What Steps Should You Take If a Breach Includes Copies of Your Filed Tax Returns?

If a data breach includes copies of your filed tax returns, act quickly. A completed tax return often contains your full name, address, Social Security Number (SSN), spouse and dependents’ SSNs, employer information, income, bank account and routing numbers for refunds, and even your signature. That is enough to fuel tax refund fraud and broader identity theft. This step-by-step plan shows how to respond immediately, what to do this week, and how to protect yourself through tax season and beyond.

How Serious Is a Breach of Filed Tax Returns?

Tax returns are one of the most sensitive documents a person has. They combine high-value identifiers (SSN, date of birth), financial details, and contact information. If criminals get this data, they can attempt to:

• File a fake tax return to steal your refund
• Open loans or credit lines using your SSN
• Change your address with the IRS to intercept notices
• Target your dependents for identity misuse
• Impersonate you with banks, insurers, or benefits programs

Because of this, you should treat a tax-return breach as a high-risk identity event and take layered defensive actions.

First 24 Hours: Contain the Risk

1) Confirm exactly what was exposed

Review the breach notice carefully. Determine whether full returns, partial records, or attachments (W-2s/1099s) were exposed, whose data was included (you, spouse, dependents), and the exposure timeframe. Save the notice and any reference numbers.

2) Change passwords and enable two-factor authentication

Update passwords for email, your IRS online account, tax software, and your bank accounts. Turn on two-factor authentication (2FA) everywhere possible. Email control is critical—if criminals control your inbox, they can reset other accounts.

3) Place a free fraud alert (or go straight to a credit freeze)

A fraud alert tells lenders to take extra steps before issuing credit in your name, and it lasts one year (extendable). You can also place a credit freeze with all three bureaus to block new credit entirely until you thaw it.

• Experian: Freeze/alert via their website or phone
• Equifax: Freeze/alert via their website or phone
• TransUnion: Freeze/alert via their website or phone

Freezes are stronger than alerts. If you don’t plan to apply for credit soon, freeze all three.

4) Inform your bank and monitor recent transactions

Call the bank account(s) listed for tax refunds. Ask for heightened monitoring, turn on transaction alerts, and consider changing account numbers if your routing/account numbers were on the filed return and you’re at elevated risk.

5) Secure dependents’ identities

If your return lists a spouse or dependents (including children with SSNs), extend fraud alerts or freezes to them as well. Child identity theft often goes unnoticed for years.

This Week: Block Tax Fraud and Tighten Your Defenses

6) Get or confirm your IRS account and set strong security

Create or sign in to your IRS online account and enable the strongest available authentication. This helps you spot notices quickly, view transcripts, and manage your security settings.

7) Apply for an IRS Identity Protection PIN (IP PIN)

An IP PIN is a six-digit number the IRS uses to verify that it’s really you filing. Without that PIN, the IRS will reject most e-file attempts in your name. You can obtain an IP PIN online after verifying your identity; you’ll get a new PIN each year.

8) Request and review your IRS tax transcript

Check your wage and income transcript for unfamiliar information returns (W-2s, 1099s) or filings you don’t recognize. If you see suspicious activity, document it and be ready to report it.

9) File your tax return early (if you haven’t yet)

Criminals try to beat you to filing. Filing early, with an IP PIN, narrows their window. If you already filed, stay alert for IRS letters indicating duplicate returns or corrections you didn’t initiate.

10) Report suspected tax identity theft promptly

If you learn that a fraudulent return was filed, respond right away. Typically, you’ll complete IRS Form 14039 (Identity Theft Affidavit) and follow IRS instructions. Keep copies of all correspondence, and send critical mail via trackable delivery.

11) Rotate direct-deposit details if exposed

If your tax return contained bank routing and account numbers, ask your bank whether you should open a new account for future direct deposits and automatic payments. Update direct deposit information with your employer and the IRS as needed.

12) Monitor your credit and identity continuously

Because a tax-return breach exposes core identifiers, monitoring for new-account attempts, address changes, and credit pulls is essential over the next 12–24 months. A consolidated monitoring tool can help you track changes and set real-time alerts. If you need an all-in-one option for credit and identity alerts, consider SmartCredit for privacy, credit monitoring, and identity protection.

Signs of Tax Identity Theft to Watch For

• IRS letter or online notice saying multiple returns were filed with your SSN
• IRS records showing wages from an employer you don’t recognize
• Refund offset or denial when you expected a refund
• Account transcript activity you didn’t initiate
• State tax agency notices about returns you didn’t file

Don’t ignore unexpected mail from the IRS or your state revenue department—even if it looks confusing or minor.

