IRS Refund Notice CP53E: What It Means and What to Do
What the CP53E Notice Actually Says
CP53E is one of a family of notices the IRS sends when a direct deposit refund cannot be delivered. According to the IRS page for this notice, you can receive it in two situations. Either your return claimed a refund and the bank information was invalid, missing, or rejected, or you filed showing a balance due and the IRS corrected the return in your favor, because you forgot to report estimated payments you actually made, or because of a math error in addition or subtraction, so a return that owed money now generates a refund with no deposit instructions attached.
What makes CP53E different from the older notices in the series is that it asks you to do something rather than just telling you a check is coming. It exists because of Executive Order 14247, “Modernizing Payments To and From America’s Bank Account,” signed March 25, 2025, which directs Treasury to move federal disbursements off paper. Treasury began phasing out paper refund checks on September 30, 2025. So instead of automatically printing a check when a deposit fails, the IRS now gives you a chance to fix the account.
You have 30 days from the date on the notice to add or update a bank account through your IRS online account, or to select one of the limited exception conditions that allows a paper check. If you do nothing, the IRS issues a paper check after six weeks. That is the default, not a penalty, but it is six weeks of waiting that a five-minute update would have avoided.
One detail worth pausing on, because it is the opposite of what most people expect: you get exactly one attempt. The IRS says you may add or update your bank account only once through the online account. If the corrected deposit is rejected by the bank a second time, a paper check is issued and you do not get another try.
Why a Direct Deposit Fails in the First Place
Banks reject incoming government deposits for a short list of reasons, and almost all of them are clerical.
The most common is a mismatch between the name on the return and the name on the account. Newly married filers who changed their name with the bank but not with the Social Security Administration, or the reverse, trip this constantly, the IRS validates the return against Social Security Administration records, and its name-change FAQ says plainly that the name on the return must match the name on the Social Security card. Transposed routing or account numbers are next. So are closed accounts, accounts that have been converted after a bank merger, and accounts frozen for unrelated reasons.
Then there are the structural rejections. The IRS will not deposit a refund into an account that does not belong to you. The notice guidance is explicit that you must use an account in your own name or a joint account you share, and not a family member’s, a friend’s, or a preparer’s. It also limits how many refunds can go to a single account or prepaid debit card in a year, which is the trigger behind the related CP53D notice. And the agency can only direct deposit refunds for the current filing year and the two prior tax years; anything older is paid another way, which is what the original CP53 notice describes.
A refund can also be reduced or held for reasons that have nothing to do with the bank. Past-due federal tax, state income tax, child support, or certain federal debts get taken through the Treasury Offset Program under IRC section 6402. That produces a different notice and a different explanation, covered on the IRS reduced refund page. A CP53E is not an offset notice and does not mean anything is wrong with your return.
How CP53E Differs From CP53, CP53A, CP53B, CP53C, and CP53D
Five notices, similar numbers, different meanings. Reading the suffix is the whole trick.
| Notice | What it means | What you do |
|---|---|---|
| CP53 | The IRS could not direct deposit and is mailing a check. | Nothing. Expect the check about four weeks from the notice date. |
| CP53A | The bank could not process the deposit; the IRS is researching the account. | Wait. Call only if nothing arrives within 10 weeks. |
| CP53B | Same research posture, with identity-theft monitoring guidance attached. | Nothing now. Monitor accounts; consider Form 14039 if you did not file. |
| CP53C | Deposit returned by the financial institution; account under review. | Nothing. Call if no check or letter within 10 weeks. |
| CP53D | Deposit request declined, usually the refund-per-account limit. | Nothing. Check normally arrives within four weeks. |
| CP53E | Refund cannot be deposited; you may supply a new account. | Act within 30 days in your online account, or a check issues after six weeks. |
The practical difference: CP53, CP53A, CP53B, CP53C, and CP53D are informational. The IRS refund notice CP53E has a clock on it. If you have one of the first five, patience is the correct strategy and calling accomplishes nothing. The IRS says plainly that telephone assistors cannot speed up a refund or provide information beyond what the notice contains.
Responding to a CP53E, Step by Step
The response happens entirely inside your IRS online account. There is no form to mail, no phone option, and no way for your CPA to do it with a power of attorney.
