Could Someone File a Tax Return in Your Name? What Owners With Complex Finances Should Protect

The message looks routine: your accountant needs one more document, your tax account needs verification, or a refund is waiting. You are between meetings, and the request refers to a business or investment you recognize. It would take only a moment to sign in.

That moment deserves a pause.

Yes. Someone who obtains your identifying information may attempt to file a fraudulent tax return in your name, even without access to your IRS online account. Protecting account credentials, obtaining an IRS Identity Protection PIN and controlling how tax documents move between people provide different layers of protection. If you suspect misuse, secure affected accounts and follow the IRS response process for your specific situation.

On October 22, the IRS issued IR-2026-127, reminding taxpayers to safeguard IRS online-account credentials and obtain an Identity Protection PIN. For owners managing businesses, property, investments or a vessel, the reminder is a reason to review the entire information-sharing process.

Your tax file contains more than income figures

A complete return can bring together identifying information, addresses, family details, business interests and financial-account information. Supporting records can add signatures, identification documents and contact details for the professionals you rely on.

Consider an illustrative owner with an S corporation, two rental partnerships and a charter yacht. Their accountant, lender, bookkeeper and administrative assistant may each need different parts of the financial file. Forwarding the complete return to everyone creates additional copies even where a smaller set of records would have met the request.

This is a practical information-management concern, not evidence that every person with complex finances faces a higher measured rate of identity theft. The response is to decide what each person needs and how they should receive it.

Protect your IRS account and the email account behind it

Start at IRS.gov using an address you enter yourself or a trusted bookmark. Avoid signing in through an unexpected message claiming your account is locked or needs urgent verification.

Use unique credentials for your IRS sign-in, email, document portal and financial accounts. Turn on multifactor authentication where available. The IRS’s October cybersecurity guidance recommends unique passwords, password managers, software updates, secure storage and backups for tax records.

Treat your email account as part of your financial security. It may receive password-reset messages and sensitive correspondence. An assistant’s need to organize documents does not justify sharing the owner’s personal IRS login.

The FBI’s online-safety guidance also recommends unique passphrases and MFA, and warns against sharing authentication codes. Approve only sign-in requests you initiated. Verify an unusual document or payment request through a previously established contact method.

What an IRS Identity Protection PIN does

An IP PIN is a six-digit number used to help prevent fraudulent federal income-tax filings with your Social Security number or individual taxpayer identification number. You can obtain one proactively; you do not have to wait to become a victim. The IRS enrollment page explains eligibility and the available verification methods.

The fastest route is generally through your IRS Online Account. If online identity verification is unsuccessful, review the IRS alternatives. Some application methods have income restrictions; an in-person Taxpayer Assistance Center appointment may be an option for people who cannot use those methods.

The IP PIN protects the filing process. It does not secure your email, stop a fraudulent wire transfer or freeze your credit. It should sit alongside account security and careful document handling.

Use the IP PIN for the year you file

The IRS IP PIN FAQs explain that a new number is generated each year. When an IP PIN is required, use the one valid for the calendar year in which the return is filed, including a prior-year return filed that year.

For example, a 2025 return filed during 2026 uses the applicable 2026 IP PIN. A return filed during 2027 uses the applicable 2027 number. Store it securely and provide it to your verified preparer through the agreed secure channel when needed for filing.

An IP PIN is different from a one-time sign-in verification code. A preparer may need the IP PIN to submit your return; they do not need you to disclose your personal login credentials or authentication codes. Family members who have their own IP PINs must be handled under the applicable IRS filing instructions.

Share documents with defined access

MFS recommends using an agreed secure portal or protected document-sharing process, reached through a previously verified address. Give each recipient access to the records needed for the task and review that access when an engagement ends.

When a lender requests a tax return, confirm the request and destination. When a broker needs proof of funds, determine whether the requested evidence requires a complete tax file. When an assistant changes roles, review their access rather than assuming old permissions have expired.