What to Tell the Organization That Was Breached

If a tax preparer, employer, benefits administrator, or software provider was breached, ask them for:

• Exactly what data was exposed (full return, attachments, SSNs, bank data)
• The exposure window and when they discovered it
• Whether your spouse/dependents were affected
• What steps they took to contain the breach
• Any credit monitoring, identity restoration, or IRS liaison support they’re providing
• Written confirmation for your records

Keep notes of every call and copy all emails or letters. If they offer monitoring, you can accept it and still use your own preferred tools.

Credit Freezes vs. Fraud Alerts: Which Should You Use?

Both are free. Here’s how to decide:

• Credit freeze: Best for maximum protection. It blocks most new credit checks. You’ll need to thaw temporarily when applying for credit or services that require a hard pull. Apply a freeze with all three bureaus.
• Fraud alert: Easier if you expect to apply for credit soon. It asks lenders to verify your identity more thoroughly but doesn’t block inquiries.

You can start with a freeze now and thaw later if needed.

Protecting Dependents and Past-Year Returns

Criminals can reuse exposed information from prior years. If older returns were involved:

• Freeze or alert for each person named on the return, including children with SSNs
• Check whether past refunds were redirected or amended fraudulently
• Track each tax year separately in your documentation

If a dependent receives odd mail (preapproved credit, tax letters), investigate immediately.

Strengthen Your Personal Security Basics

Use strong, unique passwords and a password manager

Never reuse passwords between email, tax, and financial accounts. A manager helps create and store complex passwords securely.

Turn on account alerts everywhere you can

Enable text or app alerts for sign-ins, new payees, large transactions, and profile changes at banks, payroll portals, and tax software.

Be cautious with tax communications

Phishing often follows breaches. The IRS initiates most contact by mail. Be skeptical of emails, texts, or calls demanding payment or asking for your PIN or SSN. If in doubt, sign in directly to your IRS or state account using a known URL.

Document Everything

Create a simple incident file:

• Copy of the breach notice
• Timeline of events and actions you took
• Confirmation numbers for freezes/alerts
• IRS and state letters, plus any transcripts
• Bank case numbers and correspondence

This reduces stress, speeds up calls with agencies, and supports any dispute or recovery steps later.

If You Discover Fraud Has Already Happened

• Contact the IRS immediately using the number on the notice; complete Form 14039 if directed
• Notify your state tax agency—many have their own identity theft process
• Report to your bank and replace impacted account numbers
• File an identity theft report with the FTC for a recovery plan and documentation
• Maintain freezes; add credit bureau fraud victim statements if offered

Prompt reporting can help stop additional damage and establish a documented trail that supports reversals and corrections.

Frequently Asked Questions

Do I need an IRS IP PIN if I’ve never had tax identity theft?

Yes. If your tax return was exposed, an IP PIN is one of the strongest preventive controls you can enable proactively.

Will credit monitoring stop tax fraud?

No. Monitoring alerts you to changes but doesn’t block a fake filing. That’s why combining an IRS IP PIN, credit freezes, and vigilant monitoring is most effective.

Should I close my bank account if my routing and account number were on the return?

Talk to your bank’s fraud team. Many will advise opening a new account if the risk is elevated, especially if you’ve seen suspicious activity.

How long should I keep freezes and monitoring in place?

At least 12–24 months after the breach. Identity data doesn’t expire, and criminals may wait to use it.

Privacy Practices to Reduce Future Exposure

• Limit where you store digital copies of returns; encrypt them and remove them from email attachments and cloud folders that don’t need them
• Share tax documents only through secure portals from your preparer, not regular email
• Shred physical copies you no longer need according to your recordkeeping policy
• Review your tax professional’s security practices and contract language regarding data protection

Action Checklist

1. Change passwords and enable 2FA on email, IRS, tax software, and banks
2. Place credit freezes at all three bureaus (or at least a fraud alert)
3. Create/secure your IRS account and enroll in an IP PIN
4. Review IRS transcripts for unfamiliar filings or wages
5. File early if you haven’t filed yet
6. Set account and transaction alerts at banks and payroll portals
7. Extend protections to spouse and dependents
8. Document everything and respond promptly to IRS/state notices
9. Use ongoing identity and credit monitoring to catch new issues quickly

Conclusion

A breach that includes copies of your filed tax returns is serious, but you’re not powerless. Move fast to lock down your credit, secure your IRS account with an IP PIN, monitor your accounts, and file early if you still need to. Extend these protections to everyone listed on the return, keep thorough records, and respond promptly to any IRS or state notices. With strong first-week actions and steady monitoring over the next 12–24 months, you can dramatically lower the risk of tax refund fraud and broader identity theft stemming from this breach.