Sign in, or create an account if you do not have one, identity verification takes ten to twenty minutes and requires a photo ID. Open Account Home and look at Notifications. When a CP53E has been issued, an “Add bank account” notification appears there; it is not present otherwise, which is itself a verification tool. Select it, follow the prompts, and enter the routing and account numbers exactly as they appear on a check or in your bank’s app. Allow roughly two to five business days for the refund status in your online account to update.
If you do not have a bank account, the IRS points to alternatives on its payment modernization page, including prepaid debit cards and mobile payment applications, and there are limited exception conditions that let you request a paper check through the same online interface. Hardship situations and certain legal or procedural circumstances are the stated grounds.
Three things not to do. Do not enter someone else’s account, including a relative’s or your tax preparer’s. The IRS will not validate it and will issue a paper check instead. Do not call the toll-free number expecting to give the numbers verbally; IRS employees cannot update bank information at all. And do not assume a second attempt is available if the first correction bounces, because it is not.
The Fake CP53E Wave, and How to Tell
A notice that (a) mentions money owed to you, (b) contains a QR code and a web link, and (c) asks you to enter bank account details is, structurally, the perfect phishing template. Criminals noticed. Emails and texts impersonating refund notices circulate every filing season, and the CP53E format gave them a genuine notice to copy.
The IRS itself added an FAQ to the CP53E page explaining how to check that a link or QR code is safe, look for the lock icon or https at the start of the URL, and confirm .gov is in the domain. That the agency felt the need to write that tells you how much impersonation is happening.
Four rules settle almost every case. First, the IRS does not initiate contact by email, text message, or social media to request personal or financial information; its guidance on recognizing tax scams is unambiguous about that. A CP53E arrives by mail. Second, never click a link in a message claiming to be a refund notice. Type irs.gov into the address bar yourself and sign in to your online account, if a genuine CP53E exists, the “Add bank account” notification is waiting there, and if it is not there, the message was fake. Third, the IRS never asks for gift cards, wire transfers, or cryptocurrency, and never threatens immediate arrest. Fourth, a real notice has a notice number in the upper right corner, your truncated identification number, and a tax year, and it never demands payment of a fee to release a refund.
Report the fakes rather than deleting them. Forward suspicious emails to phishing@irs.gov and see the IRS report phishing page for text messages and other channels. Impersonation of IRS employees also goes to the Treasury Inspector General for Tax Administration. If you gave up bank details to a fake notice, call your bank first, then review the IRS identity theft resources. This page is general information and not tax or legal advice for your situation; a licensed CPA should review any IRS notice against your actual account transcript before you act on it.
Related Services from The Reed Corporation
Helpful Guides You Might Also Like
Sources & References
Frequently Asked Questions
What is IRS refund notice CP53E, and why did I receive one?
IRS refund notice CP53E is a letter telling you that the agency has a refund for you and cannot deliver it to the bank account on file, and inviting you to supply a working account before it defaults to mailing a paper check. It is a delivery problem, not an audit, not a math dispute, and not an accusation. Nothing about a CP53E suggests your return was wrong, in fact, one of the two ways to receive it is that the IRS corrected your return in your favor.
The IRS page for the notice lists both triggers. The first is the obvious one: your return showed a refund and the bank information was invalid, missing, or rejected. The second is less obvious and catches people completely off guard. You filed a return showing a balance due, so you never entered any deposit instructions. The IRS then adjusted the return, most often because you made estimated tax payments that were not reported on the return, or because of a math error in addition or subtraction, and the adjustment turned a balance due into a refund. Now there is money to send and no account to send it to.
That second scenario is worth dwelling on because of what it implies about the return. If the IRS credited estimated payments you did not claim, your copy of the return understated your payments, and the same error may exist on the state return, which will not correct itself. If a math error changed the outcome, the notice explaining that adjustment is a separate letter and you should read it. A CP53E by itself does not tell you why the refund exists, only that it does.
The reason this notice exists at all is Executive Order 14247, “Modernizing Payments To and From America’s Bank Account,” signed March 25, 2025. It directs Treasury, working with the IRS and other agencies, to move federal disbursements and receipts to electronic channels, on the stated grounds that paper instruments are far more likely than electronic payments to be lost, stolen, altered, or delayed. Treasury began phasing out paper tax refund checks on September 30, 2025. The IRS published a detailed questions and answers document covering individual refunds, payments to the IRS, businesses, international filers, and third parties. Under the old regime, a failed deposit produced an automatic check. Under the new one, the IRS asks you for a working account first.
