What is an IRS Identity Protection PIN, and should a freelancer get one?

An IP PIN is a six-digit number that, per the IRS, prevents someone else from filing a tax return using your Social Security number or ITIN. The IRS says anyone with an SSN or ITIN who can verify their identity is eligible to enroll, even if they are not required to file, and the fastest route is the IP PIN section of your IRS online account profile. It is valid for one calendar year, so you retrieve a new one each year and must use it on any federal return you file that year, including prior-year returns. Enrolling does not stop other forms of identity misuse, such as a forged 1099 or a fake employer, so it is one layer of protection and not a complete one. This is general education, not tax advice.

What happens if I file my return without my IP PIN or with the wrong one?

The IRS says an incorrect or missing IP PIN will result in the rejection of your e-filed return, or a delay of your paper return until it can be verified. Because the IP PIN changes every calendar year, the usual cause is using last year's number. Log in to your IRS online account and read the current one from your profile page, or call the IRS to have it reissued by mail if you are eligible. The IRS says a reissue by mail is not available if you opted into the program for the first time during the current calendar year, or during the year-end maintenance period that normally runs from November through mid-January, so do not plan around a mailed copy at the deadline. A rejection for a missing IP PIN is not by itself proof of identity theft.

Do I have to file Form 14039 if my SSN was used on a fake tax return?

Often not. The IRS says most people do not need to file Form 14039, and says not to file it if you already submitted it or filed through IdentityTheft.gov, if the IRS already sent you a letter or notice, if the identity theft is not tax-related, or if you used or were told to use the Identity and Tax Return Verification Service. The IRS says to file only if it tells you to, if you cannot use that verification service, or if you want to report possible tax-related identity theft it does not have on file, such as a data breach. The form has three situations on it: a fraudulent federal return, a dependent fraudulently or incorrectly claimed, or an SSN or ITIN used for employment. Your own facts decide, so confirm with the number on your IRS letter or a tax professional.

I received a 1099-NEC from a company I never worked for. Do I report it?

The IRS guidance on employment-related identity theft says that if you receive a Form W-2 or Form 1099 from an unknown employer, you should not include that income on your return or amend a return you have already filed, and you should contact the Social Security Administration. That instruction applies to income that is not yours. If you are not sure whether you did any work for the payer, even a small job or a client that changed its name, check your invoices and bank deposits first, because a real but forgotten payment still belongs on Schedule C. If the notice you receive is a CP2000, follow the instructions on the notice itself. This is general education, not tax advice.

What is the Identity and Tax Return Verification Service?

It is the IRS online tool for verifying your identity and your return, and the IRS says to use it only if you were sent a CP5071 series notice or Letter 5447C. You sign in or create an IRS account and answer questions about the return, so keep a copy of the original or amended Form 1040 for the year on the letter nearby. If you verify your return, the IRS says you do not need to file Form 14039 unless it tells you to. The IRS says to wait 2-3 weeks after using the service before checking your refund, and that processing may take up to 9 weeks after you verify. Do not use it for a letter you cannot match to those notice numbers. Check the letter by calling the number on it or 800-829-1040.

Does using an EIN instead of my SSN on Schedule C prevent tax identity theft?

No. An EIN on your Form W-9 keeps your Social Security number off the forms you hand clients, which reduces how many copies of the SSN exist, but your Form 1040 is still filed under your SSN, and the Schedule C is part of that return. An EIN is not a substitute for an IP PIN. The IRS also lists an EIN you did not apply for as a warning sign of identity theft. Which form to use turns on which number was misused. If your SSN was used on a Form 1040 return, the form is Form 14039. If a business's EIN was misused, the form is Form 14039-B, the Business Identity Theft Affidavit (Rev. 5-2021), which has boxes for a sole proprietor and for the sole member of a limited liability company. For an EIN you did not apply for, Form 14039-B Section A box 1 points to irs.gov/notmyein.

Should I keep paying estimated taxes and filing on time while an identity theft case is open?

Yes. The IRS steps for victims say to file returns and pay tax as usual. An unresolved identity theft case does not suspend your filing or payment obligations, and a late return or late payment can add penalties that a later resolution may not erase. The fallback differs by cause. If an e-file is rejected as a duplicate because your SSN was misused, Form 14039 (Rev. 2-2026) says that if you checked Section B box 1 or 2 and cannot file electronically, you attach Form 14039 to the back of your paper return and submit it to the IRS location where you normally file, unless an IRS letter already told you what to do. If the problem is your IP PIN, retrieve it online or have it reissued by mail first; the IRS says to mail a paper return without it only if the PIN cannot be reissued by mail and you cannot create or access an online account. A paper return is reviewed to verify your identity and can delay a refund. Penalty relief, if any, depends on your facts, so confirm with a tax professional.

