How to Get an IRS Identity Protection PIN

The IRS closed fiscal year 2025 still holding about 316,000 unresolved identity theft cases, and it was taking an average of 21 months to finish one. Six digits, requested in about ten minutes, is what keeps you out of that queue.

The Three Ways to Get Your Pin

See the options below? You only need to do one of them, and the first one is clearly the best one. If you don't have the ability to verify through ID.me, choose the next best option you see.

1. IRS online account

   Same day

   until you have the number

   What you need

   A photo ID and a phone or webcam, to verify through ID.me
   Rules you out if

   You're under 18, you can't complete the identity check, or it's mid-November to mid-January

   Enroll from the Profile tab once you're signed in. Choose continuous enrollment unless you specifically want the number to lapse: one-time enrollment drops you out of the program at the end of the calendar year. The tool goes down for its annual reset from about mid-November to mid-January, and the other two routes are the ones still open then.

   Get an IP PIN
2. Form 15227

   4 to 6 weeks

   until you have the number

   What you need

   A phone the IRS can call you back on to verify who you are
   Rules you out if

   Your last return showed income of $84,000 or more, or $168,000 filing jointly

   Submit it online, by fax to 855-807-5720, or by mail to Department of the Treasury, IRS, Fresno, CA 93725. Pick one. Sending it twice slows it down.

   Open Form 15227
3. Taxpayer Assistance Center

   About 3 weeks

   until you have the number

   What you need

   An appointment, one government photo ID and one other form of ID
   Rules you out if

   Nothing. This is the route that exists when the other two fail

   Appointments are booked on 844-545-5640. Bring two forms of ID for each dependent you're enrolling as well, such as a birth certificate and a Social Security card.

   Find an office

The online route needs an ID.me account, which means photographing a driver's license, state ID or passport and taking a video selfie. If you'd rather not hand over a face scan, you can ask for a live video call with an agent instead, which doesn't use biometrics at all. The IRS says the selfie and video data are deleted afterwards for people verifying for the IRS.

That's the job. The rest of this is what you've just protected yourself from, and the handful of rules that catch people out afterwards.

How Are People Able to Steal Your Refund?

Tax identity theft is honestly one of the least sophisticated frauds there is. Unfortunetly, it's painfully easy to execute. Someone only needs your name, date of birth, and social security number to pull it off. The fraudster simply files a return as you sometime in mid-late January, with made-up income and withholding to produce a refund from Uncle Sam. Then, they simply point the refund at a bank account they own which is typically also fradulent. The IRS pays it out and the thief moves on to their next victim.

You find out in March, when your own return bounces on you. The rejection says a return has already been filed for your Social Security number. From that moment the problem belongs to you. The first thing you do is you file Form 14039, the Identity Theft Affidavit, and you wait while the IRS works out which of the two returns was really yours.

The IRS is not helpless here. Its filters pull millions of returns out of processing every year on suspicion, and most fraudulent refunds never leave the building. But we're dealing with such huge numbers that even a tiny fraction of them getting through means billions of dollars worth of fraud.

Nearly three million returns were held as suspected identity theft in 2025, which is more than the IRS held on every other kind of refund fraud combined. That's the IRS's safety net doing its job. It's also the pile your own return lands in, and getting out of the pile is the painful (and slow) part.

What an IP PIN Actually Is

An Identity Protection PIN is a six-digit number the IRS issues to you and to nobody else. Once you're enrolled, the IRS rejects any e-filed return that contains your Social Security number that doesn't include your pin number.

That's essentially the entire mechanism, and it works pretty darn good, usually. Filing a return currently asks for your name, your SS#, and your date of birth. All three of these items have been sitting in darkweb breach dumps for years. An IP PIN adds the one thing that hasn't leaked, because it didn't exist until you asked for it. Here's the killer part for scammers, your pin gets reset every January. This makes their life very difficult.