Here is what it looks like in practice. A Brooklyn couple files a joint return for 2025 claiming a $6,840 refund with direct deposit to a joint checking account. One spouse changed her surname after their September wedding and updated it with the bank, but not with the Social Security Administration. The IRS validates the refund against SSA records, the name and identification number do not match what the bank has, and the bank returns the deposit. Six weeks after filing, with “Where’s My Refund” showing the refund as issued, a CP53E arrives in the mail. Nothing is wrong with the return. The $6,840 is theirs. The fix is either updating the account through the IRS online account within 30 days, or waiting six weeks for a check, and separately, fixing the name with SSA so this does not repeat next April.
It also helps to know what a CP53E is not. It is not a CP2000, which proposes changes because third-party information returns do not match your return. It is not a Notice of Deficiency, the statutory letter that starts a 90-day clock to petition the Tax Court. It is not a CP14 or CP501 balance-due notice. It carries no penalty, no interest charge against you, no appeal rights to preserve, and no deadline whose expiration costs you money, only speed. That is genuinely unusual for IRS correspondence, and it is why the appropriate emotional response is mild annoyance rather than alarm.
Read the notice for three specific items. The notice number in the upper right corner, which is what distinguishes CP53E from its five siblings. The notice date, because the 30-day clock runs from it rather than from the day you opened the envelope. And the tax year, because a notice about a prior-year return may be tied to a refund you had forgotten about. If the notice references a year you did not file, that is a potential identity theft indicator and belongs on the identity theft path, not the bank-update path.
The common mistake: assuming a CP53E means the refund is in jeopardy and calling the toll-free number to argue about it. The refund is not in jeopardy, and the phone line cannot help. IRS employees cannot update bank account information under any circumstances, and telephone assistors have no additional information about refund status beyond what the notice and the online account already show. The second common mistake is ignoring the notice because a check will come anyway. That is true, and it costs six weeks. The third is treating the notice as spam because it contains a QR code; genuine current IRS notices do include them, which is exactly why fakes are convincing.
The most useful thing to do after resolving a CP53E is to prevent the next one. Confirm that the name on your tax return matches your Social Security card exactly, particularly after a marriage, divorce, or immigration status change. Verify the routing and account numbers against a check or your bank’s app rather than from memory, and re-verify after any bank merger or account conversion. If you split the refund across accounts, remember that Form 8888 is required and a single bad line on it can bounce the whole deposit. And check your estimated payments against your IRS account transcript before filing, so the IRS is not the one discovering them. Our guide to how Form 1040 works covers where these entries live on the return. This page is general information, not tax advice for your situation; a licensed CPA should review any notice against your actual account transcript.
How do I add or update my bank account after a CP53E notice?
Through your IRS online account, within 30 days of the notice date, and only once. Those three constraints are the whole answer, and each of them surprises somebody.
Start at the IRS online account for individuals. If you already have credentials, sign in. If you do not, creating one requires identity verification through the government’s identity service, which means a government-issued photo ID and either a live selfie video match or a video call with a representative. Budget ten to twenty minutes and do it on a phone rather than a desktop, because the ID capture step works better with a phone camera. If you cannot complete verification online, the IRS points to its identity verification help resources for assistance.
Once you are signed in, go to Account Home and look at Notifications. When a CP53E has been issued to you, an “Add bank account” notification appears in that list. The IRS is explicit that this option is only present when a CP53E has been issued, which makes it a free authenticity test. If someone sent you a CP53E and there is no such notification in your account, the letter or message did not come from the IRS.
Select the notification and follow the prompts. You will need the nine-digit routing number and the account number, and you should read them off a physical check, a bank statement, or the account details screen in your bank’s app rather than typing from memory. Two numbers people confuse: the routing number on a deposit slip is sometimes different from the one used for ACH transfers, and a debit card number is never an account number. If you do not have a bank account, the same interface offers guidance, and the IRS points to prepaid debit cards and mobile payment applications as alternatives on its payment modernization page. There are also limited exception conditions, hardship, and certain legal or procedural situations, that let you request a paper check through the online account.