How do my business records help if someone files a fake Schedule C in my name?

Your records are the evidence that separates your real income from a forged one. A fake return will not match your actual invoices, bank deposits, 1099s from real clients, mileage log and receipts, and the IRS asks you to verify your identity and return, not to prove a negative. Records do not replace the IRS identity process: you still follow the instructions on any notice and may need a copy of the fraudulent return, which the IRS says you can request on Form 4506-F. Keep records of every letter, call and email in the case, which the IRS also recommends. This is general education, not tax advice.

Tax Identity Theft When You Are Self-Employed: IP PIN, Form 14039 and What to Do If Someone Files in Your Name (2026 Guide for Freelancers)

Published: October 5, 2026 · Reading time: 11 min

TL;DR: Your Social Security number is on most Form W-9s you give a client unless you give an EIN instead, so freelancers have more copies of it floating around than a W-2 employee does. The IRS Identity Protection PIN (IP PIN) is a six-digit number, valid for one calendar year, that stops someone else from filing a return with your SSN. Form 14039 is the identity theft affidavit, but the IRS says most people do not need to file it: if the IRS already sent a letter, or you were told to use the Identity and Tax Return Verification Service, you usually skip it. A 1099 from a client you never had is a signal to contact the Social Security Administration, not a number to put on your Schedule C. And keep filing and paying on time while a case is open. Your own invoices, deposits and mileage log are what let you verify your real income. This guide is general education and not a substitute for a tax professional.

Why Does a Freelancer Face a Different Identity Theft Problem?

A W-2 employee hands an SSN to one employer. You hand yours, or at least your EIN and address, to every client that needs a Form W-9, every payment platform and every marketplace that issues a 1099. That is more places for it to leak, and a data breach at any of them can put it into someone else's hands.

The IRS lists several ways your information gets misused. Its list of warning signs includes a rejected tax return, a "Form W-2 or Form 1099 from employer you didn't work for," a 1099-G for unemployment benefits you did not apply for, an EIN you did not apply for, and an "Unreported income alert, like a CP2000 series notice." Several of those land directly on a self-employed person's desk. A CP2000 is already a familiar notice to Schedule C filers, as the CP2000 guide explains, and the IRS itself says these signs do not always mean you have been affected by identity theft, so look before you assume.

This guide assumes you are a U.S. sole proprietor or single-member LLC filing Schedule C with your Form 1040. Nothing here changes how you compute profit; it is about whether the return on file at the IRS is yours.

What Does an IP PIN Do?

The IRS describes it as "a six-digit number that prevents someone else from filing a tax return using your Social Security number (SSN) or individual taxpayer identification number (ITIN)." It is known only to you and the IRS, and the agency says it helps verify your identity when you file an electronic or paper return.

How it works in practice, per the IRS IP PIN pages:

Who can get one. Anyone with an SSN or ITIN who can verify their identity can enroll, including if you are not required to file.
Fastest route. Your IRS online account, in the IP PIN section of your profile page.
It changes every year. "An IP PIN is valid for one calendar year." A new one is generated each year, and once you opt in online you retrieve it online each calendar year. The IRS says it is generally viewable in your account from mid-January through mid-November.
Prior-year returns need it too. The IP PIN must be used on any federal return filed during that calendar year, including prior-year returns. If you file your 2026 return in early 2027, you use the number for 2027.
Where you enter it. The IRS says it is used only on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS. For a freelancer, that means your Form 1040 with Schedule C attached.

Two cautions from the IRS. "The IRS will never ask for your IP PIN," so any call, email or text asking for it is a scam. And the IRS says to give it only to your tax professional, and only when you are ready to sign and submit.

An IP PIN protects the front door: a return filed under your SSN. It does not stop a forged 1099 or someone using your SSN to get a job. Treat it as one layer of three or four.

What if you lose it?

The IRS says that filing without it means "An incorrect or missing IP PIN will result in the rejection of your e-filed return or a delay of your paper return until it can be verified." If you need it reissued, log in to your online account, or call 800-908-4490. A verified caller's IP PIN is mailed within 21 days. The IRS says mail reissue is not available if you opted in for the first time during the current calendar year, or during the year-end maintenance period that normally runs from November through mid-January. Plan to retrieve it online before you are mid-return.

What if you cannot get an online account?

The IRS offers Form 15227 if your adjusted gross income on your last filed return was below $84,000 for individuals or $168,000 for married filing jointly, with a phone call to verify identity, and an in-person appointment at a Taxpayer Assistance Center for everyone else. Those routes are slower, so enroll well before filing season.

