What to Do If Your W-2 Is Stolen

A stolen Form W-2 is a serious concern because it contains your full name, address, Social Security number (SSN), and detailed income data. In the wrong hands, this information becomes a tool for committing identity theft.

The primary risk is tax-related identity theft, where a criminal uses your SSN and wage information to file a fraudulent tax return and claim a refund. This can create significant complications with the Internal Revenue Service (IRS), potentially delaying your legitimate refund and involving you in a lengthy resolution process. Taking immediate action is the best way to mitigate potential damage.

Initial Steps for Identity Protection

If your W-2 is missing or compromised, your first actions should focus on safeguarding your financial identity. Contact one of the three major credit bureaus—Equifax, Experian, or TransUnion—to place an initial fraud alert on your credit file. When you contact one bureau, it must notify the other two. This alert signals to creditors that they should take extra steps to verify your identity before extending new credit.

For a higher level of security, you can request a credit freeze with each bureau. A credit freeze restricts access to your credit report, which most creditors need before approving a new account. While a fraud alert lasts for one year, a credit freeze remains in effect until you lift it. This step is free and provides a significant barrier against unauthorized financial activity.

You should also file a report with the Federal Trade Commission (FTC) through its website, IdentityTheft.gov. This site guides you through creating a recovery plan and generates an official Identity Theft Report. This report is documentation that proves to businesses and government agencies that your identity has been stolen, which is necessary for resolving fraudulent issues.

Consider filing a report with your local police department as well. A police report serves as another official record of the crime. Paired with your FTC Identity Theft Report, it strengthens your case when disputing fraudulent activity. Keep copies of all reports and correspondence for your records.

Contacting Federal and State Agencies

After protecting your credit, you must notify relevant agencies about the compromised tax information. Your first call should be to your employer’s payroll or human resources department. Inquire if the loss was part of a larger data breach and request a replacement copy of your W-2, as you will still need it to file your taxes.

Next, inform the IRS that your information has been compromised. This can help the agency flag your account for suspicious activity. If a fraudulent return has been filed using your SSN, the IRS will likely send you a notice, such as a Letter 5071C, asking you to verify your identity. Responding to this notice promptly is necessary.

The Social Security Administration (SSA) should also be on your contact list. A thief could use your stolen SSN to gain employment, resulting in incorrect earnings being posted to your Social Security record. You can check your earnings statement for accuracy by creating a “my Social Security” account on the SSA’s website and reporting any discrepancies.

A criminal could also use your information to file a fraudulent state tax return. Contact your state’s department of revenue or taxation to report the potential identity theft. Each state has its own procedures, and notifying them early can prevent a fraudulent state refund from being issued in your name.

Preparing the IRS Identity Theft Affidavit

The tool for officially reporting tax-related identity theft to the IRS is Form 14039, the Identity Theft Affidavit. This form alerts the IRS that your information has been compromised and you may be a victim of tax fraud. Filing this affidavit initiates an IRS investigation and places a special marker on your tax account for future protection.

You can download Form 14039 from IRS.gov. Before filling it out, gather your full name, current address, and Social Security number. You will also need the address from your last filed tax return if it has changed, and the tax year affected by the identity theft.

The form is divided into several sections. Section B asks you to specify how you were affected. For example, you would check a box if you tried to e-file and were rejected because a return was already filed with your SSN, or if you received a specific IRS notice about a suspicious return.

Other sections require your personal contact information and details about the tax return for the year in question, including your filing status and adjusted gross income if you know it. After completing the form, you must sign and date it under penalty of perjury, affirming that the information is true.

How to File Your Taxes After W-2 Theft

After completing the Identity Theft Affidavit, you must file your legitimate tax return. If you believe a fraudulent return has been filed, you cannot e-file because the IRS system will reject a second return for your Social Security number. You must file a paper tax return by mail.

Prepare your paper return and attach a copy of the completed Form 14039. Send the entire package to the IRS service center where you would normally file your return.

Be prepared for a significant delay in processing your return and receiving any refund you are due. The IRS must manually process paper returns flagged for identity theft, which takes longer than an e-filed return. The agency will investigate your claim, which involves comparing your legitimate return with the fraudulent one.

After the IRS processes your case, you will likely be issued an Identity Protection PIN (IP PIN). An IP PIN is a six-digit number that adds an extra layer of security. For all future tax years, you will need to use this IP PIN to verify your identity when you file your federal tax return.