TaxProcedureA resource from TIN Comply
IRS form · From the IRS manual

Form 14039, Identity Theft Affidavit: when to file it, each section, where it goes, and how IDTVA works the case

Form 14039 reports tax-related identity theft to the IRS: a fraudulent return under the client's SSN, a dependent claimed by someone else, or an SSN used for employment. This page covers when the form is the right tool, each section of the February 2026 revision, the filing routes, and what the IRS does with the affidavit.

Revision February 2026Filed with IRS identity theft unit (online, fax, mail or with the return)Updated October 25, 2026Sources Form 14039 (Rev. February 2026); IRM 25.23.4 (rev. 10-01-2026); IRM 13.1.7.4
At a glance
Current revisionFebruary 2026
Required sectionsA through E; F when filing for someone else
Preferred routeOnline at IRS.gov/dmaf/form/f14039
Fax (general)855-807-5720
BusinessesUse Form 14039-B, not Form 14039
First page of IRS Form 14039
Form 14039 (Rev. February 2026). Opens the IRS PDF.

When to use Form 14039, and when it is the wrong tool

Section B lists the three situations the form covers: someone used the person's information to file a federal return, the person or their dependent was fraudulently or incorrectly claimed as a dependent, or the SSN or ITIN was used for employment. The form says that if the situation is not one of those, do not file it; report the incident to the FTC at IdentityTheft.gov and consider an IP PIN.

Common triggers in practice: an e-file rejected because a return was already filed under the SSN, a notice for income the client never earned, a refund that was already issued, or an IRS letter asking the client to verify identity. If the client got Letter 5071C or a similar verification letter and did file the return, the fix is verification, not Form 14039. If the client did not file, follow the letter's instructions, which usually involve this form.

Other limits:

  • “To avoid delays do not use this form if you have already filed a Form 14039 for this incident.”
  • For a dependent: “Do not use this form if dependent's identity was misused by a parent or guardian in filing taxes, this is not identity theft.”
  • Businesses use Form 14039-B, Business Identity Theft Affidavit; IRM 25.23.4 refers business taxpayers to it. For employers or payers whose EIN was used on fake W-2s or 1099s, see TIN Comply's guide to 1099s or W-2s filed under your EIN and the Form 14039-B kit.
  • A preparer who altered a return, filed without consent or diverted a refund is a return preparer misconduct issue. IRM 25.23.4.4 sends those taxpayers to Forms 14157 and 14157-A instead.
  • A taxpayer does not need Form 8821 on themselves for protection. IRM 21.3.7.5.3 says the CAF unit rejects those and encloses Publication 5027.

Line by line

Section ASituation you are reporting (required)
Box 1: filing for yourself. Box 2: responding to an IRS notice or letter; enter its number and follow the special mailing and fax instructions. Box 3: for a dependent child or relative (their information goes in Sections C and D). Box 4: for another person, living or deceased.
Section BHow I am impacted (required)
Box 1: someone used the information to file a federal return (with a box if the spouse is also a victim). Box 2: the person was fraudulently claimed as a dependent. Box 3: the SSN or ITIN was used for employment. Then a narrative: what happened, how it affects the tax account, when the person found out, and relevant dates. Attach pages if needed.
Section CName and contact information of the victim (required)
Name, current mailing address (last known if deceased), 9-digit SSN or ITIN, the address on the last return if different, phones, best times, and preferred language.
Section DTax account information
Check if not required to file or filed with no income. Names used on the last return, the year of the last return filed, and the tax years believed affected (the tax year, not the filing year; enter Unknown if unsure).
Section EPenalty of perjury statement and signature (required)
Signed by the taxpayer, representative, conservator, parent or guardian.
Section FRepresentative, conservator, parent or guardian (required if filing for someone else)
Check one: 1, surviving spouse of a deceased taxpayer (no attachments needed); 2, court-appointed or certified personal representative (attach the court certificate); 3, no personal representative appointed (attach a death certificate or formal government notice, and state the relationship); 4, conservator or Form 2848 representative for a taxpayer unable to complete the form (attach the appointment or Form 2848 and enter the CAF number); 5, parent or guardian of a dependent. Then the filer's name, address and phone.

A practitioner filing for a client who can complete the form should have the client sign it. Box 4 of Section F is for a taxpayer who is unable to complete the form, with a Form 2848 attached.

Where and how to file

The form instructs: “Choose one method of submitting this form either Online (preferred method), by Mail, or by FAX, not all methods.”