What Are the Warning Signs on a Freelancer's Desk?

What you notice	What it can mean	First move
Your e-file is rejected and the error mentions a duplicate return or an IP PIN	Someone may have filed first, or you used the wrong year's IP PIN	IP PIN error: re-check it against your online account, or have it reissued by mail. Duplicate: follow any IRS letter; otherwise attach Form 14039 to a paper return
A 1099-NEC or W-2 from a payer you never worked for	Your SSN may have been used for work you did not do	Do not report it on your return; contact the Social Security Administration
A 1099-G for unemployment benefits you never applied for	Someone may have claimed benefits in your name	IRS lists it as a warning sign; follow the IRS identity theft guide
A CP2000 listing income you did not earn	Third-party reports under your SSN do not match your return	Follow the notice instructions; check payer names against your own invoices
An EIN you did not apply for	Someone may have opened a business account under your name	The IRS lists it as a warning sign; Form 14039-B Section A box 1 and irs.gov/notmyein cover an EIN you did not apply for
A CP5071 series notice or Letter 5447C	The IRS flagged your return for identity verification	Use the Identity and Tax Return Verification Service
A letter you cannot match to any return you filed	A fraudulent return may be on file	Verify the letter by calling 800-829-1040, then follow its instructions

A 1099-NEC with your SSN from an unknown payer is not income you earned, and the IRS says not to put it on your return. But rule out a real client that changed its legal name, a platform that issued the form under a parent company, or a one-off job you forgot. The reconciliation guide for 1099-NEC and 1099-K income shows how to match forms to deposits, and a real-but-forgotten payment is the one case where ignoring the form is wrong.

When Is Form 14039 the Right Form, and When Is It Not?

Form 14039 (Rev. 2-2026) is the Identity Theft Affidavit. It has three situations in Section B: you know or suspect someone used your information to fraudulently file a federal return, you or a dependent were fraudulently or incorrectly claimed as a dependent, or your SSN or ITIN was fraudulently used for employment. The form is explicit that if your situation is none of those, "If your situation is not one of the scenarios above, do not file a Form 14039."

On the IRS pages the starting point is "Most people don't need to file this form." Do not file it if:

You already sent it or filed through IdentityTheft.gov.
The IRS already sent you a letter or notice (follow what it says).
The identity theft is not tax-related.
You used, or were told to use, the Identity and Tax Return Verification Service.
The misused number is a business EIN rather than your SSN, or you are a business, trust, estate or tax-exempt organization. The IRS points those cases to Form 14039-B.

File only if the IRS tells you to, if you cannot use the verification service, or if you want to report possible tax-related identity theft the IRS does not have on file, such as a data breach.

One exception to read alongside that list: Form 14039's own instructions say that if you checked Section B box 1 or 2 and cannot e-file because your SSN, your spouse's or a dependent's was misused, you attach the form to the back of your paper return and submit it to the IRS location where you normally file. If an IRS letter has already told you what to do, follow the letter.

The verification service replaces the affidavit in the common case

If the IRS sends a CP5071 series notice or Letter 5447C, it directs you to the Identity and Tax Return Verification Service. The IRS says "Only use this service if we sent you a CP5071 series notice or letter 5447C." Have the original or amended Form 1040 for the year on the letter. If you did not file, the service lets you tell the IRS, because someone may have tried to file with your information. The individuals identity theft guide says: "Don't file Form 14039, Identity Theft Affidavit if you use this service." The verify page is softer: "If you verify your return, you don't need to complete Form 14039, Identity Theft Affidavit, unless we tell you." After you verify, the IRS says "Wait 2-3 weeks after you use this service to check your refund" and "It may take up to 9 weeks to process your return after you verify it."

Sole proprietor: individual or business filer?

A sole proprietorship's income is reported on your personal Form 1040 through Schedule C, so the individual path above is the natural fit. The IRS business identity theft page describes business warning signs such as being unable to e-file "because one was already filed with the same EIN or SSN" and says it may send Letter 6042C or 5263C to validate a business return. The rule is by which number was misused. A fraudulent Form 1040 under your SSN is a Form 14039 situation. Misuse of a business EIN is a Form 14039-B (Rev. 5-2021) situation, and that form's Section C has boxes for "I am a sole proprietor" and "I am the sole member of a limited liability company." The enrolled agent versus CPA guide can help you choose who to ask if your facts straddle both.

A Worked Scenario: The Rejected E-File

Priya is a freelance illustrator. In February 2027 she e-files her 2026 return and it is rejected. Here is the decision path, with each step tied to an IRS source.

