What Happens If Someone Steals My W2?

The discovery that your Form W-2 has been stolen can be alarming. This document contains sensitive data, including your full name, address, Social Security number (SSN), and detailed income information. A criminal can use this information to commit tax-related identity theft by filing a fraudulent tax return to claim a refund. There are established procedures with federal agencies to help you report the theft, protect your identity, and fulfill your tax obligations.

Immediate Actions to Protect Your Identity

Contact your employer’s human resources or payroll department. Inform them that your W-2 was stolen and request a copy. This action ensures you have the document to file your own taxes and alerts your employer to a potential data breach.

You must file an official identity theft report with the Federal Trade Commission (FTC) online at IdentityTheft.gov. Completing this report generates an official record of the crime and provides you with a personalized recovery plan. This FTC report is a document you will need when dealing with other agencies.

To prevent thieves from opening new lines of credit, place a fraud alert on your credit files. You only need to contact one of the three major credit bureaus—Equifax, Experian, or TransUnion. The bureau you contact is required by law to notify the other two. An initial fraud alert lasts for one year and requires lenders to take extra steps to verify your identity before issuing new credit.

Finally, you need to notify the Internal Revenue Service (IRS) of the potential identity theft. This is a separate action from filing your tax return and can be done by calling the IRS’s specialized identity theft protection line. Reporting the theft to the IRS flags your account, making it more difficult for a fraudulent return to be processed.

Filing Your Tax Return After W2 Theft

If you attempt to e-file your return and it is rejected because a return has already been filed using your SSN, this is a clear sign that a thief has acted first. In this scenario, you must complete and file IRS Form 14039, the Identity Theft Affidavit. This form must be attached to your legitimate tax return, which you will then need to print and mail to the IRS; you will not be able to e-file.

If you cannot obtain a replacement W-2 from your employer before the tax filing deadline, you can use Form 4852, Substitute for Form W-2. To complete this form, use your final pay stub to provide your best estimates of total wages earned and federal income, Social Security, and Medicare taxes withheld. This form is then attached to your paper-filed tax return in place of the missing W-2.

The IRS will investigate your claim, which can delay your refund. Victims of identity theft often wait for the IRS to process their legitimate returns. During this period, keep copies of all correspondence with the IRS, including the mailed return with Form 14039. The agency will eventually resolve the conflicting returns, process your valid one, and clear the fraudulent one from your record.

Long-Term Protective Measures

To secure your tax account against future fraud, opt into the IRS’s Identity Protection PIN (IP PIN) program. An IP PIN is a six-digit number that provides an extra layer of security, preventing anyone from e-filing a tax return using your Social Security number without it. You can request an IP PIN through the “Get an IP PIN” tool on the IRS website, and the IRS will issue you a new PIN each year.

Beyond the initial one-year fraud alert, actively monitor your credit by reviewing your full credit reports from Equifax, Experian, and TransUnion. You are entitled to free weekly reports from all three bureaus through AnnualCreditReport.com. Scrutinize these reports for any accounts, inquiries, or debts you do not recognize.

You should also create a “my Social Security” account on the Social Security Administration’s (SSA) website to view your earnings record. Periodically check this statement to ensure that all reported wages are from your actual employers. If you see income from an employer you have never worked for, it means someone else is using your SSN for employment, a separate form of identity theft that you must report to the SSA.