SituationRoute (from the form)
Most filersOnline at https://www.irs.gov/dmaf/form/f14039 (attachments are not available online), or fax 855-807-5720, or mail to Department of the Treasury, Internal Revenue Service, Fresno, CA 93725
Responding to an IRS notice or letter (Section A box 2)Mail to the address in the notice with a copy of it, or fax to the number in the notice; if none, follow the notice's mailing instructions
Return cannot be e-filed because the SSN or ITIN was already used (Section B box 1 or 2)Attach Form 14039 to the back of the paper return and file it where the client normally files

Faxes need a cover sheet marked “Confidential”. Do not send an original return to the Fresno address or the fax number. The form also encourages enrolling in the IP PIN program online, at a Taxpayer Assistance Center appointment (844-545-5640), or on Form 15227 if eligible.

What the IRS does with it

The claim goes to Identity Theft Victim Assistance (IDTVA). IRM 25.23.4.4: “Taxpayers indicate IDT by submitting Form 14039, Identity Theft Affidavit, a police report, or a similar statement.” For cases that come from compliance functions, such as an underreporter or exam case, IRM 25.23.4.2 is stricter: “Cases that are referred to IDTVA from a Compliance function must include a Form 14039, police report or Federal Trade Commission (FTC) Identity Theft Report to be considered an identity theft claim.” That is why a notice response claiming identity theft should include the affidavit.

After research, the examiner classifies the case as a mixed entity, a scrambled SSN, an identity theft case it can resolve, a case to route elsewhere, or not identity theft at all (for example, two returns actually filed by the SSN owner). IRM 25.23.4.2 describes two treatment streams: streamlined processing where the fraudulent return can be nullified, and non-streamlined processing where it must be moved to a separate IRS number. The resolution scenarios turn on whether there is a valid return, one or more invalid returns, and a lost refund. Non-tax identity theft (for example, a credit card opened in the client's name) is worked under a separate category with an entity control.

If the examiner cannot decide from the file, IDTVA contacts the taxpayer for more information. Claims that turn out to be frivolous are referred to the Frivolous Return Program, and unsupported allegations are reversed.

Two points on getting help: TAS generally does not accept identity theft issues as stand-alone systemic burden cases (IRM 13.1.7.4 lists identity theft among the excluded processing inquiries), so Form 911 works only where there is economic burden or another qualifying factor. And transcript requests on accounts with identity theft follow special rules in IRM 21.2.3; for example, a verification of non-filing request ordered on Form 4506-T may be answered with a substitute product, Letter 3538.

Common rejections and mistakes

  • Filing a second Form 14039 for the same incident, which the form says causes delays.
  • Submitting by all three methods. Pick one.
  • Using Form 14039 for a business. File Form 14039-B.
  • Reporting preparer misconduct as identity theft. Use Forms 14157 and 14157-A.
  • Parent or guardian misuse of a dependent's SSN, which the form says is not identity theft.
  • Sending the original return to Fresno. File it where the client normally files, with the affidavit attached if e-file is blocked.
  • No Section F documentation when filing for a decedent or another person.
  • Answering a compliance notice without the affidavit, which may not be treated as an identity theft claim.

Questions practitioners ask

Should my client file Form 14039 if a return was rejected as a duplicate?

If someone else filed using the client's SSN, yes. The form says to attach it to the back of the paper return and mail it where the client normally files, since the return cannot be e-filed.

Can I file Form 14039 for my client?

If the client cannot complete it, a representative can sign using Section F box 4 and attach the Form 2848 and CAF number. Otherwise, the client signs the affidavit.

Is Form 14039 used for business identity theft?

No. Businesses use Form 14039-B, Business Identity Theft Affidavit, which IRM 25.23.4 refers business taxpayers to.

Does my client need a police report?

No. IRM 25.23.4.4 accepts Form 14039, a police report or a similar statement. For cases referred from compliance functions, IRM 25.23.4.2 requires a Form 14039, police report or FTC Identity Theft Report.

Can Form 14039 be filed online?

Yes. The form calls online submission the preferred method, at IRS.gov/dmaf/form/f14039, though attachments cannot be included online.

Will the Taxpayer Advocate take an identity theft case?

Only in limited situations. IRM 13.1.7.4 excludes identity theft issues from systemic-burden acceptance, so TAS involvement generally requires economic burden or another qualifying factor.