If a scammer files a tax return under your Social Security number this year, expect to wait about 20 months to see your real refund. Half a million people are already stuck in that queue. The fix is on your end, and it takes 10 minutes on IRS.gov.
National Taxpayer Advocate Erin M. Collins delivered her mid-year report to Congress on June 24. Her word for how long the IRS takes to resolve identity theft cases: “unconscionable.” Not a first-time complaint. She has flagged the same delay in three straight annual reports. It keeps getting worse.
What’s actually happening
At the end of the 2026 filing season, more than 500,000 identity theft victim assistance cases were open at the IRS. The average case takes about 20 months to work through. The report ties the delay to a staffing collapse: the IRS went from roughly 102,000 employees at the start of the 2025 filing season to about 74,000 at the start of the 2026 season. A 27% cut.
Identity theft cases don’t get resolved by an algorithm. They need a human to compare returns, confirm the real filer, undo the fake refund, and release yours. Fewer humans, longer queue.
Here’s what they don’t tell you. This year the IRS issued about 90 million refunds averaging $3,275 each. That is real money. If your $3,000 refund is the deposit on a car, a chunk of a tax bill, or your kid’s braces, “we’ll get to it in 2028” is not a shrug. It’s a hit.
Why the fix is you, not them
Once your identity gets stolen, the recovery is slow because it’s manual. The prevention is fast and free.
The IRS runs an Identity Protection PIN program. Once you enroll, you get a six-digit code every year. That code has to appear on any federal return filed under your Social Security number. Electronic or paper, current year or prior year. Without it, the return gets rejected.
A scammer who has your name, address, birth date, and SSN, but not your IP PIN, cannot file a return in your name. The fraudulent return bounces at the IRS door. Your real return still works because you know your code.
Two things to know. The code is unique to you and rotates every year. And the IRS will never call or email you asking for it. If someone does, they’re the scammer.
Do this now
Go to IRS.gov and search “Get an IP PIN.” The fastest way is the online account route. Log in, verify identity through ID.me if you haven’t already, then go to the Profile tab and click into the IP PIN program. Choose continuous enrollment so it renews on its own each year. Ten minutes.
Can’t do the online account? Two backup paths. If your last-filed AGI is under $84,000 single or $168,000 married filing jointly, submit Form 15227 through the IRS site. Your PIN arrives by mail in four to six weeks. If Form 15227 doesn’t work for you, book an in-person appointment at a Taxpayer Assistance Center. Bring a government photo ID and a second form of identification.
The opt-in program is only open from mid-January through mid-November each year. Miss the window and you can’t enroll until next spring. That means the 2027 filing season already has a deadline attached: enroll by mid-November 2026 to have your 2026 PIN in hand.
Verdict on the IRS side: this is dumb. Twenty months to fix a stolen refund is not policy. It is triage. Your move: block the theft in the first place. It costs you a coffee’s worth of time and it works.
How Candid Yak makes money. Some of the products we write about pay us if you apply or sign up through our links. That never changes our verdict, our rankings, or the numbers in this article. We call a bad deal a bad deal whether it pays us or not. Some brands shown in our comparison tools are placeholder examples while we finalize partner agreements, and we label them as such.