How Can Fraudsters Use Your Identity to Create a Fake Tax Preparation or Refund Account?

Tax season attracts criminals because a single successful attempt can yield a quick payout. If a fraudster has enough of your personal information, they can create or hijack a tax preparation or refund account in your name, file a return, and redirect the refund before you ever know what happened. This guide explains how the scam works, the warning signs to watch for, and the practical steps to protect yourself and respond quickly if something looks off.

How Fraudsters Build a Fake Tax Preparation or Refund Account

Creating a fake tax or refund account usually requires a combination of your personal details and access to an email or phone number that they control. Here’s how the process commonly unfolds:

• Collecting your data: Criminals pull your name, address, date of birth, Social Security number (SSN), and sometimes prior-year tax info from data breaches, public records, or data brokers. They may add details from social media or phishing emails.
• Setting up or hijacking an account: They create a new profile on a tax prep platform using your identity, or try to reset the password on an existing account by intercepting one-time passcodes (SIM swap, compromised email, or phone number spoofing).
• Filing a fraudulent return: Using fabricated W-2s or 1099s, they file early in the season to beat your legitimate return.
• Redirecting the refund: They choose a payout method they control—prepaid debit card, newly opened bank account, or third-party payout rails. Some use refund advances or “cash out” using rapid transfer services tied to the account.
• Covering tracks: They change contact details in the tax platform so alerts go to them, not you, and they may file “auth” documents to delay verification long enough to get paid.

Where Criminals Get the Details They Need

Fraudsters don’t need to hack you directly. They often compile a profile from multiple sources:

• Data breaches: Exposed SSNs, W-2s, or payroll records can fuel instant filing fraud.
• Data brokers and people-search sites: Address history, DOB, phone numbers, and relatives help pass knowledge-based checks.
• Phishing and impostor support: Fake “IRS” or tax software emails that capture logins or MFA codes; phone calls pretending to be tax support to “verify” your identity.
• Mailbox theft and account notifications: Paper tax forms or IRS letters intercepted from unsecured mailboxes provide key numbers and timelines.

Common Attack Paths You Should Recognize

• New account in your name: The fraudster sets up a brand-new account on a tax prep site with your SSN but their email and phone.
• Account takeover (ATO): Your existing tax software account gets reset via compromised email inbox or intercepted one-time codes.
• Fake employer income: Fraudsters submit fabricated W-2s or 1099s to inflate a refund.
• Refund diversion: The return is legitimate but the direct deposit info is changed to the fraudster’s account or prepaid card.
• State tax filing fraud: Criminals often target state returns first because state systems can have different protections and timing.

Early Warning Signs to Watch For

Tax-refund fraud often surfaces outside of traditional credit monitoring, so watch for operational clues:

• IRS rejection notice: You try to e-file and get a message that a return for your SSN is already on file.
• Unfamiliar tax software emails: “Welcome,” “verify your email,” MFA codes, or password resets from a provider you don’t use.
• Unexpected IRS or state letters: Notices about a suspicious return, identity verification requests (for example, a 5071C letter), or a refund issued that you didn’t receive.
• Strange two-factor prompts: Unsolicited login codes for your tax software or email.
• Mail issues: Missing W-2/1099 forms or intercepted postal mail in January–March.

Why This Fraud May Not Show on Your Credit Report

Many victims are surprised that these crimes don’t appear in traditional credit alerts. That’s because:

• No new loan or line of credit: A fake tax filing is not a credit-based event, so bureaus may not capture it.
• Alt-rails payouts: Refunds routed to prepaid cards or payment apps don’t require a hard inquiry.
• Internal-only changes: Fraudsters change contact info within a tax platform without touching your credit file.

To learn more about how off-credit fraud can happen, see our guide: Why Can Fraud Happen Without Appearing on Your Credit Report?

How to Reduce Your Risk Before Tax Season

• Create and secure your IRS online account: Set it up early and enable two-factor authentication (app-based or security key if available). Do the same for your state tax account.
• Claim your profile on your preferred tax prep software: If you’ll use an online provider, register with your email and phone now to preempt squatters, and enable strong MFA.
• Use app-based MFA, not SMS when possible: Authenticator apps or passkeys reduce SIM-swap risk.
• Get an Identity Protection PIN (IP PIN) from the IRS: This six-digit PIN must be included on your return, blocking fraudsters who don’t have it. Many taxpayers can opt in.
• Minimize public data: Remove or suppress your personal details from people-search sites to make knowledge-based checks harder.
• Secure your email first: Your inbox is the key to password resets. Use a unique, long passphrase and MFA.
• Protect physical mail: Consider a locking mailbox and collect W‑2/1099 forms promptly. Go paperless where offered.

