Filing season hands criminals two things they lack the rest of the year: a believable reason to contact you about money, and a refund sitting in the middle of the conversation. Some of it comes at you directly. Some runs through the person you paid to do your taxes.
The IRS Opens With a Letter
Almost every fake IRS contact breaks on one fact. The IRS reaches you the first time by mail, through the US Postal Service. Not a phone call, not a text, not a message on social media. So an unexpected call about a tax bill you have never seen answers itself. The agency will not call to demand payment on the spot or threaten you with arrest.
The payment method settles the rest. The IRS never accepts gift cards, and it does not demand a wire transfer, a prepaid debit card or crypto. Real payments go to the US Treasury by check, bank transfer or card, against a notice you can hold.
Text and email versions attach a link instead of a threat. Your refund is on hold, your return needs review, and the link, sometimes hidden in a QR code, opens a page built to look like IRS.gov. Forward those to phishing@irs.gov. For an impersonation call, the Treasury Inspector General for Tax Administration takes reports at 800-366-4484.
The Preparer Who Will Not Sign
Anyone paid to prepare a federal tax return must have a Preparer Tax Identification Number, or PTIN, and must sign the return and write that number on it. That is the law, not a courtesy. A ghost preparer does the work and does neither. You get a printed return to sign and mail yourself, or an e-filed one with the paid preparer line left empty.
That blank line is the whole point. A signature ties a real person with a traceable IRS number to every figure on the page. Without it, the only name on the document is yours, and you owe the extra tax, interest and penalties if the numbers were invented.
Inflated Refunds and Where the Money Lands
A ghost preparer needs your refund to be large. A big number brings in the next customer, and it often sets the fee. Getting there means inventing deductions, a business that does not exist, dependents who are not yours. The refund lands, the preparer takes a cut, and the storefront is empty by the time the IRS examines the return. The bill comes to you.
Two habits protect the money. A fee quoted as a percentage of your refund is a red flag the IRS names directly: it pays the preparer to inflate the number. And before you sign, read the direct deposit lines at the bottom of the return. Some ghost preparers put their own routing and account numbers there and collect the whole refund.
Five Checks on Anyone You Pay to File
They sign the return and enter their PTIN on it. Look at both before it goes anywhere.
They give you a complete copy, which the law requires no later than the moment you sign.
The refund goes to your account. Check the routing and account numbers yourself, digit by digit.
The fee is a flat amount or an hourly rate, never a percentage of the refund and never cash with no receipt.
They are still reachable in June. An audit letter arrives months after the seasonal storefront has closed.
The IRS publishes a searchable Directory of Federal Tax Return Preparers with Credentials and Select Qualifications. If a preparer has already done damage, Form 14157 is the complaint form, and Form 14157-A, Tax Return Preparer Fraud or Misconduct Affidavit, goes with it when they filed or altered your return without consent.
When Somebody Files in Your Name First
Stolen identity refund fraud never touches your bank. Someone holding your name, birth date and Social Security number files an early return with invented wages and routes the refund to their own account. Filing opens in late January, and beating you to it is the whole strategy.
You e-file and it bounces back rejected, because a return has already gone in under your Social Security number. Other signals: an IRS notice about a return you never sent, or a W-2 from an unknown employer.
The response is Form 14039, Identity Theft Affidavit, filed online at IRS.gov or on paper. A rejected e-file still has to be filed, so print the return, attach the affidavit and mail it. Then wait, because these cases run for months. IRS Identity Theft Central, at irs.gov/identity-theft-central, carries the rest, and our article on identity theft covers the credit side.
That data often comes from you, typing it in. In filing season, phishing messages stop imitating banks and start imitating tax software. Your return was rejected. Your refund needs confirming. The link opens a copy of the login page, accurate down to the logo, and takes your username, password and the code from your phone. The attacker walks off with last year's return, your Social Security number and your bank details. Reach your tax software by typing the address yourself or from a bookmark, turn on two-factor authentication, and set up your free IRS Online Account yourself rather than letting anyone do it for you.
Get an Identity Protection PIN
One step closes this door. An Identity Protection PIN is a six digit number known only to you and the IRS, and an electronic return filed under your Social Security number without the correct one is rejected. A thief holding everything else still cannot file.
Anyone with a Social Security number or an ITIN who can verify their identity may enroll, victim or not. The fastest route is the IP PIN section of your IRS Online Account. If you cannot verify online, Form 15227 is the mail-in application for filers under an income limit, and an appointment at a Taxpayer Assistance Center is open to anyone.
Two details decide whether it works. The number changes every year, so retrieve the new one before you file. And the IRS will never ask you for it, so a call, email or text requesting your IP PIN is a scam by definition.