After you submit, you should see a confirmation message. If there is an error message instead, read it carefully and follow the instructions; the IRS acknowledges that systemic issues can prevent an update and advises trying again later rather than assuming the attempt succeeded. Then allow roughly two to five business days for the refund status in your online account to reflect the change.
Now the constraint that costs money. You get one opportunity. The IRS states that you may add or update your bank account only once through the online account, and that if the direct deposit is not accepted by the bank and is rejected, a paper check will be issued. There is no second correction. That means a $9,400 refund with a transposed digit becomes a six-week wait for a check, and nothing you do can accelerate it. Price that out for a household counting on the money in March to cover a $3,200 tuition installment and a $1,750 estimated tax payment due April 15: a deposit that would have landed in five business days now arrives in an envelope in the second week of May, and both obligations have to be funded some other way.
Two hard limits on whose account you may use. The account must be in your own name or a joint account you share. Not a parent’s, not an adult child’s, not a friend’s, and not your tax preparer’s. The IRS says directly that it will not validate an account belonging to someone else and will issue a paper check instead. This rule exists because refund diversion into preparer-controlled accounts has been a persistent fraud pattern, and it is enforced by the name-match validation rather than by anyone’s judgment.
And the channel is exclusive. You cannot update bank account information by calling the toll-free line. The IRS states plainly that its employees cannot update bank account information, and that you must access your online account within 30 days from the date of the CP53E to receive your refund by direct deposit. A power of attorney on Form 2848 lets a CPA speak to the IRS about your account and pull your transcripts; it does not let anyone else log into your online account or change your deposit instructions. Your accountant can walk you through this on a screen share. Your accountant cannot do it for you.
Joint returns add a wrinkle. The refund belongs to both spouses, but the online account is individual: each spouse has their own credentials, and the notification appears in the account of the taxpayer the notice was issued to, which is normally the primary filer listed first on the return. If the primary filer is the spouse who does not handle the finances, that person still has to be the one who signs in and completes the update. Sort out who has account access before the 30 days start running rather than during week four.
Consider a worked timeline. Notice dated March 4. The 30-day response window closes April 3. If you update the account on March 12, the status updates by roughly March 19 and the deposit follows. If you do nothing, the IRS issues a paper check about six weeks after the notice, mid-April, and then mail time on top of that, to the address of record. If you moved after filing, the check goes to the old address unless you filed Form 8822, and the IRS mails refund checks only to the address of record.
The common mistake: entering the numbers from a deposit slip or from memory instead of from the account details screen. Since there is only one attempt, this single shortcut is responsible for most of the six-week waits that follow a CP53E. The second common mistake is letting the 30 days lapse while waiting to talk to someone at the IRS about it, which is a call that cannot produce a result. The third is entering a spouse’s individual account on a joint return where the primary filer’s name does not appear on the account.
Do three things before you type anything. Open your bank’s app and screenshot the routing and account numbers. Confirm the name on the account matches the name on the return. Then complete the update in one sitting, and check the refund status in your online account a week later rather than assuming. And regardless of outcome, watch the refund itself on Where’s My Refund rather than calling. Our guide to how Form 1040 works shows where the direct deposit lines sit on the return, so next year’s entry is right the first time. This page is general information and not tax advice for your account; a licensed CPA can review your transcript with you before you respond.
How long does a refund take after a CP53E, and can it still be reduced?
An IRS refund notice CP53E puts you on one of two timelines, and you pick which one by acting or not acting. If you update the bank account inside the 30-day window, the refund status in your online account generally updates within two to five business days of the change, and the deposit follows on the normal cycle after that. If you do nothing, the IRS issues a paper check after six weeks, and then you add mail transit. The gap between those two outcomes is roughly a month and a half of your own money.
Those figures come from the CP53E guidance itself. The rest of the CP53 family runs on different clocks and it is worth knowing which one you are on. A plain CP53 says the check should arrive about four weeks from the notice date. CP53D, the notice for a declined deposit request, says roughly the same four weeks. CP53A, CP53B, and CP53C all mean the financial institution returned the deposit and the IRS is researching the account, and all three tell you to expect up to 10 weeks before a check or a follow-up letter, with an explicit instruction not to call before then because the agency will have nothing to tell you. The IRS lists the delay factors on those pages: bankruptcy, an open audit, and a balance due on a related tax year account.
