IRS Notice CP 1A
What IRS Notice CP 1A means
IRS Notice CP 1A is a notice tied to the account issue described in CP 1A. That sounds dry, but the practical point is simple: the IRS has a question, a proposed change, a balance, a refund issue, or a missing piece in its file. The notice number matters because the IRS uses that number to describe the type of problem it believes exists.
A taxpayer should not treat IRS Notice CP 1A like generic junk mail. The IRS says most notices deal with a specific issue and usually explain what action, if any, the taxpayer should take. The problem is that IRS letters are written for the IRS first and the reader second. They can be technically correct and still hard to follow. One paragraph might refer to a tax year. Another might mention a refund, balance, credit, penalty, or deadline. The job is to slow down and read the notice like evidence, not like a threat.
Identity and taxpayer-number notices need a careful read because a small mismatch can hold up a return. IRS Notice CP 1A might involve a name, Social Security number, employer identification number, address, or account verification issue. Sometimes the fix is simple. Sometimes the mismatch points to a deeper problem, especially when a refund is frozen or the IRS cannot match the return to its records.
Why you received IRS Notice CP 1A
You received IRS Notice CP 1A because the IRS believes something connected to the account issue described in CP 1A needs attention. The trigger could be a tax return entry, a payment posting, a missing form, a third-party income document, a refund adjustment, a credit review, a penalty, or an account mismatch. Sometimes the IRS changed the return during processing. Sometimes it compared the return to W-2s, 1099s, K-1s, brokerage records, payroll filings, or other data sent by someone else.
Do not assume the IRS is right. Do not assume it is wrong either. That is the boring answer, but it is the answer that saves people money. The notice has to be checked against the filed return, the taxpayer’s records, and the IRS transcript for the year involved.
A common example: a taxpayer moved, changed banks, made an estimated payment under the wrong Social Security number, or received a late Form 1099 after the return was filed. The IRS computer sees a mismatch and sends a notice. Another common version is even more ordinary. The taxpayer entered a number on the wrong line, forgot a schedule, or claimed a credit without attaching the support the IRS wanted to see.
Why IRS Notice CP 1A matters
IRS Notice CP 1A matters because the notice can affect money and future IRS contact. A small refund adjustment can turn into a bigger problem if the taxpayer ignores the explanation. A balance notice can pick up penalties and interest. A proposed adjustment can become harder to dispute if the taxpayer misses the response date. A collection notice can move the account closer to levy activity.
The most dangerous IRS notice is not always the one with the biggest number. It is the one the taxpayer misunderstands. Someone might pay a balance that should have been disputed. Someone else might ignore a correct notice because the IRS wording annoyed them. Neither approach is smart. The better move is to identify what the IRS changed, what records support or contradict the change, and what response path the notice allows.
For IRS Notice CP 1A, the taxpayer should look for the notice date, response deadline, tax year, form number, amount due or refund change, and contact instructions. If the notice includes a payment voucher, that does not automatically mean payment is the only option. If the notice says no response is needed, the taxpayer should still keep it with the return records. IRS notices have a way of becoming relevant months later.
Start with the account record
For IRS Notice CP 1A, the account transcript is often the best place to start because it shows what the IRS has actually posted. The notice gives the IRS explanation. The transcript shows the account activity. The return shows what the taxpayer reported. Those three records should tell one story. When they don’t, that gap is where the work begins.
How some people handle IRS Notice CP 1A
Some people handle IRS Notice CP 1A by creating a simple file before they do anything else. They keep the full notice, the envelope if timing matters, the filed return, wage and income forms, proof of payments, refund records, and any prior IRS letters for that tax year. Then they mark the deadline on a calendar. Not exciting. Very useful.
After that, they compare the IRS version of the facts to their own records. If the notice involves income, they check each W-2, 1099, brokerage statement, K-1, retirement form, and business income record. If it involves a payment, they look for bank withdrawals, Direct Pay confirmations, EFTPS receipts, canceled checks, payroll tax deposits, or estimated tax vouchers. If it involves a credit or dependent, they gather the records that prove eligibility rather than sending a vague explanation.
