How to Save Your Business from Tax ID Theft

Tax ID theft occurs when a business’s Employer Identification Number (EIN) is used without authorization. In most cases, this involves tax, payroll filings, or information returns submitted using a legitimate EIN that does not belong to the filer. Many businesses only discover the issue after receiving an unexpected IRS notice or learning that a return has already been filed. When this happens, IRS processing slows down, refunds can be delayed, and compliance concerns may arise.

This article explains how tax ID theft affects businesses, what warning signs to watch for, and how business owners can respond and reduce risk using guidance from the Internal Revenue Service.

Key Takeaways

Tax ID theft involves unauthorized use of an EIN
Many cases are discovered through IRS notices or rejected filings
The IRS follows separate procedures for business identity theft
Limiting EIN exposure and monitoring filings can reduce risk

How Tax ID Theft Affects Businesses

Unlike individual identity theft, unauthorized EIN activity can continue unnoticed for a period of time before being detected. Fraudulent filings can occur without the business’s knowledge until the IRS identifies conflicting information. Once identified, the IRS may review the account to determine which filings are legitimate and which can interrupt normal processing.

Fraudulent Tax Returns Field First

A stolen EIN may be used to file a business tax return before the actual business files its own return. When this happens, the IRS may notify the business that a return has already been received, requiring additional steps to correct the record.

False Payroll or Information Returns

Unauthorized payroll filings, such as Forms 941 or W-2, can cause discrepancies between reported wages and actual payroll records. These inconsistencies often result in IRS notices and require clarification before the account can return to normal processing.

IRS Processing Delays

When the IRS detects unauthorized EIN activity, it may temporarily restrict certain actions on the business account. Refunds, amended returns, or other requests may take longer while the situation is reviewed.

Fast Fact

The IRS handles business identity theft separately from individual identity theft and requires reporting steps.

What to Do if Your Business EIN is Compromised

If a business suspects that its EIN has been used without authorization, it should act promptly. The IRS and federal agencies provide clear steps for documenting the issue and restoring accurate records. Delaying action can lead to additional filings being submitted under the same EIN.

Federal Identity Theft Recovery Guidance

The federal government directs businesses affected by identity theft to document the incident and follow official recovery steps through IdentityTheft.gov. This resource explains how to keep records of unauthorized activity, save IRS notices, and coordinate recovery efforts alongside IRS reporting requirements.

Contact the IRS Business Assistance Line

Businesses should contact the IRS Business & Specialty Tax line as soon as suspicious activity is identified. This allows the IRS to flag the account and provide guidance based on the specific type of unauthorized EIN use involved.

_{IRS Telephone and Local Assistance page showing official contact details for businesses reporting unauthorized EIN.}

Follow IRS Business Identity Theft Instructions

In many cases, the IRS requires written documentation to confirm that the business is the legitimate EIN holder. Businesses may be asked to complete an EIN holder. Businesses may be asked to complete the Business Identity Theft Affidavit (Form 14039-B) and provide supporting details so the IRS can correct affected records.

Continue Filing Required Returns

Even while identity theft concerns are being reviewed, businesses are still required to file tax returns on time. Continuing normal filing helps prevent penalties unrelated to the identity theft issue.

How Businesses Can Reduce Tax ID Theft Risk

While EIN theft cannot always be prevented, businesses can reduce exposure by understanding how unauthorized access typically occurs and by following IRS-recommended safeguards. These measures reflect how the IRS detects and reviews unauthorized EIN activity during compliance checks, including guidance outlined in IRS Publication 5293.

Identity Common EIN Exposure Points

Unauthorized EIN activity often begins through routine business operations rather than deliberate attacks. Common exposure points include deliberate attacks. Common exposure points include third-party payroll providers, former employees who retained records, unsecured email attachments, and shared digital files. Recognizing these risks helps businesses reduce unnecessary access.

Limit EIN Sharing and Third-party Access

The IRS recommends limiting access to sensitive taxpayer information to individuals who need it to perform their duties. Businesses should periodically review which vendors, service providers, or advisors still have access to EIN-related records.

Monitor IRS Notices and Filings Closely

Unexpected IRS letters or unfamiliar filing activity are often early warning signs of unauthorized EIN use. Reviewing correspondence promptly allows businesses to address concerns before delays or penalties occur.

Secure Business Records

Restricting access to tax documents, securing digital files, and maintaining internal controls can reduce the likelihood of accidental disclosure or unauthorized use of EIN information.

Final Words

Tax ID theft can disrupt normal business operations and slow IRS processing. By following IRS instructions, using federal recovery resources, limiting EIN exposure, and responding quickly to warning signs, businesses can reduce risk and resolve identity theft issues more efficiently.