Calling does not accelerate anything, and the IRS says so on every page in the series. Telephone assistors cannot provide additional information about refund status, cannot update bank information, and cannot release a refund early. The tool that actually reflects status is Where’s My Refund, and your online account shows the same information alongside your notices.
Yes, the refund can still be reduced after a CP53E. The notice explicitly warns that when the refund is issued it may be subject to offset if you have other outstanding liabilities. Offsets run under IRC section 6402 and the Treasury Offset Program. The order matters: the IRS first applies the refund to any federal tax you owe for other years, then Fiscal Service applies the remainder against past-due child support, federal non-tax debts such as defaulted student loans, state income tax obligations, and certain unemployment compensation debts. You receive a separate notice from the Bureau of the Fiscal Service identifying the agency that took the money, and you dispute it with that agency, not with the IRS. The IRS reduced refund page explains the split.
An injured spouse situation is the exception worth knowing. If a joint refund was offset for a debt belonging solely to your spouse, Form 8379 lets you claim your share. It can be filed with the return or afterward, and processing takes months, so file it with the return whenever the debt is known in advance.
Interest is real but modest. Under IRC section 6611, the IRS pays interest on overpayments, and if a refund on a timely filed return is not issued within 45 days of the later of the due date or the filing date, interest accrues from that point at the quarterly overpayment rate. Interest paid to you on a refund is taxable income and shows up on a Form 1099-INT for the following year, which is a small unpleasant surprise for people who forget about it.
Work a timeline. A return is filed February 20 claiming $11,300. The deposit is rejected in early March. A CP53E is dated March 14, so the response window closes April 13. Scenario one: the taxpayer updates the account March 20, sees the status change March 26, and the money lands within the following week, call it March 31, about six weeks after filing. Scenario two: the taxpayer sets the notice aside. The IRS issues a paper check about six weeks from March 14, so late April, plus mail time to the address of record. Call it May 2. Same $11,300, a month later, in an envelope that can be stolen from a mailbox. Scenario three: the taxpayer owes $4,150 in past-due state income tax that has been referred to the offset program. The check is $7,150 and a separate Fiscal Service notice explains the difference.
State refunds run on an entirely separate track. A New York refund is not affected by a federal CP53E, has its own status tool at the Department of Taxation and Finance, and has its own offset rules. New York can apply a state refund against state tax debts, and it participates in reciprocal offset programs with the IRS. So a taxpayer can have a federal deposit failure and a state deposit that lands normally, or the reverse, and the two agencies will not tell each other about it. Check both.
If a check never arrives, there is a defined path. Wait the stated window, four weeks for CP53 and CP53D, ten weeks for CP53A, CP53B, and CP53C, six weeks plus mail time after a CP53E default. Then call the number on the notice and request a refund trace, or file Form 3911, Taxpayer Statement Regarding Refund. If the check was issued and cashed by someone else, the trace triggers a claims process through the Bureau of the Fiscal Service, which takes months but does work.
The common mistake: calling repeatedly during the waiting period. It produces no information and consumes hours. The second is not checking the address of record before defaulting to a paper check. The IRS mails refund checks only to the address on the return or a permanent change of address processed after filing, so a taxpayer who moved in the interim should file Form 8822 immediately rather than hoping mail forwarding catches it. The Postal Service does not always forward government checks. The third is forgetting that a large refund is itself a planning failure worth fixing; our calculators can help right-size next year’s withholding.
Going forward, the reliable habit is to check refund status in your online account rather than by phone, keep your address and your name-to-SSA match current, and treat any refund over a few thousand dollars as a signal to revisit withholding. This page is general information and not tax advice; a licensed CPA should review your transcript and any offset notice before you dispute anything.
Is my CP53E real or a scam, and how do I verify it?
Verify any IRS refund notice CP53E in your own IRS online account, and nowhere else. That single step resolves essentially every case, costs nothing, and does not require you to click, call, scan, or reply to anything you received.