Some taxpayers agree with IRS Notice CP 1A after doing that review. Some partly agree and partly dispute it. Others respond because the IRS used incomplete information or posted something incorrectly. The right response depends on the notice language, the account transcript, the tax year, and the proof available. A short, clear response with the right documents is usually better than a long letter that explains everything except the actual issue.
Original documents should usually stay with the taxpayer unless the IRS specifically asks for them. Copies, labeled pages, and a mailing record are safer. If the notice allows faxing or online upload, the taxpayer should still save proof of what was sent and when.
How The Reed Corporation can help
The Reed Corporation can review IRS Notice CP 1A and translate it into plain English: what the IRS says, what year is involved, what deadline matters, and what records should be checked before anyone responds. A lot of notice work starts with that step. The letter feels less scary once the issue is named.
We can compare the notice to the filed return, review transcripts, check payment history, look for missing income forms, review credit eligibility, and organize a response package when the facts support one. For balance notices, we can help look at payment options and account status. For refund notices, we can help trace what changed. For examination or proposed adjustment notices, we can help pull the records into a cleaner response.
The point is not to argue with every IRS notice. The point is to avoid guessing. If IRS Notice CP 1A is correct, the taxpayer needs a practical plan. If it is wrong, the response should be specific enough for the IRS to fix the account. If it is partly right, the taxpayer may need to separate the agreed items from the disputed ones.
Get help with your IRS notice
IRS audit, refund and notice assistance Get help now with your IRS notice
Related Services from The Reed Corporation
Helpful Guides You Might Also Like
Sources & References
Frequently Asked Questions
What is IRS Notice CP 1A, and what is the IP PIN it gives me?
CP 1A is the letter the IRS mails you to hand over your Identity Protection PIN, the six-digit number you put on your federal return so the IRS knows the filing actually came from you. People also see it written as CP 01A — same notice, two ways of styling it. The number it carries does one job: it ties your Social Security number or ITIN to a code only you and the IRS know, which stops a thief from e-filing a return under your name to grab your refund. If you have been wondering why a plain IRS envelope showed up around December or January with a fresh six-digit code inside, that is the IP PIN, and CP 1A is how it travels. The Identity Protection PIN is the whole reason the letter exists.
Here is the part people get wrong. The IP PIN is not your e-file PIN, your Identity Protection number is not a password to an account, and it is not the same five-digit Self-Select PIN you may have typed in past years to “sign” an e-filed return. The Identity Protection PIN is exactly six digits. The Self-Select e-file PIN is five. Mixing them up is the single most common reason a return that should sail through gets bounced back, because the software validates the IP PIN against IRS records before the return is even accepted. You enter the current-year IP PIN from your latest CP 1A on Form 1040, and the same number works on Form 1040-SR for seniors, Form 1040-NR for nonresident filers, and Form 1040-SS. The IRS lays out which forms take the number on its Understanding Your CP01A Notice page, and the broader program rules live on Get an Identity Protection PIN.
Why does the IRS bother with a separate number at all? Because a Social Security number is not a secret. It is on old W-2s, in data breaches, on forms sitting in filing cabinets at a dozen companies you have done business with. A criminal who has your SSN and date of birth can file a fake return in late January, claim a refund, and be gone before you have your real W-2 in hand. The IP PIN closes that door. Without the correct CP 1A code, the fraudulent e-filed return is rejected. The IRS explains the whole identity-theft picture on its Identity Theft Central hub, and there is a deep set of answers on the IP PIN FAQ page if you want the IRS’s own version.
A real scenario from how this plays out in our office. A freelance graphic designer in Brooklyn got a CP 1A in early January with an Identity Protection PIN, set it on the kitchen counter, and forgot about it. In March she handed us a W-2, a stack of 1099-NECs, and her last year’s return — but not the CP 1A. We flagged it, she dug the letter back out of a drawer, and we entered the six-digit IP PIN before transmitting. The return was accepted in minutes. Had we e-filed without it, the IRS would have rejected the whole thing and she would have lost a week chasing the number down during the busiest stretch of filing season. That is the practical value of CP 1A: it is not paperwork to ignore, it is the key that lets your return in the door.
