Tax season compresses a year of your personal data into a handful of documents: your Social Security number, your income, your bank details, your children's names and birth dates. That concentration is exactly what identity thieves wait for. A fraudulent return filed in your name can be paid out to a stranger's account before you even sit down with your paperwork. Most tax-related identity theft, though, depends on small openings — a piece of mail left in an unlocked box, a reused password, a phone call answered in a moment of alarm. Close those openings and you remove most of the opportunity.

Why tax season is a thief's favourite month

Think about how many places your tax information sits between January and April. Your employer's payroll system. A tax preparer's office. A tax software account you log into twice a year. Your email inbox, where a PDF of your W-2 may be sitting right now. Every one of those is a door.

The classic scam is refund fraud: someone files a return using your Social Security number and your name, inventing income and deductions, and directs the refund to a prepaid card or bank account they control. You find out weeks later, when your own electronic return is rejected because a return has already been filed under your number. The second wave is impersonation — emails, texts and calls that use the IRS name to frighten you into handing over money or credentials. Both types peak in the same few weeks, which is why a little preparation now saves an enormous amount of frustration later.

Before you file: habits that keep your return yours

Most of the protection happens before you type a single number into tax software.

• Open an IRS online account now, not in April. It lets you see your account transcript, your payment history and whether a return has already been filed under your number. Setting it up takes a few minutes and gives you a baseline.
• Request an Identity Protection PIN (IP PIN). This is a six-digit code the IRS issues to you personally, and it must be entered for your return to be accepted. It changes every year, so plan on retrieving it each January.
• File early if you expect a refund. The first return filed under a given Social Security number is the one that gets processed.
• Use a unique password and two-factor authentication on your tax software, your bank and — critically — your email. Your email inbox is the reset key to everything else.
• Freeze your credit with all three credit bureaus. It is free, it can be lifted temporarily when you need a loan, and it stops most new-account fraud. It does not stop a fraudulent tax return, but it closes an adjacent door.
• Collect documents from a locked mailbox and avoid emailing scans of your W-2 or Social Security card. If your preparer has a secure portal, use it.

If you work with a preparer, ask for their Preparer Tax Identification Number, ask how they store and eventually delete client files, and read every line of the return before you sign. The signature, and the accuracy, are yours.

Filing safely when it's time to submit

File from your own device, on a network you trust. Public Wi-Fi, hotel business centres and shared library computers are poor places to enter a Social Security number. Choose direct deposit and check the routing and account numbers twice; a single transposed digit can send your refund into limbo.

If you owe money, pay through the IRS's own payment options — your IRS online account, IRS Direct Pay, or an approved card processor — not to a caller who offers to "settle" the balance. Keep a copy of the filed return as an encrypted PDF, and store it somewhere other than your inbox. If you have to file on paper, use trackable mail and keep the receipt.

How to spot an IRS impersonation scam

Impersonation works because it borrows authority and adds urgency. The IRS does contact people, but the method and the manner give the fakes away. Watch for these signals:

• A caller demands immediate payment and threatens arrest, deportation, licence loss or a lawsuit.
• Payment is requested by gift card, prepaid debit card, wire transfer or cryptocurrency. No legitimate tax agency collects that way.
• Caller ID shows the IRS, a local police department or a courthouse. Numbers are easily spoofed; what appears on the screen proves nothing.
• An email or text asks you to click a link and "verify" your identity, refund amount or bank details. The IRS does not start a bill or refund conversation by email or text.
• Someone asks for your SSN, IP PIN or bank credentials over the phone before any letter has arrived.
• You are told to stay on the line, keep quiet, or act within the hour.
• A "preparer" offers to file for you and take a percentage of the refund.

What the IRS actually does

For most account issues, first contact comes by mail, in a letter that explains the problem and gives you time to respond or appeal. There are situations where the IRS calls, but you never have to resolve anything on that call. Hang up, then reach the agency through the number on IRS.gov or your IRS online account. A real representative will not mind the pause.

If a fraudulent return has already been filed

1. File your correct return anyway and follow the instructions in the notice you receive. Victims are usually asked to submit Form 14039, the Identity Theft Affidavit, along with their documentation.
2. Respond to every IRS letter on time and keep copies of everything you send. Delays make resolutions slower, not faster.
3. Place a freeze or fraud alert on your credit files and read your credit reports for accounts you do not recognise.
4. Report it at IdentityTheft.gov, which builds a recovery plan and generates an FTC identity theft report you can share with banks and agencies.
5. Report the scam itself. Forward phishing emails to phishing@irs.gov, and report impersonation calls to the Treasury Inspector General for Tax Administration.
6. Change passwords on your tax software, email and financial accounts, and turn on two-factor authentication everywhere it is offered.

If a refund is being withheld, a large balance is in dispute or you are facing an audit, bring in a qualified tax professional or attorney. General guidance goes only so far when money and liability are on the line.

Make it a year-round habit, not a spring panic

The people who rarely get hit tend to do a few boring things consistently. They freeze their credit and leave it frozen. They use a password manager so no account shares a password. They retrieve their IP PIN each January and store it with their tax file. They keep returns for the period their situation requires — often three years, longer for some records — then shred the rest rather than tossing them in the recycling. They let unknown numbers go to voicemail, and they never confirm personal details to someone who called them first.

None of this is dramatic. That is the point. A frozen credit file, a fresh IP PIN and an unsigned conversation with a suspicious caller are usually the whole difference between a routine refund and a season spent proving who you are.

Photo: Nataliya Vaitkevich / Pexels