Avoid sending passwords in the same message as protected files. Keep a controlled copy of important records, protect paper documents and dispose of unneeded copies securely. Convenience should not leave tax returns scattered across inboxes and unrestricted shared folders.

These are recommended working practices. A portal’s existence alone does not establish that its permissions, users or devices are secure.

Warning signs that deserve attention

The IRS identity-theft guide identifies warning signs including rejected returns, unfamiliar income documents and unexpected account activity. These signals warrant investigation; they do not prove identity theft on their own.

What you notice	First response
Your return is rejected because a return was already filed using your identification number	Have your preparer verify the rejection and follow the applicable IRS process
An IRS notice refers to a return or account activity you do not recognize	Verify the notice independently and respond through the official instructions
A login or password-reset alert arrives unexpectedly	Check the account directly and secure it if access is unauthorized
A familiar contact suddenly requests credentials, tax documents or changed payment instructions	Verify through an established contact method before acting

A convincing name or accurate business detail is not sufficient verification. Contact the person using a number or address already in your records.

What to do after suspected misuse

Secure access and identify what was exposed

Stop interacting with the suspicious sender. If credentials were disclosed, change the affected password through the official service and change it anywhere it was reused. Review recovery details and active sessions with the provider or your IT professional. If a device may be compromised, use a trusted device for recovery and seek technical assistance.

The FTC’s response guidance addresses stolen information, passwords, device access and fraudulent payments. If money was transferred, contact the financial institution immediately through a verified channel and ask about recovery options. A refund or reversal is not guaranteed.

Follow the tax-specific process

Notify your existing tax preparer through a verified channel. Follow any authenticated IRS notice and the instructions applicable to the incident. The IRS advises affected taxpayers to preserve correspondence and continue filing returns and paying taxes as required.

Do not assume that every incident requires Form 14039. The current Identity Theft Affidavit specifies when to use it and warns against duplicate submissions. If the IRS directs you to its Identity and Tax Return Verification Service, follow that process instead of automatically filing another affidavit.

Personal and entity incidents also require different treatment. For suspected misuse involving a business, trust or estate, consult the IRS business identity-theft guidance rather than assuming the individual form applies.

Address the wider identity risk

Use IdentityTheft.gov for a recovery plan where identity theft has occurred. If your information could be used to open credit accounts, consider a credit freeze. The FTC explains that placing or lifting a freeze is free and that you must contact each of the three nationwide credit bureaus.

A credit freeze and an IP PIN address different systems. Freezing credit does not prevent a fraudulent tax filing, and obtaining an IP PIN does not replace a credit freeze.

Make protection part of financial administration

Owners do not need to give every adviser access to every account to keep their financial affairs coordinated. A workable process identifies who maintains the records, who may receive documents, who prepares the return and how sensitive changes are verified.

Before the next filing cycle, confirm that your sign-in and recovery methods work, review IP PIN enrollment, and agree how the current number will reach your preparer. Give the same attention to the email and document accounts used by anyone helping administer your affairs.

If you suspect identity theft, use the official recovery steps and contact your existing preparer promptly. For ongoing coordination of complex financial records, explore MFS Personal CFO services or request a consultation. Keep Social Security numbers, IP PINs, credentials and confidential documents out of a general website inquiry; arrange a verified secure channel first.

Client bulletin researched October 23, 2026. IRS procedures and service availability can change; use the linked official instructions for your situation. Financial administration support does not replace technical incident response from your account provider or cybersecurity professional.

Sources

• IRS IR-2026-127: Protect tax information
• IRS cybersecurity awareness guidance
• Get an Identity Protection PIN
• IRS IP PIN FAQs
• IRS identity-theft guide for individuals
• Form 14039 Identity Theft Affidavit
• IRS business identity-theft guidance
• FTC: What to do if you were scammed
• IdentityTheft.gov
• FTC credit freezes and fraud alerts
• FBI online-safety tips

Explore more:High-Income Individuals