One more thing the notice itself spells out. The IP PIN on a given CP 1A is good for one tax year. The IRS generates a new one each year and mails a new CP 1A, so the number you used last April is already dead. You do not reuse it. You also do not need the IP PIN for everything — it is required to e-file the main individual returns named above, but the IRS does not make you enter it on a Form 4868 extension, a Form 1040-X amended return, or a Form 433-D installment agreement. That narrow scope trips people up too, because they assume the number is a universal “prove it is me” code for any IRS interaction. It is not. It is a return-filing safeguard, and a tightly defined one. Keep that distinction straight and the CP 1A stops feeling mysterious.
It helps to know where CP 1A sits among the IRS’s identity letters, because they get confused all the time. CP 1A is the one that carries the working IP PIN — the number you actually type on the return. Its sibling, the CP 1 notice, is different: that one tells you the IRS placed an identity-theft indicator on your account, which is the IRS flagging a problem rather than handing you a six-digit code to use. We spell out the contrast in our guide to the CP 1 identity-theft indicator, and the full set of IRS letters lives in our IRS notices guide. The short version: CP 1A gives you a tool to use, CP 1 tells you the IRS turned a protection on. Mixing them up leads people to hunt for an IP PIN on a CP 1 that does not contain one, or to ignore a CP 1A that does. Read the notice title at the top before you assume which one you are holding, and check whether a six-digit Identity Protection PIN is printed on it — that is the tell.
If you are a client of ours, the move is simple: when a CP 1A arrives, scan it or photograph it and send it over with the rest of your documents, then file the paper with your tax records. We treat the IP PIN the same way we treat a W-2 — a required input we will not transmit a return without. If you would rather hand the whole thing off, our IRS notice assistance team handles CP 1A and the identity-protection enrollment that produced it, and our individual tax return preparation service builds the IP PIN into the filing so nothing gets rejected on a missing six-digit code. The goal is that your CP 1A never becomes a problem — it just quietly does its job while your real return goes through and the fake one bounces.
Why did I receive IRS Notice CP 1A — who gets an Identity Protection PIN?
You got CP 1A because the IRS issued you an Identity Protection PIN, and there are really only three roads that lead there. You reported that you were a victim of tax-related identity theft. The IRS flagged your account as a victim on its own, based on suspicious filing activity tied to your SSN. Or you opted into the IP PIN program voluntarily and asked for the protection yourself. Whichever road you took, the result is the same letter — a CP 1A (sometimes printed as CP 01A) carrying a six-digit number for the coming filing season. The IRS describes who falls into each bucket on its Understanding Your CP01A Notice page.
The original purpose of the IP PIN was narrow: protect people who had already been burned. If a thief filed a return under your SSN one year, the IRS would enroll you so it could not happen again, and you would start getting a CP 1A every December or January with a new Identity Protection PIN. That is still a major source of these notices. But the program has changed in a way a lot of taxpayers have not caught up to — it is now open to everyone. Any taxpayer who wants the extra safeguard can opt into the IP PIN program through the online “Get an IP PIN” tool, get verified, and start receiving the protection. The IRS walks through enrollment on Get an Identity Protection PIN, and the bigger context for why identity theft drives all of this is on Identity Theft Central.
So if you opted in last year and a CP 1A landed this winter, nothing is wrong. That is the system working exactly as designed. The IP PIN is not a punishment and it is not a sign the IRS suspects you of anything. It is a shield. The surprising part for most people is that the smartest move here is to invite the notice on purpose — voluntarily enrolling before anything bad happens is one of the few genuinely free, genuinely effective fraud defenses the IRS offers individuals. Most people only think about the IP PIN after a fake return has already cost them a refund and six months of cleanup. Getting the CP 1A before the theft beats getting it after.
