Yes, someone can steal your tax refund, and it happens more often than most people realize

Tax refund theft occurs when someone files a return using your Social Security number before you do, claims your refund, and the IRS sends the money to them instead of you. This is called identity theft, and it's one of the fastest ways a criminal can convert stolen personal information into cash. The IRS processes millions of returns each year, and the agency's systems flag some fraudulent filings, but not all of them catch the theft before the refund is issued.

The theft can happen in several ways: a data breach exposes your Social Security number and address, a tax preparer commits fraud, someone with access to your mail intercepts your tax documents, or a criminal straightforward buys your information on the dark web. Once they have your number, filing before you do is straightforward—they file electronically, claim a refund, and the IRS deposits it into a bank account they control.

The good news is that the IRS has tools to detect and prevent this, and you have legal recourse if it happens to you. But the process of recovering a stolen refund takes time, and prevention is far more effective than recovery.

Key Takeaways

  • Tax refund theft happens when someone files a return with your Social Security number before you do and claims your refund as their own.
  • The IRS will reject your return if a refund has already been issued under your number, and you'll receive a notice explaining the discrepancy.
  • You must file Form 14039, Identity Theft Affidavit, with the IRS to report the theft and begin the recovery process.
  • Recovery typically takes several months, and you may not receive your legitimate refund until the IRS completes its investigation.
  • Freezing your credit, monitoring your credit reports, and filing your return early each year are the most effective ways to prevent this theft.

How the IRS detects stolen refunds and what happens to your return

When you file your return, the IRS checks whether a refund has already been issued under your Social Security number that year. If one has, your return is rejected, and you receive a notice in the mail explaining that a duplicate return was detected. This notice is your first sign that someone may have stolen your identity.

The IRS does not automatically reverse the fraudulent refund or contact law enforcement. Instead, the agency flags your account and requires you to prove your identity and that you are the legitimate filer. Until you do, your refund is held, and you cannot receive it. The IRS will not process your legitimate return until the identity theft case is resolved.

If the IRS does not catch the theft before issuing the refund—which happens in some cases—the money goes to the criminal's bank account. The IRS then has to recover it from that account, which requires coordination with the bank and law enforcement. This is slower and less certain than catching the fraud before the refund is issued.

Filing Form 14039 to report the theft to the IRS

Form 14039, Identity Theft Affidavit, is the official document you file with the IRS to report that someone has stolen your identity and filed a fraudulent return. You must file this form by mail, not electronically. Include a copy of your legitimate return, a copy of the IRS notice you received rejecting your return, and any other documentation that shows the fraud occurred.

Mail Form 14039 to the IRS address listed in the notice you received. Do not file it with your regular return. The IRS will send you a confirmation number once they receive it, and you can use that number to track the status of your case.

Processing Form 14039 typically takes 60 to 120 days, though cases involving significant fraud or multiple years of theft can take longer. During this time, the IRS investigates the fraudulent return, attempts to recover the refund from the criminal's bank account, and prepares your account for your legitimate refund.

What to expect during the IRS investigation and recovery process

Once you file Form 14039, the IRS assigns your case to an identity theft specialist. This person reviews the fraudulent return, compares it to your legitimate return, and determines whether the refund was issued before or after your report. They also coordinate with the bank that received the fraudulent refund to attempt recovery.

If the refund was issued to a bank account, the IRS can request that the bank freeze the account and return the funds. Banks are required to cooperate with IRS requests, but the process is not instantaneous. The bank must verify the IRS's authority, locate the account, and confirm that the funds are still there. If the criminal has already withdrawn the money, recovery becomes much harder.

You will receive updates from the IRS by mail as the investigation progresses. Once the case is closed, you will receive a final notice explaining the outcome and when your legitimate refund will be issued. If the IRS recovered the stolen refund, you will receive it along with any interest owed. If recovery was not possible, you may be able to claim the loss on a future tax return or pursue a claim through the Federal Trade Commission.

