Someone Filed As You — The Recovery, In Order

Read the signal correctly — which door are you standing at?

Tax-related identity theft announces itself in one of four ways, and the right first move is different at each door. (1) An identity letter arrived — 5071C, 4883C, or 5747C: the IRS's filters stopped a suspicious return filed with your name and number; go to Step 2. (2) Your e-file was REJECTED with R0000-902 — a return for your SSN is already accepted: first rule out your own household (a spouse, a parent, another preparer, a return you forgot you filed); if none of those explains it, go to Step 3. (3) A notice describes a return or a job you never had (a CP2000 for wages from a stranger employer, a balance on a return you never filed): go to Step 3. (4) Your data was merely exposed in a breach, with no tax sign yet: skip to Step 5 — protection, not paperwork. The Notice Decoder carries each letter's exact channel and deadline; decode yours there before you act. 🔊 Listen

Authority: IRS, “Identity theft guide for individuals”; Notice Decoder (Letters 5071C, 4883C, 5747C); Reject Decoder (R0000-902)

If the IRS wrote first, verify — through the letter's own channel, and do NOT file Form 14039

When the Taxpayer Protection Program catches the suspicious return, the IRS sends the identity letter and waits for YOU: 5071C can be answered online at idverify.irs.gov (typed by you, never via a link anyone sends), 4883C is phone-only on the number printed on the letter, and 5747C is in person at a Taxpayer Assistance Center by appointment. The window is 30 days from the letter's date. If the return named in the letter is one you never filed, say exactly that during verification — that answer is what opens the theft case. For THIS path the IRS's instruction is explicit and counter-intuitive: do not file a Form 14039. TPP already has the case; a 14039 on top of it is a duplicate, and duplicates delay resolution. After successful verification, allow up to nine weeks for processing of a legitimate return. 🔊 Listen

Authority: IRS, “How IRS ID theft victim assistance works” (TPP path — “Do not file a Form 14039”); IRS, “Identity verification for IRS letter recipients”

If YOU discovered it, Form 14039 is the case-opener — filed once, filed with your real return

When no TPP letter has arrived — the R0000-902 rejection, the notice about a stranger's return, a dependent claimed by someone else — Form 14039, the Identity Theft Affidavit, is how the case opens. Complete it once, completely: what happened, the tax years affected, the notices you received. Then follow the form's own delivery rule: if you are filing your legitimate return for the affected year, attach the 14039 to the BACK of your completed PAPER return and mail the package to the address for your state in the form's instructions — your real return is paper this year; it cannot e-file past the fraudulent one. The form can also be submitted online at irs.gov (the form names the online route as preferred when no return is attached) or by fax or mail per its instructions. What never helps: filing a second 14039, or filing one for non-tax theft (a stolen credit card is a crime, but it is not this form's case). 🔊 Listen

Authority: Form 14039 and its instructions; IRS, “How IRS ID theft victim assistance works”

Set the honest expectation — the IDTVA clock, in the IRS's own words

Your case goes to the IRS's Identity Theft Victim Assistance organization, whose specialists research it, remove the fraudulent return, and correct your account across every affected year. The IRS states its goal plainly: resolution is “generally within 120 days.” Then it states its reality just as plainly: inventories swelled and “on average it is taking us 550 days to resolve identity theft cases.” Plan on the reality, not the goal: well over a year is the honest expectation for a full resolution today, and complex cases — multiple years, business identity theft — run longer. You will receive a letter when the case is resolved (and CP01 notices as markers are placed). Two IRS warnings belong on your refrigerator: do NOT submit duplicate Forms 14039, and do NOT contact the IRS just to check status — both cause delays. When you genuinely need a human on an existing case, the Identity Protection Specialized Unit is 800-908-4490; the Form 14039 processing-status dashboard on irs.gov shows current processing times. 🔊 Listen

Authority: IRS, “How IRS ID theft victim assistance works” (120-day goal; 550-day average; duplicate/status warnings); IRS, Identity Protection Specialized Unit

