The Internal Revenue Service and its Security Summit partners used the fourth entry in a summer awareness campaign to push a blunt message at taxpayers and the professionals who file for them: a stolen Social Security number is often all a criminal needs to file a bogus return, and a free six-digit code from the IRS is one of the few tools built specifically to stop it. The September push centers on the Identity Protection PIN, a number that ties a return to one person and one person only. For anyone whose Social Security number has already turned up in a data breach, the gap between having that PIN and not having it can decide whether a refund arrives on schedule or gets buried in a fraud investigation for months.
How a six-digit number blocks a fraudulent return
An IP PIN is a six-digit number known only to the taxpayer and the IRS, used to verify identity whenever a federal return is filed electronically or on paper. The IRS and its Security Summit partners describe it as a critical defense tool against identity thieves filing fraudulent tax returns. Anyone with a valid Social Security number or Individual Taxpayer Identification Number who can verify their identity is eligible to enroll, and a parent or legal guardian can request one for a dependent as well.
The protection is not permanent. An IP PIN is valid for a single calendar year, and the IRS generates a new one annually, a detail spelled out in the agency’s September 4 release on the program. Enrolling once does not hand a taxpayer a code they can reuse indefinitely — it has to be retrieved fresh each filing season through the same account used to sign up.
Free retirement updates: A quiet rule change can shrink a Social Security or Medicare check, and no one warns you. The free Retirement Shield newsletter catches these early and explains what to do. Get it free.
An IRS Online Account is the fastest way in
The quickest route to an IP PIN is through an IRS Online Account, inside the IP PIN section of the profile page. Someone without an existing account has to register and pass an identity check first, and once enrolled, the PIN is generally viewable in that account from mid-January through mid-November each year — a detail worth knowing so a taxpayer checking outside that window does not assume the system is broken. The same release points tax professionals toward a companion tool, Tax Pro Account, which lets them submit power of attorney and tax information authorization requests and manage active client authorizations, though that is a separate system from an individual’s own IP PIN enrollment. Anyone under 18 cannot use the online path and needs one of the alternatives below instead.
Form 15227 and an in-person visit cover everyone else
Taxpayers who cannot clear the online identity check are not shut out of the program. Anyone whose adjusted gross income on their last filed return was below $84,000, or $168,000 filing jointly, and who has access to a telephone can submit Form 15227 online; the IRS then calls the number provided to verify identity and mails the PIN, typically within four to six weeks. Anyone who does not qualify for that path, or still cannot verify their identity, can instead schedule an in-person appointment at a Taxpayer Assistance Center with a photo ID and a second form of identification, a route the IRS says usually produces a mailed PIN within about three weeks.
The version of this scam that comes by phone
The enrollment rules double as a fraud filter. Tax professionals cannot obtain an IP PIN on a client’s behalf — taxpayers have to request their own — which closes off a route a criminal might otherwise try through a compromised preparer login. The IRS is equally direct about a second angle: the agency will never call, email, or text anyone to request an IP PIN, so any such contact is fraudulent no matter how official it sounds or what number it appears to come from.
Confirmed victims of tax-related identity theft skip the enrollment process altogether. The IRS automatically issues them a new IP PIN every year, typically mailed with a CP01A notice.
Part of a five-part campaign, not a one-off warning
The September 4 release is the fourth installment in a five-part “Protect Your Clients; Protect Yourself” summer series that the IRS and Security Summit partners run for tax professionals and, by extension, the taxpayers whose data those professionals hold. The Security Summit itself is a public-private partnership that has worked since 2015 to protect the tax system against identity theft and fraud, and tax professional security is also a featured topic at the 2026 IRS Nationwide Tax Forum, with the final session running September 15 to 17 in San Diego. The same release reminds tax preparation firms that under the Federal Trade Commission’s Safeguards Rule, they are required to use multifactor authentication to protect client data unless a Qualified Individual approves an equivalent control in writing — a parallel defense layer built for the professionals rather than the taxpayers themselves.
The PIN has to ride along with every return, every year
Once a taxpayer opts in, the obligation does not fade quietly. The six-digit code must be entered on every federal return filed that year, including a prior-year return being filed late, and it applies only to Forms 1040, 1040-NR, 1040-PR, 1040-SR, and 1040-SS. A missing or incorrect PIN triggers an e-file rejection or delays a paper return until the IRS can verify it by hand — a self-inflicted holdup that undercuts the very protection the program is meant to provide. Full enrollment mechanics are laid out on the IRS’s Get an Identity Protection PIN page, which is also where a taxpayer retrieves a lost or forgotten number rather than filing a new Form 15227.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