What to Do If You Suspect a Fake Tax Preparation or Refund Account

If something looks off—suspicious emails, rejection when filing, or a notice you didn’t expect—act quickly. The order below helps limit damage and preserve evidence:

1. Secure your email and phone first: Change your primary email password and enable MFA; contact your mobile carrier to add a high-security note or port-out PIN to reduce SIM-swap risk.
2. Check your tax software accounts: Attempt to sign in to all tax prep platforms you’ve used. If locked out, start account recovery immediately and change associated emails/phones back to yours.
3. Create or sign in to your IRS online account: Review recent activity and correspondence. If asked to verify identity due to a suspicious filing, follow the instructions promptly.
4. Request or confirm your IRS IP PIN: If you don’t already have one, enroll; if you do, make sure it hasn’t been changed. Keep the PIN private.
5. Contact the tax software provider’s fraud team: Report the unauthorized account or filing, ask them to lock the account, and request logs of recent changes if available.
6. Respond to IRS/state letters: If you receive a 5071C (or similar) identity verification letter, complete the verification steps through the official site or phone number listed.
7. File an identity theft affidavit: If a fraudulent return was filed, complete the IRS Form 14039 (Identity Theft Affidavit) and follow the IRS guidance for next steps.
8. File your real return by mail if required: The IRS may ask you to paper-file with proof of identity if your e-file is blocked.
9. Notify your state tax agency: Report suspected state tax fraud; many states offer their own PINs or holds.
10. Preserve evidence: Save emails, screenshots, headers, and provider responses. They can help with investigations and recovery.

How Criminals Bypass Verification—and How You Can Counter It

• One-time codes: Attackers trick victims into sharing codes or intercept via SIM swap. Counter with app-based MFA and never share codes.
• Knowledge-based questions: Answers can be guessed from data brokers or public records. Counter by reducing your public footprint and opting into stronger verification (ID upload, selfie match) when available.
• Email compromise: Password reuse or weak passwords lead to takeover. Counter with unique passphrases and a password manager.
• Support impersonation: Scammers pose as IRS or software support. Counter by initiating contact only through official sites; do not trust inbound calls, links, or pop-ups.

Monitoring That Actually Helps for Tax Fraud

Because refund fraud may not trigger a credit inquiry, you need to layer your monitoring:

• Account alerts: Turn on login, password change, email/phone change, and payout change alerts in your tax prep account and email provider.
• Bank and card alerts: Enable transaction, new payee, and external transfer alerts for accounts that could receive refunds.
• Credit and identity monitoring: While tax fraud may not hit your credit directly, identity thieves often commit multiple types of fraud. Monitoring can surface new accounts or identity activity that follows. If a financial alert looks odd, first verify the source and the account details before reacting. For a quick triage process, see: What Should You Check First When a Financial Alert Looks Suspicious?

After you’ve worked through the protections above, you can optionally evaluate a consolidated toolset for credit and identity monitoring here: SmartCredit for Privacy, Credit Monitoring, and Identity Protection.

If Your Refund Was Stolen: What Recovery Looks Like

Recovery is possible but can take time. Prepare for verification steps and follow-ups:

• IRS processing time: If a fraudulent return was filed, the IRS may need additional time to resolve the identity theft case before issuing your refund.
• State timelines vary: State agencies may have separate processes; keep copies of everything you submit.
• Monitor for follow-on fraud: Thieves who have your SSN might attempt unemployment, benefits, or loan fraud later in the year.

Practical Prevention Checklist

• Enroll in the IRS IP PIN program and secure your IRS/state accounts with strong MFA.
• Register and lock down your preferred tax software account before tax season.
• Use a password manager and app-based MFA for email and financial accounts.
• Reduce your digital footprint on data broker sites; remove exposed personal data.
• Collect tax forms early; use a locking mailbox and consider USPS Informed Delivery.
• Beware of unexpected emails or calls about “tax verification”—go to the official website manually.
• Keep device software up to date and use security scans to reduce malware risks.

FAQ

Can someone file taxes in my name without my W-2?

Yes. Criminals can submit fabricated W-2s or 1099s with your SSN. The IRS often detects inconsistencies, but criminals aim to cash out before mismatches surface.

Will freezing my credit stop tax refund fraud?

A credit freeze is excellent for stopping new credit accounts but does not directly block tax filing fraud. Use an IRS IP PIN and secure your tax accounts as well.

What if I already filed and my refund was diverted?

Contact the IRS immediately and follow their guidance for refund trace and identity theft procedures. Report the incident to your state agency if applicable.

Do I need to file a police report?

Some institutions may ask for it. Filing a report and an identity theft affidavit can help document the crime, but follow IRS and state instructions first for tax-specific steps.

Conclusion

Fraudsters target tax preparation and refund systems because a single successful filing can pay out quickly—and the crime may never appear on your credit report. By securing your IRS and state accounts, enrolling in an IP PIN, locking down your email and tax software profiles with strong MFA, and reducing your public data exposure, you make this type of fraud much harder to pull off. If warning signs appear, act quickly: recover accounts, verify with the IRS, file required affidavits, and monitor for follow-on fraud. A few steps taken before and during tax season can protect your refund and your identity for years to come.