If your tax information was exposed, the first hours matter: fast action can limit refund fraud, identity theft, and long-term damage.
This guide explains what to do right away, how to contact the right agencies, and how to protect your records going forward.
What it means when tax information is exposed
Tax information exposure can happen through a data breach, a phishing attack, stolen mail, a compromised tax preparer account, or malware on a personal device.
The risk is serious because tax data often includes Social Security numbers, dates of birth, income details, bank account numbers, and filing history—enough for criminals to attempt refund fraud or open new accounts in your name.
In many cases, exposed tax data is used in identity theft schemes rather than immediate direct theft.
That means the harm may show up later as a rejected return, a suspicious IRS notice, a fake tax return filed in your name, or unfamiliar credit accounts.
How to respond if your tax information was exposed
The best response is to move quickly, document everything, and lock down the most likely points of attack.
Start with the account and filing systems that connect directly to your tax return and financial identity.
1. Secure your tax filing accounts and email
- Change passwords for your IRS Online Account, tax software, email, and financial institutions.
- Use unique, strong passwords that are not reused elsewhere.
- Turn on multi-factor authentication wherever it is available.
- Review recovery email addresses and phone numbers for unauthorized changes.
Email is especially important because it is often the gateway to tax software resets and account recovery.
If criminals can access your inbox, they may be able to intercept IRS notices, password reset links, and bank alerts.
2. Contact your tax preparer or tax software provider
If your information was exposed through a CPA, enrolled agent, payroll provider, or tax software platform, notify them immediately and ask what data was affected.
Request written details about the incident, including the exposure date, the data elements involved, and whether passwords, bank information, or full Social Security numbers were compromised.
If the breach involved a professional preparer, ask what containment measures were taken and whether they reported the incident to law enforcement or regulators.
A reputable provider should be able to explain next steps clearly and offer monitoring or identity protection resources if available.
3. Watch for IRS account takeover and refund fraud
Create or review your IRS Online Account as soon as possible.
If someone has already filed a return using your information, you may receive a notice, or you may discover that your return was rejected because a return under your Social Security number already exists.
Be alert for signs such as:
- A tax return rejection stating a return was already filed.
- IRS letters you did not expect.
- Wage or income statements you do not recognize.
- Changes to your IRS online profile, mailing address, or direct deposit information.
Place a fraud alert or credit freeze
If exposed tax information includes your Social Security number, consider contacting one of the three major credit bureaus—Equifax, Experian, or TransUnion—to place a fraud alert.
A fraud alert makes it harder for identity thieves to open new accounts in your name because lenders are prompted to verify identity more carefully.
A credit freeze is even stronger.
It restricts access to your credit file until you lift it, which can block many new-account applications.
Freezing credit with all three bureaus is free and does not affect your existing accounts or credit score.
- Fraud alert: useful if you want lighter protection and are planning to apply for credit soon.
- Credit freeze: best if you want maximum restriction against new-account fraud.
Report tax identity theft to the IRS
If you suspect your tax data was used to file a fraudulent return, report it to the IRS right away.
The IRS may flag your account for additional verification and issue an Identity Protection PIN, or IP PIN, if you are eligible.
An IP PIN is a six-digit number used to verify your identity when filing your federal tax return.
It helps prevent another person from filing a return in your name.
If the IRS assigns or approves one for you, keep it secure and use it every filing season.
You may also need to submit Form 14039, Identity Theft Affidavit, if the IRS instructs you to do so or if your tax account has already been affected.
The form helps the IRS investigate the issue and protect your account from further misuse.
Notify your state tax agency if state returns may be affected
Tax data exposure can affect state filings as well as federal returns.
If your Social Security number, wage data, or state filing details were exposed, contact your state department of revenue or taxation.
Ask whether a fraudulent state return has been filed and what protections are available.
State agencies often have their own procedures for identity theft cases, and a problem at the state level may not show up in federal records.
Addressing both systems reduces the chance that criminals can use your information across multiple tax jurisdictions.
Check your financial accounts for unusual activity
Because tax records may include bank account numbers and refund deposit details, review every linked financial account.
Look for small test deposits, unfamiliar withdrawals, failed login attempts, new payees, or changes to direct deposit instructions.
- Review checking and savings accounts daily for several weeks.
- Enable transaction alerts for logins, transfers, and new beneficiaries.
- Call your bank if you see even minor suspicious activity.
If a refund was redirected or a bank account was compromised, your bank may be able to reverse unauthorized transactions or close the account to prevent further use.
Document the breach and keep a response file
Good documentation can save time when dealing with the IRS, state agencies, banks, or credit bureaus.
Keep a file with dates, names, case numbers, screenshots, emails, letters, and any credit reports or fraud alerts you place.
Include copies of:
- Breach notification letters
- IRS notices or rejection messages
- Police reports, if you file one
- Support tickets from tax software or preparers
- Statements showing suspicious account activity
Clear records make it easier to prove what happened and track the steps you took to reduce damage.
Should you file a police report?
In some cases, yes.
If your tax information exposure led to identity theft, fraudulent accounts, or stolen funds, a police report may help support disputes with financial institutions and credit bureaus.
It may also be useful if you need to show that the theft was real and reported promptly.
Whether you file locally often depends on the type of fraud and the requirements of the institutions involved.
If you do file, bring your documentation and ask for a copy of the report number or official record.
How to reduce future tax-related risk
Once the immediate threat is under control, strengthen your tax and identity defenses.
Many incidents begin with simple weaknesses such as reusing passwords, missing software updates, or falling for phishing emails that imitate the IRS or a tax preparer.
- Use a password manager and unique passwords for every account.
- Keep devices updated with current security patches.
- Delete suspicious emails and never click unknown tax-related links.
- Use secure file-sharing methods for tax documents.
- Store physical tax records in a locked cabinet.
- Consider obtaining an IRS IP PIN if you qualify.
If you share tax documents with a preparer, ask how they protect client data, whether they use encryption, and how they handle remote access.
Security practices matter because many tax breaches begin in third-party systems rather than the IRS itself.
When to get professional help
If you see repeated account takeovers, fraudulent filings, or complex financial damage, consider working with a tax professional, an identity theft specialist, or an attorney experienced in tax identity theft.
Professional help can be especially useful if your case involves business returns, payroll information, or a large volume of exposed records.
You may also want help if you are unsure whether the exposure involved sensitive identifiers beyond tax documents, such as payroll files, W-2s, 1099s, or banking records.
The broader the exposure, the more important it is to coordinate your response across tax, banking, and credit systems.