Protecting yourself from tax refund theft before it happens

File your return early—as soon as you have all your documents. The earlier you file, the less time a criminal has to file a fraudulent return under your number. Many people who file in February or March are protected straightforward because they filed before the criminal could.

Freeze your credit with the three major credit bureaus: Equifax, Experian, and TransUnion. A credit freeze prevents anyone from opening new accounts in your name, which is often the next step a criminal takes after stealing a refund. The freeze is free and takes about 15 minutes per bureau. You can lift the freeze temporarily if you need to open a new account yourself.

Monitor your credit reports for accounts you did not open. You can request a free copy of your credit report from each bureau once per year at AnnualCreditReport.com. Look for new credit cards, loans, or inquiries you do not recognize. If you find fraudulent accounts, dispute them when ready with the bureau and the creditor.

Use a reputable tax preparer or file yourself using IRS-approved software. Some tax preparers have been caught filing fraudulent returns to steal refunds. If you use a preparer, verify their credentials and ask whether they have identity theft insurance.

What to do if your refund is delayed but you have not received a notice

If you filed your return and expected a refund but have not received it after the normal processing time, check the status using the IRS's "Where's My Refund?" tool on IRS.gov. This tool shows whether your return was received, is being processed, or has been held for review.

If the tool shows your return is held or under review, contact the IRS at 1-800-829-1040 to ask why. Do not assume it is identity theft—delays can also occur if there is a math error, missing information, or a match issue with another document like a W-2. The IRS representative can tell you the specific reason and what you need to do next.

If you receive a notice saying a duplicate return was filed, follow the steps in the next section. If you do not receive any notice but your refund does not arrive, file Form 14039 anyway as a precaution. The IRS will investigate and confirm whether fraud occurred.

Reporting the theft to law enforcement and the Federal Trade Commission

In addition to reporting the theft to the IRS, you should report it to the Federal Trade Commission at IdentityTheft.gov. The FTC maintains a database of identity theft reports and can provide you with a recovery plan tailored to your situation. You will receive an Identity Theft Report, which you can use to dispute fraudulent accounts with creditors and credit bureaus.

You can also file a report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Law enforcement rarely investigates individual tax refund thefts unless they are part of a larger fraud ring, but filing a report creates an official record and may help if the criminal strikes again.

Keep copies of all notices, correspondence with the IRS, and documentation of the theft. You may need these if you pursue a civil claim against the criminal or if the theft affects your credit in the future.

Frequently Asked Questions

How long does it take to get my refund back after I report the theft?

The IRS typically takes 60 to 120 days to investigate and resolve an identity theft case. Once resolved, your legitimate refund is issued within two to three weeks. In total, expect four to six months from the time you report the theft to receiving your money. Some cases take longer if the criminal's bank account is difficult to locate or if the funds have already been withdrawn.

What if the criminal already spent the money from my refund?

If the refund was withdrawn before the IRS could recover it, you will not receive that money back from the IRS. However, you may be able to claim the loss as a theft loss on your tax return in the year the theft occurred. You can also pursue a civil claim against the criminal if they are identified, though collecting money from a criminal is often not practical. The FTC can advise you on other recovery options.

Do I have to pay taxes on a refund that was stolen in my name?

No. The fraudulent return is not your return, so the income and refund claimed on it are not your responsibility. The IRS will remove the fraudulent return from your record once the identity theft case is closed. You only owe taxes on income you actually earned.

Can I file my return electronically if I have already reported identity theft?

Yes, but the IRS may require additional verification. When you file after reporting identity theft, the IRS may ask you to mail a signed copy of your return along with Form 14039 or other proof of identity. Ask the IRS whether electronic filing is available for your case before you attempt to file online.

What if I discover the theft years later?

You can still report it to the IRS and file Form 14039, but the recovery process becomes more complicated. The IRS may have already closed the case, and the criminal's bank account may no longer exist. However, you should still report it to create an official record and to protect yourself from future fraud. The statute of limitations for claiming a refund is generally three years, so act as soon as you discover the theft.