It helps to be clear about what this pin is and what it isn't:

• It isn't the password to your IRS account. It's a number you type into your tax software.
• It isn't proof of identity. If you call the IRS or walk into an office, they won't accept it as ID.
• It only goes on Forms 1040, 1040-NR, 1040-PR, 1040-SR, 1040-SS and 1040-X. Not on your state return, and not on Form 4868 when you file for an extension.

Anyone with a Social Security number or an ITIN can have one. You don't need to have been a victim of anything, and you don't need to be required to file a return.

Everyone on the Return Needs Their Own Pin

There's no family IP PIN and no joint one. Each number belongs to one person and they'll need their own unique pin number.

If you file jointly and you both have one, both numbers go on the return. If only one of you has one, only that number goes on, and you can still e-file. Enrolling both of you means the return carries two separate checks instead of one.

Dependents are where this quietly bites. If you claim a dependent who has an IP PIN, their number has to appear on your Form 1040, on Form 2441 if you're claiming child care costs, and on Schedule EIC if you're claiming the Earned Income Credit. Leave it off and the whole return is rejected. On a paper return you don't enter dependent numbers at all.

Children under 18 can't set up an online account, so a parent or guardian gets a dependent's number through Form 15227 or in person.

Getting a child an IP PIN is worth the trouble for a reason most people don't think about. A child's Social Security number is the cleanest thing on the market: it has no credit history attached, nobody checks it for years, and a thief can use it to claim credits on a return long before anybody notices. Since the 2025 filing season there's a second thing worth knowing here, though this one is about your own number rather than the child's. If somebody else has already claimed your dependent, your e-filed return used to be rejected outright, and you were pushed onto paper. Now it's accepted anyway, as long as the primary taxpayer on that return has a valid IP PIN. The dependent doesn't need one for this, unless the IRS has already issued them one.

The Number Changes Every January

This is the rule that catches people, and it catches them at the worst possible moment.

Your IP PIN is valid for one calendar year. A new one is generated each January, and the number you use is the one for the year you're filing in, not the year the return covers. If you're filing a late 2023 return in 2026, you use your 2026 number.

Where that number turns up depends on how you enrolled. Enroll online and no letter is ever mailed to you: you sign in and read it off your profile. Enroll by form or in person and the IRS mails you a CP01A notice each year instead, going out from mid-December through early January.

Two things follow from that shape. November and December are the worst months to do this online, because the tool is down for its reset and a number you have already lost won't be remailed until that finishes. Form 15227 and an office appointment are not on that clock, so first-time enrollment by either of those is still open in those two months. And if you're enrolling for the first time and you're going to use Form 15227 or an office appointment, four to six weeks before April 15 means starting in February at the latest.

If you've lost the number, don't apply for a new one. Sign in and read it, or call 800-908-4490 and have it remailed, which takes up to 21 days and won't work at all if you enrolled for the first time this year or if you ask during the maintenance window.

What It Costs You to Skip It

The case for an IP PIN isn't really about the fraud. It's about the recovery.

When the IRS has two returns under one Social Security number, an identity theft victim assistance case is opened, and those cases are the slowest thing the agency does. The National Taxpayer Advocate files the whole subject under a heading that reads "Case Resolution Time for Identity Theft Victim Assistance Cases Remains Unconscionably Long at Nearly Two Years".

The Taxpayer Advocate's recommendation is that these cases should take 90 days. They currently take about seven times that, and there's no sign of that changing soon: the IRS went from more than 102,000 staff in January 2025 to roughly 74,000 by December, a 27% cut, with this backlog still sitting there.

So the trade is ten minutes now against a wait that has averaged more than a year in each of the last four years, during which your refund is not coming.

Nobody Legitimate Will Ever Ask You For It

The IRS is unusually blunt about this: it will never ask for your IP PIN. Not by phone, not by email, not by text. Any message that does is a scam, and a valuable one to run, because the IP PIN is the piece that would make a stolen Social Security number usable again.

If you get an IRS letter you weren't expecting, don't act on the phone number printed in it. Look the notice up on irs.gov, or call the IRS on a number you found yourself.