Here is why the question comes up so much. A genuine current-generation IRS refund notice contains a web link and a QR code, mentions money the government owes you, and asks you to enter bank account information. That is, feature for feature, the anatomy of a phishing message. The IRS knows it. The agency added an FAQ to the CP53E page titled “How do I know the link or QR code is safe?” advising taxpayers to look for a lock icon or https at the start of the URL and to confirm .gov appears in the domain. Agencies do not write FAQs like that unless impersonation is happening at volume.
The verification procedure is four steps. First, do not use anything printed in or attached to the message you received, not the link, not the QR code, not the phone number. Second, type irs.gov into your browser’s address bar yourself and sign in to your online account. Third, look at Notifications on Account Home. The IRS states that the “Add bank account” option is present only when a CP53E notice has been issued. If it is not there, no CP53E was issued to you. Fourth, review the notices and letters section of the account, which shows the correspondence the IRS has actually sent.
Layer on the structural rules that never change. The IRS does not initiate contact with taxpayers by email, text message, or social media to request personal or financial information; that is the core of its scam recognition guidance. So an emailed or texted CP53E is fake, full stop, regardless of how good the logo looks. The IRS does not demand payment of a fee to release a refund. It does not ask for gift cards, wire transfers, or cryptocurrency. It does not threaten immediate arrest or deportation. And it does not ask you to reply with a Social Security number, a full account number, or an online account password.
Then read the paper itself. A genuine notice carries a notice number in the upper right corner in the CP or LTR format, a notice date, your name and address as they appear in IRS records, a truncated taxpayer identification number showing only the last four digits, and a specific tax year and form number. Fakes commonly get the small things wrong: a full Social Security number printed in the clear, a tax year that does not match anything you filed, a payment demand with a deadline measured in hours, a return address that is not an IRS service center, or grammar that reads like a translation.
Work through a live example. A New Jersey taxpayer receives an email on a Sunday afternoon with an IRS logo, the subject line “Notice CP53E, Refund Deposit Failed,” a QR code, and a link reading “Update Your Refund Account.” The message says a $4,782 refund is on hold and gives 24 hours to respond. Three things are wrong before you look any further. The IRS does not initiate contact by email. A genuine CP53E gives 30 days, not 24 hours. And a real notice arrives in an envelope. The taxpayer opens irs.gov directly, signs in, and finds no notices and no “Add bank account” notification. The message is a fake. He forwards the email to phishing@irs.gov and deletes it. Total time: four minutes. Had he scanned the QR code, he would have landed on a cloned login page harvesting his credentials and his routing and account numbers, and the fraud would not have surfaced until the real refund vanished.
There is also a lookup worth bookmarking. The IRS maintains an index of notices and letters where you can enter the notice or letter number from the upper right corner and read the official description of what that notice means. If the number on your letter returns nothing on that index, the number was invented. If it returns a description that does not match the letter in your hand, the letter was fabricated around a real number. Either result is decisive, and the lookup takes under a minute.
If something did arrive by mail and you still are not sure, there is one more move: call the number on the official IRS website, not the number on the letter, and ask them to confirm whether a notice was issued to your account. Better, have your CPA pull your account transcript with an authorization on Form 2848. Every notice the IRS issues is recorded on the account, and a transcript settles the question in minutes.
The common mistake: calling the number printed on a suspicious letter. If the letter is fake, that number connects you to the scammer, who now has a live target who believes he is talking to the IRS and who has already been primed to hand over bank details. The mirror-image mistake is dismissing a real notice as fake because it contains a QR code, missing the 30-day window and adding six weeks to your own refund. Verify rather than guess in either direction. A third error is replying to the sender to complain. That confirms the address is live and multiplies the attempts.
Report what you find. Forward phishing emails to phishing@irs.gov and see the IRS report phishing page for text messages and mailed fakes. Report IRS employee impersonation to the Treasury Inspector General for Tax Administration. As electronic refunds become the default under the payment modernization order, expect impersonation of deposit-related notices to increase rather than fade, and make the online-account check a reflex. Our guide on tax advice covers the same instinct applied to advice generally. This is general information rather than advice for your situation; a licensed CPA should verify any notice against your account transcript before you respond to it.
What should I do if I already gave bank details to a fake refund notice?
Move fast and in a specific order. The first hour matters more than everything that follows, and the sequence below is built around limiting what a criminal can do with what they now hold.