How do you actually get into the program if you cannot verify online? The fastest path is the online identity verification tied to your IRS online account — that is what most people use, and the Identity Protection PIN posts to the account, with the CP 1A following by mail. If you cannot complete the online identity check, the IRS offers a fallback: Form 15227, the application for an IP PIN, which is available to taxpayers below an income limit. You can read about that route on the IRS page About Form 15227 — and I would point you there for the exact income figure rather than quoting a number that shifts. If neither the online tool nor Form 15227 fits your situation, you can verify your identity in person at a Taxpayer Assistance Center, and the IRS issues the IP PIN that way too. The full set of paths is on Get an Identity Protection PIN.
A concrete example of the “flagged by the IRS” road. A retired teacher in Queens filed her return in February and it was rejected — someone had already filed under her SSN in late January. She went through the identity-theft reporting process, the IRS confirmed the fraud, and the next December a CP 1A showed up with her first Identity Protection PIN. From that point on, every return she files needs the current six-digit IP PIN, and the IRS mails a fresh CP 1A each year. She did not choose the program. The fraud chose it for her. That is the difference between the voluntary opt-in and the victim path, and it is worth knowing which one you are on, because it tells you whether the protection is something you signed up for or something the IRS assigned after confirming theft.
One detail that surprises people: once the IRS assigns the IP PIN because it confirmed identity theft on your account, you generally cannot just turn the protection off and go back to filing without it. The victim path is sticky by design — the whole point is to keep the door locked after someone already picked it. The voluntary opt-in works a little differently, but the practical reality for almost everyone is the same: once you are in the IP PIN program, plan on a CP 1A arriving every December or January and plan on entering the current six-digit number on every return going forward. That is not a burden so much as a routine. If you have a sibling notice in hand and are not sure whether it is the CP 1A with a usable IP PIN or the CP 1 indicator letter, our walkthrough of the CP 1 identity-theft indicator sorts the two apart, and the broader IRS notices guide maps where each letter fits. The reason this matters is timing: if you treat the IP PIN as optional and skip it, the return that needed it bounces, and you are now solving the problem during filing season instead of before it.
The thing to take away is that a CP 1A is account-specific and identity-specific. It is not a mass mailing and it is not tied to a balance you owe — there is no money question buried in it, no levy, no collection action. It is purely about confirming that the person filing under your number is you. If you are not sure which road got you here, or you want help enrolling the rest of your household in the IP PIN program, our IRS notice assistance team sorts out the enrollment and explains what the IP PIN obligates you to do going forward. And if the CP 1A arrived because of a return that bounced, that is often the first sign of a deeper identity-theft problem, which our individual tax return team is set up to untangle alongside the actual filing. The notice is the start of the protection, not the end of a problem.
How do I use the IP PIN from CP 1A when I file, including with a tax preparer?
Using the IP PIN from your CP 1A is mechanically simple: you take the six-digit number off the current-year notice and enter it on your return before you file. On Form 1040 there is a dedicated spot for the Identity Protection PIN near the signature area, and the same goes for Form 1040-SR, Form 1040-NR, and Form 1040-SS. If you e-file, the software has a field for it. If you paper-file, you write it in the box. That is the whole action — but the details around it are where returns get rejected, so it is worth being precise. The IRS lays out the mechanics on Understanding Your CP01A Notice and answers the edge cases on its IP PIN FAQ.
Rule one: use the current year’s IP PIN, not last year’s. The number rotates every filing season, so the CP 1A you got this past December carries the only code that will work on the return you are filing now. Enter an expired IP PIN and an e-filed return gets rejected outright. Rule two: the IP PIN is six digits — if your software is asking for a five-digit number, it is asking for the Self-Select e-file PIN, which is a different thing entirely, and you should not put your Identity Protection PIN there. Getting those two fields crossed is the classic mistake, and it produces a rejection that looks mysterious until you realize the wrong number went in the wrong box.
