A federal notice from the Internal Revenue Service and its Security Summit partners this month renewed a specific warning aimed at anyone who has ever worried about a stolen refund: no one from the agency will ever telephone, email or text asking for the six-digit code that keeps a tax return tied to the right person. The notice landed as the fourth installment of a summer campaign urging both tax professionals and ordinary filers to lock down the credentials that stand between a household’s refund and a stranger who already has a stolen Social Security number. Knowing exactly what that code does, who is allowed to ask for it, and how someone actually gets one separates a legitimate IRS contact from an attempted scam.
What The Six-Digit Code Is Actually Blocking
The tool at the center of the warning is called an Identity Protection PIN, or IP PIN — a six-digit number known only to a taxpayer and the IRS. Its job is narrow but important: when a federal return carrying that number is filed, the number confirms the return actually belongs to the person whose Social Security number is on it, which is what stops an identity thief from filing a fraudulent return first and collecting someone else’s refund. The code is not permanent. It is valid for a single calendar year, and the IRS generates a new one automatically every year, so a number obtained this filing season will not work the next one. A tax preparer, no matter how trusted, cannot request an IP PIN on a client’s behalf — enrollment has to come from the taxpayer directly.
Free retirement updates: Enrollment and claim windows come and go, and missing one can cost you real money. The free Retirement Shield newsletter keeps you ahead of the deadlines that matter. Sign up free.
The IRS’s Own Rule: No Call, No Email, No Text
The release is direct about the one behavior that should raise suspicion immediately: contact asking for the code itself. IRS Chief Executive Officer Frank Bisignano framed the broader push around multifactor authentication, IP PINs and secure online accounts as adding “important layers of security that helps safeguard sensitive data held by practitioners, taxpayers, and IRS systems.” The agency’s separate enrollment page states the contact rule even more bluntly for anyone who already holds a PIN, warning outright that any phone call, email or text requesting the number is, by definition, a scam attempt. The instruction that follows is just as specific — the number should be shared with no one except the IRS itself and, at the moment of filing, a trusted tax preparer, never read aloud or typed into a message on request.
Who Gets One Automatically, And Who Has To Opt In
Two very different groups end up holding an IP PIN. Anyone who has already had a fraudulent return filed under a stolen Social Security number and had that theft confirmed by the IRS gets enrolled automatically, receiving a new PIN every year without applying for it again. Everyone else has to opt in voluntarily, and the eligibility bar is broad: anyone with a Social Security number or an individual taxpayer identification number who can verify their identity qualifies, whether or not they are required to file a return at all that year. Parents and legal guardians can request one for a dependent, too. A household that has never been a fraud victim and simply wants to close off the possibility ahead of time is exactly who the voluntary program is built for.
Three Enrollment Paths When The Online Route Fails
The fastest way to get a PIN is through an existing IRS online account, where it appears in the profile section once identity has been verified. For a taxpayer who cannot set up that account, a second route exists: filing Form 15227, available to anyone with adjusted gross income under $84,000 as an individual or $168,000 filing jointly, which triggers a phone call from the IRS to confirm identity and a mailed PIN that typically arrives within four to six weeks. Anyone who cannot use either option — including filers over those income limits who still cannot verify online — can schedule an in-person appointment at a Taxpayer Assistance Center with picture identification in hand, a path that generally produces a mailed PIN within about three weeks. Confirmed identity-theft victims skip all three; their annual PIN simply arrives by mail on a CP01A notice.
One Code A Year, Tied To A Narrow Set Of Forms
The PIN only matters on specific paperwork — Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS — and it has to be entered correctly on every one of those, electronic or paper, or the return gets rejected or delayed while the IRS sorts out the mismatch. For most of the year, a taxpayer who has opted in can log back into an online account and see the current PIN displayed on the profile tab, though the number is generally viewable only from mid-January through mid-November. The rule is part of a wider effort that has run since 2015, when the IRS, state tax agencies and the tax industry first formed the Security Summit as a standing partnership against tax-related identity theft, and this year’s push is being delivered through a five-part “Protect Your Clients; Protect Yourself” series aimed squarely at the tax professionals who hold client data most fraud attempts are actually chasing.
Benefits That Also Wait On A Form Nobody Prompts
An IP PIN is paperwork the IRS will not chase anyone for, which is the whole point of the warning: the taxpayer has to go and ask for it. Several benefit programs for older households work the same way and are skipped for the same reason. Extra Help with Part D drug costs, VA Aid and Attendance for veterans and surviving spouses, and weatherization assistance for insulation and furnace repairs each sit with a different office, and none of them is triggered by a tax return or a notice in the mail.
The Benefits Checklist runs 63 pages and covers 11 programs, the 2026 income limits attached to each and a 50-state directory of the offices that take the applications.
Compare the Extra Help and VA Aid and Attendance entries, and the 2026 limits on each, in The Benefits Checklist.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
