Filing early in 2027? The IRS says to request an Identity Protection PIN before mid-November

On October 22, 2026, the IRS reminded taxpayers to guard against tax-related identity theft in two ways: by protecting the sign-in details for their IRS online account and by getting an Identity Protection PIN (IP PIN). It also flagged a timing issue: the online system that hands out IP PINs shuts down for annual maintenance in mid-November and is generally back starting in mid-January. If you plan to file early in 2027, the IRS says to request one before the shutdown.

What an IP PIN does

An IP PIN is a six-digit number that keeps someone else from filing a federal tax return with your Social Security number or individual taxpayer identification number (ITIN). Only you and the IRS know it, and the IRS uses it to confirm it's really you when you file, on paper or electronically. A few rules apply:

• It's valid for one calendar year, and a new one is generated every year.
• Once you have one, you must use it on every federal return you file during that year, including returns for earlier years.
• A wrong or missing IP PIN gets an e-filed return rejected, and a paper return is delayed until the IRS can verify it.
• It goes only on federal Forms 1040, 1040-NR, 1040-PR, 1040-SR, 1040-SS and 1040-X, not on a state return or a Form 4868 extension request.

Who can get one, and how

Anyone with an SSN or ITIN who can verify their identity can enroll. According to the IRS, you can get one even if you aren't required to file a federal return, and parents and legal guardians can also request one for dependents.

The fastest route is your IRS Individual Online Account. Sign in, open your profile and request a PIN in the IP PIN section. New users must register and verify their identity first, and the IRS suggests having photo identification ready. You'll be offered two options:

• Continuous enrollment keeps you in the program for this year and future years.
• One-time enrollment covers only the current calendar year, and you're automatically opted out when it ends.

If you sign up online, the IRS won't mail you the new number each year. You retrieve it from your account every calendar year; it is generally viewable from mid-January through mid-November.

If you can't use the online account

• Form 15227: if the adjusted gross income on your last return is under the limits the IRS lists and you have access to a phone, you can apply online with this form. The IRS calls to verify your identity, then mails the IP PIN, usually within four to six weeks, and sends a new one by mail each year after that.
• In person: if neither option works for you, make an appointment at a Taxpayer Assistance Center (844-545-5640) and bring one federal or state photo ID plus a second form of identification. The PIN usually arrives by mail within three weeks.
• Dependents under 18 can't be enrolled online, so parents need one of these alternatives.

The IRS notes that both alternatives take longer than the online account.

Keep the PIN and your account to yourself

• Don't share your online account sign-in details with anyone. The IRS notes the account can hold sensitive records such as recently filed returns, refund status, payments, tax records, notices and service requests.
• Give your IP PIN only to a trusted tax professional, and only once you're ready to prepare and submit your return. If you use tax software, enter it when the software asks for it.
• The IRS will never call, email or text you, or contact you on social media, to ask for your IP PIN. A call, email or text that asks for it is a scam.
• In the profile section of the online account, you can also turn on email notifications for new account information or activity.

Signs of tax identity theft and where to report

The IRS lists warning signs worth a closer look, though it says they don't always mean your identity was stolen:

• your tax return is rejected;
• you receive a Form W-2 or 1099 from an employer you never worked for;
• someone offers to "help" with your online account;
• you get alerts about password resets or sign-in verifications you didn't request.

The IRS asks you to send fake IRS emails to phishing@irs.gov. For a suspicious text, email phishing@irs.gov with the subject "Text", the sender's number, the message, your own number and when you got it, and forward the text to 7726 (SPAM). For a suspicious IRS-related call, the IRS says to note the number, hang up and call the Treasury Inspector General for Tax Administration (TIGTA) hotline at 800-366-4484.

If your identity was stolen, the IRS says to stop all contact with the thief, change your online account password to a complex, unique one, follow the instructions in any IRS letter or notice, report the theft, work through the recovery steps on IdentityTheft.gov, get an IP PIN and keep records of letters, calls and emails. Most people don't need Form 14039, the Identity Theft Affidavit: the IRS wants it only in specific cases, such as when it tells you to file one.

An IP PIN keeps a thief from filing a federal return with your Social Security number. If you plan to file early, request one before mid-November, and keep it to yourself until you, or a trusted tax professional, file your return.