Filing with a tax preparer does not change who controls the IP PIN — it stays yours. You give the six-digit number from your CP 1A to your preparer, your preparer enters it in the return just like any other required field, and the return transmits. The IRS is explicit that you should share the IP PIN only with a trusted tax professional and no one else. At our firm we treat the CP 1A like a W-2: a required document we collect up front, and a return we will not transmit without. The reason is purely practical — if we e-file an individual return that needs an IP PIN and the field is blank or wrong, the IRS bounces it, and now you are fixing a rejection during the part of the season when everything takes longer. You can read how we handle these on our individual tax return preparation page.
Here is a worked example. A married couple in Manhattan files jointly. The wife had an identity-theft incident two years ago, so she gets a CP 1A every year with her own Identity Protection PIN; the husband never enrolled, so he has none. On a joint return, each spouse who has an IP PIN enters their own — so her six-digit number goes in her field, and the husband’s IP PIN field stays empty because he does not have one. People assume one IP PIN covers the whole return. It does not. The number is attached to the individual, not the return, and on a joint filing the software has a separate slot for each spouse. Put her number in his slot, or assume one number covers both, and the return gets rejected. Their preparer simply collects her CP 1A each year, confirms the number is current, and enters it correctly.
What about the situations where you do not need the IP PIN at all? The Identity Protection PIN is required to e-file the individual returns named above, but the IRS does not require it on a Form 4868 extension, on a Form 1040-X amended return, or on a Form 433-D installment agreement. So if you are filing an extension in April and you cannot find your CP 1A, the extension still goes through — the IP PIN requirement attaches to the actual return, not the extension request. That said, you will need the current IP PIN when you eventually file the real 1040, so finding the CP 1A is still on your list, just not an emergency that blocks the extension. The broader program rules are on Get an Identity Protection PIN.
A second layer trips people up: dependents can have IP PINs too. If your child or another dependent was issued a CP 1A — which happens when a minor’s SSN gets caught up in identity theft, a depressingly common thing — that dependent’s six-digit IP PIN goes on the return that claims them, in the spot the software provides for the dependent’s number. So a single return can need more than one IP PIN: yours, your spouse’s, and a dependent’s, each in its own field. Leave a dependent’s IP PIN out and the e-filed return can be rejected over a number you did not even realize you were missing. The fix is the same discipline we use for every client: gather every CP 1A in the household before we touch the return, confirm each number is the current-year code, and enter each in the correct field. If your situation has several IP PINs in play, or a dependent’s CP 1A you are unsure how to handle, start a new client inquiry and we will make sure each one lands where it belongs before the return is transmitted. Getting all the numbers in on the first pass beats chasing a rejection later.
For paper filers, one caution: a return that should carry an IP PIN but does not will not get rejected the way an e-file does — it gets delayed instead, because the IRS routes it through extra identity verification before processing. So leaving the IP PIN off a paper 1040 does not save you; it just trades a fast rejection for a slow review. Enter the number from your current CP 1A and the paper return processes normally. If you are unsure where the field is, or you are filing a less common form like 1040-NR, our IRS notice assistance team can confirm exactly where the IP PIN goes and make sure the CP 1A number is entered correctly before anything is transmitted. The whole point of the IP PIN is to make your real return go through and the fraudulent one bounce — used right, it does exactly that, and you never think about it again until next year’s CP 1A shows up.
I lost my CP 1A or IP PIN — how do I retrieve or replace it?
Losing the CP 1A is common and fixable. The fastest way to get your Identity Protection PIN back is to log into your IRS online account and retrieve it there — the same number on your CP 1A is available in your account, so a misplaced paper notice does not lock you out. The IRS built a dedicated page for exactly this situation: Retrieve Your IP PIN. If you can verify your identity online, you can usually pull the current IP PIN in a few minutes and keep filing on schedule. That is the first thing to try before you do anything else, because it is the quickest and it does not require waiting on the mail.
If you cannot get into your online account — you never set one up, or you cannot complete the identity verification — there is a second path: have the CP 1A reissued. The IRS can mail you a replacement notice with your Identity Protection PIN. A reissued IP PIN comes by mail to your address of record, so this route takes longer than the online retrieval, which matters if you are up against a filing deadline. The IRS describes the retrieval and reissue options on the Retrieve Your IP PIN page and in its IP PIN FAQ. The key point: a lost CP 1A does not mean you are stuck filing late. It means you take one of two recovery routes, and the online one is almost always faster.