Read the rejection reason. If it cites a missing or incorrect IP PIN, she is not yet a victim. She enrolled in 2025 and typed the 2026 number from last year's records. She logs in to her IRS account, reads the current-year number from her profile and re-files. Done.
If it says a return was already filed under her SSN, she does not guess. The IRS says to follow its instructions. If it sends a CP5071 series notice or Letter 5447C, she uses the Identity and Tax Return Verification Service with her 2026 Form 1040 in hand.
She pulls her own records together. If a letter later shows a 1099 from a payer she does not recognize, her invoices and deposits show no match.
She keeps filing and paying. The IRS tells victims to file and pay as usual, so she does not hold her estimated payments. If the rejection was a duplicate, she follows any IRS letter; otherwise she attaches Form 14039 to the back of a paper return. If the problem was her IP PIN, she retrieves it online or has it reissued by mail first, and mails a paper return without it only if it cannot be reissued and she cannot create or access an online account. Either way she expects a slower refund.
She closes the gap. She reports to the FTC at IdentityTheft.gov, places a fraud alert and changes her IRS online account password.

No dollar figures are in this scenario because the tax on her return is unaffected. The cost of identity theft is time and delay, not a different tax calculation.

Why Do Your Books Help?

The IRS process is designed to verify your identity and your return. Your records help in three specific ways:

Sorting real from forged income. A third-party form under your SSN from a payer with no invoice, no deposit and no emails is a strong sign it is not your income. The IRS employment guidance says only that a W-2 or 1099 from an unknown employer should not go on your return.
Answering an automated mismatch. Even when the cause is not fraud, a CP2000 is resolved by matching reported income to your actual payments. See the CP2000 guide and the six-year audit window guide for how long to keep what.
Supporting an identity check on a real return. If the IRS asks you to verify the return you filed, a dated, categorized record tells you what is on it. The Schedule C audit triggers guide covers the same habit.

Records do not replace the IRS process. If you need a copy of the fraudulent return itself, the IRS says to send Form 4506-F, and the IRS guide says to get a form, if needed, to designate a representative.

What Should You Do This Fall to Lower the Risk?

Enroll in the IP PIN program through your online account before filing season, and plan to retrieve a new number each January.
Use a complex, unique password for your IRS online account, per the IRS prevention tips.
Hand clients an EIN on the W-9 instead of the SSN where it is allowed. See the EIN versus SSN guide. It reduces exposure; it does not replace an IP PIN.
Keep a case folder if anything looks off. The IRS says: "Keep records of letters, phone calls and emails."

Common Mistakes to Avoid

Reporting a 1099 you did not earn. The IRS says not to put income from an unknown employer's W-2 or 1099 on your return or to amend one you already filed.
Filing Form 14039 reflexively. If you got a CP5071 series notice or Letter 5447C, the IRS directs you to the verification service instead.
Using last year's IP PIN. It is valid for one calendar year.
Waiting until January to enroll. Alternative enrollment routes are slower, and a mailed reissue is not available during the year-end maintenance period.
Pausing your filing or estimated payments. The IRS says to file returns and pay tax as usual.
Responding to a "verification" text or email. The IRS says it does not start contact that way and will never ask for your IP PIN.

How CentSense Helps

An identity check is only fast if you know what your real year looked like. CentSense helps with the records side:

Scan receipts with AI so each business expense is documented the day it happens
Categorize expenses to the correct Schedule C line, so the return you filed is easy to rebuild or verify
Log business miles by date, with the right rate for each half of 2026
Keep personal and business spending separate throughout the year
Export a CPA-ready CSV so the person helping you can match your books to what the IRS shows

CentSense does not file identity theft affidavits, enroll you in the IP PIN program or communicate with the IRS for you. It gives you clean records to bring to the process.

Authoritative References

Do not let a forged return be the first time you check your records. Start a free CentSense account, scan every business receipt the day you get it, log your miles by date and keep a categorized Schedule C record you can verify in minutes. The free tier includes 10 AI receipt scans a month, no credit card required, and the Solo plan is $5/month for unlimited scans, mileage tracking and a CPA-ready CSV export. Start free →

This guide is general education for U.S. self-employed taxpayers filing Schedule C. It is not personalized tax or legal advice. IRS procedures, notice numbers and forms change, and how identity theft is handled depends on your facts, so follow the instructions on any IRS notice you receive and confirm next steps with a CPA, enrolled agent or the IRS directly.

Compare alternatives

See how CentSense stacks up to other expense and receipt tools for freelancers.