembered devices; sign out of all sessions.
   • Remove saved bank accounts or update deposit info only after you’re secure.
2. Lock down your IRS identity.
   • Create or secure your IRS online account before criminals do.
   • Apply for an Identity Protection PIN (IP PIN). This is a 6-digit code the IRS requires on your return; without it, e-filing in your name is rejected.
3. Freeze your credit and monitor for changes.
   • Place free security freezes at Equifax, Experian, and TransUnion.
   • Enable transaction and new account alerts with your bank and credit cards.
4. Audit your email security.
   • Secure the email addresses tied to tax accounts with strong, unique passwords and MFA.
   • Check filters and forwarding rules for silent exfiltration.
5. Reduce exposed personal data.
   • Opt out of major data brokers and people-search sites listing your info.
   • Remove high-risk details from public social profiles (address, phone, birth date, employer).
6. Document and notify.
   • Save suspicious emails and screenshots of alerts or logins.
   • Notify your tax software provider’s fraud team and your state tax agency if you see account takeover signs.

Set your “pre-season” security checklist

Build these tasks into your routine each December–January so you’re already protected before e-filing starts.

• Claim your accounts early: Create or log in to your IRS, state tax, and tax software accounts before criminals do.
• Turn on strong MFA everywhere: Prefer authenticator apps or security keys; back up recovery codes securely.
• Refresh passwords: Use a password manager; rotate any password reused elsewhere.
• Enable login alerts: Email and push notifications for new devices, password changes, and profile edits.
• Enroll in an IRS IP PIN: Renew annually; store the PIN securely and never share it by email or text.
• Harden your email: Add MFA, review security logs, and ensure recovery emails/phones are current.
• Verify refund routing: Confirm the last four digits of your bank account and your mailing address before filing season opens.
• Reduce public exposure: Systematically remove your info from data brokers; keep phone and address off public social posts.

If a fraudulent return is filed in your name

Even with preparation, fraud can still happen. If you learn a return was filed before yours:

1. File identity theft documentation: Complete IRS Form 14039 and follow the instructions from any IRS notice you received.
2. File your real return by paper if instructed: Include Form 14039 and any verification documents.
3. Notify your state revenue department: Many states have their own identity verification process.
4. Preserve evidence: Keep letters, screenshots, and call logs.
5. Extend monitoring: Watch for new accounts, collection notices, or address changes tied to your identity.

Common myths that put you at risk

• “I’m safe if I don’t file early.” Waiting makes you easier to beat. Fraudsters rely on being first.
• “SMS codes are enough.” SIM-swaps and phishing can bypass SMS. Use an authenticator app or security key when possible.
• “My info isn’t public.” Data brokers often list addresses, relatives, and employment history—exactly what attackers need for account recovery questions.
• “I’ll notice right away.” Many victims learn about fraud from an IRS letter weeks later. Early account alerts and monitoring are critical.

How privacy exposure fuels tax fraud

Tax fraud isn’t only about your Social Security number. Attackers assemble a mosaic of details to impersonate you effectively:

• Addresses and dates: Aid knowledge-based authentication and state filing questions.
• Employer info and pay cycles: Make phishing lures sound legitimate (“verify your W-2 delivery”).
• Phone numbers and emails: Enable password resets and SIM-swap attempts.
• Relatives and prior names: Support calls and identity quizzes.

Reducing what’s publicly available limits their ability to pass verification checks and manipulate support staff.

Privacy tools and monitoring that help

Consider a layered approach:

• Password manager: Creates unique, long passwords and stores recovery codes securely.
• Authenticator app or security key: Stronger MFA than SMS; resists phishing.
• Credit and identity monitoring: Alerts you to new accounts, inquiries, and changes that often accompany tax fraud attempts.
• Data broker opt-outs: Reduce the raw material criminals use to reset accounts.

If you want ongoing alerts about credit changes, new account attempts, and identity-related activity—signals that often correlate with tax fraud—consider using a dedicated monitoring solution such as SmartCredit for privacy, credit monitoring, and identity protection. It complements good privacy hygiene by surfacing changes quickly so you can act.

Red flags checklist you can scan in 60 seconds

• Unsolicited password resets or 2FA codes from tax or IRS services
• Login alerts from unknown devices or locations
• Verification or “welcome” emails from tax brands you never used
• IRS or state letters about account activity you didn’t start
• Bank or credit notifications about new accounts or micro-deposits
• People-search sites listing your address, relatives, and employer
• New forwarding rules or filters in your email account

When to escalate

Seek help immediately if you notice any of the following:

• Confirmed account takeover of your tax software or IRS account
• Evidence a return was filed in your name
• Multiple institutions reporting identity changes you didn’t make
• Signs of a SIM-swap (phone loses service unexpectedly, then 2FA codes stop arriving)

In these cases, contact your tax provider’s fraud team, your state tax agency, your mobile carrier (for SIM-swap), and consider filing an FTC Identity Theft report to create a recovery plan.

Conclusion

Fraudsters prepare for tax season just like you do—only earlier. The strongest defense is to claim and secure your accounts before filing opens, add resilient MFA, trim your public data exposure, and watch for early warning signs like unsolicited codes, password-change notices, or unfamiliar login alerts. Move quickly when something looks off: change credentials, enable an IRS IP PIN, freeze your credit, and monitor for new activity. A few proactive steps now can prevent weeks of cleanup later and keep your refund—and identity—where they belong.