A practical example of why the online account matters. A real-estate agent in the Bronx tossed what he thought was junk mail in January — it was his CP 1A. In late March, mid-deal and trying to get his return filed, he realized he needed the IP PIN. Because he had set up an IRS online account the year before, he logged in, retrieved the current six-digit number under the IP PIN section, gave it to us, and we filed that afternoon. Had he relied on a reissued CP 1A by mail, he would have lost a week or more waiting for the letter. The lesson we give every client who is in the program: set up the IRS online account now, while it is calm, so that when you lose the CP 1A — and many people do — you can self-serve the IP PIN instead of waiting on a reissue. You can read how the online account ties into identity protection on Get an Identity Protection PIN and the broader hub at Identity Theft Central.
What you should not do is improvise. Do not file with last year’s IP PIN because you found that older CP 1A in a drawer — an expired number gets the e-filed return rejected just as surely as no number at all. Do not leave the IP PIN field blank and hope the return slides through; an individual e-file that needs the number and lacks it will bounce, and a paper return without it gets delayed in identity review. And do not call a number from an email or text claiming it can “recover” your IP PIN — that is a scam vector, and the only legitimate recovery routes are your IRS online account and an IRS-reissued CP 1A. The IRS will never call, email, or text you asking for the IP PIN, and it will not ask you to confirm it through a link.
There is also a timing wrinkle worth knowing. If you opted into the program and then lose the number early, before the IRS has generated and mailed the next CP 1A, the retrieval tool may not yet show a current-year code — the new IP PIN gets created on the IRS’s annual schedule, usually around December into January. So if you are looking in, say, November and do not see a number for the upcoming year, that is not a malfunction; the next IP PIN simply has not been issued yet. Once the new CP 1A goes out, the current code appears in your account. If you are mid-season and the number should exist, and the online tool still will not produce it, that is the moment to get help rather than guess.
There is a difference between how you originally got into the program and how you recover a lost number, and it is worth keeping straight. If you first enrolled through Form 15227 because you could not verify online, that does not mean you are stuck using Form 15227 every time you misplace the letter. Recovery runs through the retrieval and reissue channels — your IRS online account first, an IRS-reissued CP 1A second — not through a fresh application. And if neither of those works, in-person verification at a Taxpayer Assistance Center is the backstop the IRS keeps for people who cannot get the number any other way; the IRS can confirm your identity there and get you the IP PIN. The overview of all of this, including how Form 15227 fits the enrollment side, is on the IRS page About Form 15227, and our broader IRS notices guide shows where CP 1A sits in the lineup. The reason we draw the line between enrollment and recovery is that people waste days filling out the wrong form — reapplying when they only needed to retrieve a number that already exists in their account.
If any of this stalls — the online verification fails, the reissue is too slow for your deadline, or you are not sure whether the number you are holding is current — bring it to us. Our IRS notice assistance team helps clients retrieve or replace a lost CP 1A and confirms the IP PIN is the current-year code before we file, and our individual tax return service builds the recovered IP PIN into your filing so the return is accepted on the first try. A misplaced notice is an annoyance, not a crisis — handled right, you recover the IP PIN, file on time, and the protection keeps doing its job.
Do I need a new IP PIN every year, and what happens if I file CP 1A returns without it (plus scam safety)?
Yes — you need a new IP PIN every year, and that is the most important thing to understand about CP 1A. The IRS generates a fresh Identity Protection PIN for the coming filing season and mails a new CP 1A, usually around December or January. Last year’s number is dead. You do not carry it forward, you do not reuse it, and the only number that works on the return you are filing now is the six-digit code on your most recent CP 1A. The IRS states this plainly on Understanding Your CP01A Notice and reinforces it across the IP PIN FAQ. Treat each CP 1A as a one-season key.