Every year after: the IP PIN, and the wider recovery in parallel

Confirmed victims are issued an Identity Protection PIN — a new six-digit PIN by mail each year (Notice CP01A, arriving around December–January) that must be on the return or the return rejects; the platform's IRS Account Concierge walks the voluntary version for everyone else, and this platform never stores an IP PIN, by design. In parallel, run the non-tax recovery the IRS itself points to: report the theft at the FTC's IdentityTheft.gov for a personal recovery plan and an FTC Identity Theft Report; place a free fraud alert or credit freeze with the credit bureaus; and if a CHILD's number was misused — a dependent claimed by a stranger, a first job or a credit offer in a minor's name — file the 14039 for the affected return, request an IP PIN for the child through the same program, and check whether a credit file exists in the child's name (a minor should have none; a file that exists is a finding, and the bureaus must freeze it on a parent's request). The tax case and the credit case are separate machines; run both. 🔊 Listen

Authority: IRS, “Get an Identity Protection PIN” and Notice CP01A; IRS, “Identity theft guide for individuals” (FTC IdentityTheft.gov pointer); FTC, IdentityTheft.gov

The three traps that cost victims money twice

Do not pay an “expediter.” No company can move an IDTVA case faster, none has a channel the IRS honors, and the IRS charges nothing for any step on this page — a fee to “release your refund” or “unlock your account” is the second theft wearing the first one's clothes (run it through the Scam Shield). Do not file a second return or a second 14039 “to get in line again” — the IRS reads duplicates as delay, not urgency. And do not ignore the paper letters while waiting: if the IRS writes during the case — another verification letter, a request for documents — answer within its window; a missed window can close the wrong case. Scared, slow, and paper-driven is the real shape of this recovery; anyone selling you a different shape is selling. 🔊 Listen

Authority: IRS, “How IRS ID theft victim assistance works”; IRS Dirty Dozen (identity-theft and expediter schemes) — see the Scam Shield

The pieces, in their own rooms

• Notice Decoder — Letters 5071C, 4883C, 5747C and Notice CP01A, each with its channel, its 30-day clock, and its don't-confuse line.
• Reject Decoder — R0000-902, “this SSN already has an accepted return”: the household checks first, then the theft path.
• Scam Shield — the IRS contact rules and the checker: is the “IRS” demanding gift cards actually the IRS?
• IRS Account Concierge — the IRS online account and the voluntary IP PIN, the protection layer for everyone, victim or not.
• Forms Library — Form 14039, the Identity Theft Affidavit, explained line by line.

Every step on this page, with its source

• The order of operations, the TPP carve-out (“Do not file a Form 14039” when the Taxpayer Protection Program caught the return), where the affidavit goes (attached to the back of the completed paper return, mailed to the location for your state of residence), the IDTVA assignment, and the resolution letters: IRS, “How IRS ID theft victim assistance works,” irs.gov.
• The clock, in the IRS's own words on that page: resolution “is generally within 120 days, but… on average it is taking us 550 days to resolve identity theft cases” — and the same page's warnings that duplicate Forms 14039 and status calls cause delays.
• The identity letters — 5071C (online at idverify.irs.gov), 4883C (phone only), 5747C (in person, by appointment), 30 days to respond, up to nine weeks' processing after successful verification: IRS, “Identity verification for IRS letter recipients”; the Notice Decoder carries each letter in full.
• Form 14039, Identity Theft Affidavit — when to file it, when not to, and its submission routes (online, fax, mail, or attached to the paper return): Form 14039 and its instructions, irs.gov. Questions on an existing case: the Identity Protection Specialized Unit, 800-908-4490.
• Aftermath — the annual Identity Protection PIN for victims (Notice CP01A) and the voluntary IP PIN for anyone with an SSN or ITIN: IRS, “Get an Identity Protection PIN”; the IRS Account Concierge on this platform.
• The parallel path — a personal recovery plan and an FTC Identity Theft Report for the credit side of the theft: the Federal Trade Commission, IdentityTheft.gov (the IRS's own guide points victims there).

If the case has stalled beyond the IRS's stated timeframes and the delay is causing real hardship, the Taxpayer Advocate Service — an independent organization inside the IRS — exists for exactly that; see Your Rights & Free Help.