The IRS flagged more than 1 million tax returns for potential identity theft during the 2023 tax season, according to the U.S. Department of the Treasury, signaling that such fraud continues to be a pervasive problem for taxpayers.

Tax-related identity theft occurs when criminals use a taxpayer’s personal information to file a return in their name to claim their federal tax refund.

The IRS identified nearly 1.1 million tax returns as potentially fraudulent as of March 2, according to a Treasury report issued to the public Tuesday that analyzed data partway through the filing season. The associated refunds were worth about $6.3 billion.

The IRS had confirmed 12,617 of the tax returns were fraudulent as of the same date in March, Treasury reported. That figure is up from 9,626 tax returns at the same time in 2022.

More from Personal Finance:
Black taxpayers more likely to face audits, IRS confirms
Social Security, federal salaries at risk in debt ceiling standoff
TurboTax payments for $141 million settlement set to begin

Tax-related identity theft has been a problem since about 2004-05, and it “only got worse” since then, said Nina Olson, executive director and founder of the Center for Taxpayer Rights.

“It went from being a one-off [thief] ripping off someone’s Social Security number to a whole scheme and organized crime,” Olson said.

Identity theft was the most prevalent type of fraud that consumers reported to the Federal Trade Commission in 2022. A report issued Wednesday by the Identity Theft Resource Center found that identity crime declined in 2022, but only marginally from the all-time high hit in 2021.

The IRS increased the number of filters it uses to identify potentially fraudulent tax returns since the 2022 tax season. The agency used 236 filters during the recent tax season, compared with 168 filters last year, Treasury said.

Tax returns identified as fraudulent by these IRS filters are held during processing until the IRS can verify the taxpayer’s identity.

“They’re trying to crack down … to make sure you’re [the one] actually filing,” said Dan Herron, a certified public accountant and certified financial planner based in San Luis Obispo, California.

Sometimes, the system inadvertently catches returns that aren’t fraudulent, though.

One of Herron’s new clients had been filing a paper tax return every year with a different accountant but filed an electronic return in 2023. The client received an IRS notice in the mail saying that the return had been flagged for fraud. The client had to contact the agency to verify their identity — delaying the issuance of a tax refund by several weeks, Herron said.

“It’s not a perfect system, but it’s going in the right direction,” Herron, founder of Elemental Wealth Advisors, said of the IRS systems.

Taxpayers may not know they’re the victim of tax-related identity theft until they try to file a return online and learn that a return was already filed using their Social Security number. The IRS may also send a letter saying it identified a suspicious return using your SSN, for example, among other telltale signs.

Taxpayers can still claim a refund if this happens. But they’ll have to take additional steps to prove their identity to the IRS, and their refund will likely be delayed as a result.

Perhaps the best way for taxpayers to prevent identity theft is to request an Identity Protection Personal Identification Number (IP PIN) directly from the IRS, Olson said.  

The IP PIN is a six-digit number assigned to eligible taxpayers at the start of each filing season. It’s known only to the taxpayer and, once issued, is needed when filing a tax return as an authentication measure.

A tax return filed by a scammer without the associated IP PIN would not be processed, Olson said. She recommends taxpayers who want an IP PIN request one in the latter part of the calendar year, ahead of the tax season, and that they keep it handy.

The IRS issued 802,449 total IP PINs to taxpayers as of March 4, according to the Treasury’s report.

Taxpayers can also reduce their risk by trying to file a return early in the tax season, experts said. The IRS also recommends several online security measures tied to computers and mobile phones, digital passwords, multifactor authentication and avoiding suspicious e-mail links or attachments.

The IRS also never initiates contact with taxpayers by e-mail, text or social media to request personal or financial information, and never calls to threaten lawsuits or arrest, the agency said.

The IRS recommends victims of tax-related identity theft take a few important steps:

• Complete IRS Form 14039, Identity Theft Affidavit, if your e-file return is rejected because of a duplicate filing using your Social Security number. Continue to pay your taxes and file your tax return, even if it must be by paper. Attach the identity theft form to your paper return.
• Respond immediately to any IRS notice.
• File a complaint with the FTC at identitytheft.gov.
• Contact one of the three major credit bureaus (Equifax, Experian or TransUnion) to place a fraud alert on your credit records.
• Close any financial or credit accounts opened by thieves.