So what actually happens if you file without it? It depends on how you file. An e-filed individual return that requires an IP PIN and does not have the correct current-year number gets rejected by the IRS — the return does not process, and you have to fix it and resubmit. A paper return that should carry the IP PIN but does not is not rejected; instead it gets delayed, because the IRS pushes it through additional identity verification before it will process the filing. Either way, leaving the IP PIN off does not get you a faster refund — it gets you a bounce or a slowdown. The broader rules sit on Get an Identity Protection PIN.
Remember that the IP PIN requirement attaches to the actual return, not to every IRS form. You do not need the number on a Form 4868 extension, a Form 1040-X amended return, or a Form 433-D installment agreement. So missing your CP 1A in April does not block an extension. But it will block the real 1040 when you go to file it, so finding or retrieving the current IP PIN stays on your list — the extension just buys you time, it does not erase the requirement. People sometimes read “I filed my extension without the number, so I am fine” as meaning the IP PIN no longer matters. It still matters for the return itself.
Now the scam safety, because this is where real money gets lost. The IRS will never call, email, or text you asking for your IP PIN. It will not ask you to confirm the number through a link, it will not threaten you over the phone to extract it, and it will not email a “verify your IP PIN” form. Criminals know the IP PIN is the one number that lets them file under your name, so it is a prime target. The only people who should ever have your IP PIN are you and your trusted tax preparer. If anyone else asks for it — by phone, text, email, or a pop-up — that is fraud. Hang up, delete it, do not click. The IRS lays out how it does and does not contact taxpayers on Identity Theft Central, and you can report suspected scams through the resources there.
A scenario we see around tax season. A small-business owner in Manhattan got a slick email “from the IRS” saying his refund was on hold and he needed to confirm his Identity Protection PIN through a portal to release it. The email had a logo, a case number, the works. He almost entered the six-digit number from his CP 1A. He called us first. We told him what we tell everyone: the IRS does not ask for the IP PIN by email, and entering it on that portal would have handed a thief the exact code needed to file a fraudulent return under his SSN. He forwarded the email to the IRS phishing address and deleted it. His real return went through that week with the IP PIN entered the only safe way — by us, directly into the return software. That is the counterintuitive bit worth sitting with: the IP PIN protects you from fraud, but the IP PIN itself becomes the thing fraudsters hunt for. Guarding the number is part of the protection.
How do you tell a real CP 1A from a fake one in the mailbox, since scammers mimic IRS letters too? A genuine CP 1A comes by mail, carries the notice number at the top, and prints your six-digit IP PIN for you to use — it asks for nothing back. It does not contain a link to “activate” the number, a QR code to scan, a phone number demanding you read the IP PIN aloud, or a threat about your refund being frozen until you respond. The legitimate notice gives; the scam takes. If a letter or message about your IP PIN is asking you to send the number somewhere, call to confirm it, or click to verify it, that is the fraud tell — the IRS already has your IP PIN, so it would never ask you for it. When you are unsure, do not act on the message; instead retrieve your real number through your IRS online account and compare. Our IRS notices guide shows what the authentic letters look like, and the retrieval steps are on the IRS page for Retrieve Your IP PIN. The habit that keeps you safe is boring on purpose: trust the mailed CP 1A, distrust anyone who contacts you asking for the IP PIN.
Keep the CP 1A with your tax records each year, the same way you keep your W-2s and 1099s, and shred nothing until you have entered the current IP PIN and confirmed the return was accepted. When the new CP 1A arrives in December or January, send it to us with the rest of your documents so we can file with the right number on the first try. If a notice goes missing, retrieve the IP PIN through your IRS online account or have the CP 1A reissued rather than guessing. And if anything about a “CP 1A” or “IP PIN” request smells off, route it past us before you act — our IRS notice assistance team checks whether a notice or message is legitimate, and our individual tax return preparation service files your return with the current IP PIN built in. The number changes every year, the scams keep coming, and the safe habit is the same each season: get the new CP 1A, protect the IP PIN, file with it, confirm it went through.