Call your bank first. Before you contact the IRS, before you file anything, call the number on the back of your debit card and tell them your account and routing numbers were disclosed in a phishing attack. Ask for the account to be flagged, ask whether to close and reopen it, and ask them to place a hold on outbound ACH debits. Routing and account numbers alone are enough to originate an ACH debit, and criminals move within days. If you also gave a debit card number, cancel the card in the same call.
Change the credentials you exposed. If you entered anything on a cloned login page, assume the username and password are compromised, and assume they are compromised everywhere you reused them. Change the IRS online account password directly at irs.gov, then change any other account using the same password, starting with your primary email, because email access is what lets an attacker reset everything else. Turn on multi-factor authentication where it is available.
Get an Identity Protection PIN. The IP PIN is a six-digit number that must appear on your federal return for it to be accepted, which blocks someone else from filing in your name. Any taxpayer who can verify their identity can request one at the IRS IP PIN page. It is issued annually. This is the single most effective preventive step available to an individual, and it takes about fifteen minutes.
File Form 14039 if a fraudulent return may have been filed. The Identity Theft Affidavit tells the IRS your identity was used or is at risk. File it if your e-filed return is rejected as a duplicate, if you receive a notice about a return you did not file, or if the IRS reports wages from an employer you never worked for. If nothing has happened yet, the IP PIN is usually the better first move and the affidavit can wait until there is something to report.
Report it. Forward the phishing email to phishing@irs.gov and follow the channels on the IRS report phishing page for text messages and mailed fakes. Report IRS employee impersonation to the Treasury Inspector General for Tax Administration, and say specifically that the lure was a fake IRS refund notice CP53E, because the agencies track the templates in circulation. File a report at IdentityTheft.gov, the Federal Trade Commission site, which generates a recovery plan and an identity theft report that creditors accept. Contact the fraud department at one of the three national credit bureaus to place a fraud alert, which propagates to the other two, and consider a full credit freeze, which is free and stronger.
Monitor the tax account itself. Sign in to your IRS online account and read the account transcript for the year in question. It shows every posted transaction: the return as filed, adjustments, refund issued, refund returned, and notices sent. If a refund was issued to an account you do not recognize, you have a specific date and amount to work from. Watch state accounts too, since state refunds are targeted in parallel and the state agency has its own process.
Consider what the real damage looks like. A Manhattan taxpayer scans a QR code on what appears to be a CP53E, lands on a cloned page, and enters her name, Social Security number, date of birth, routing number, and account number, expecting a $5,220 refund. Within 48 hours there is a $2,400 ACH debit against the checking account and an attempt to open a credit card in her name. Because she called the bank the same evening, the debit is reversed under the bank’s error resolution procedures and the account is closed and reissued. Because she froze her credit the next morning, the card application is declined. Because she obtained an IP PIN, the fraudulent return someone tried to file in February was rejected. Total loss: several hours and a new account number. The same fact pattern with a three-week delay routinely produces a stolen refund, a rejected legitimate return, and a resolution process that runs past a year.
The common mistake: waiting to see whether anything happens. Criminals sell harvested data quickly and the window between disclosure and use is often measured in days. The second is closing the bank account but leaving the exposed password in place on the email address tied to it. The third is assuming the tax exposure ends when the bank issue is resolved, a Social Security number and date of birth remain usable for years, which is what the IP PIN and the credit freeze are for.
Business owners have two more steps. If the exposed account is a business operating account, the bank’s error-resolution protections for commercial accounts are weaker than the consumer ones under Regulation E, so speed matters even more and the conversation with the bank should include positive pay or ACH debit filters going forward. And if an employer identification number was disclosed alongside personal information, business identity theft is a separate pattern, fraudulent payroll filings and fraudulent credit applications in the company’s name, that the IRS handles through its own business identity theft channel rather than the individual one.
Afterward, tighten the habits that make this repeatable. Never act on a link in a message about money; open the site yourself. Keep the IP PIN renewal on your calendar. Reconcile your refund against your account transcript rather than against your expectation. And if a preparer ever offers to route your refund through their own account, treat it as disqualifying. The IRS will not deposit a refund into an account that is not yours, and a preparer who proposes it is describing a fraud pattern. Our guide to tax advice covers how to tell a real professional from a confident one. This page is general information and not legal or tax advice for your circumstances; contact a licensed CPA and, where money is missing, law enforcement.