Someone filed 1099s or W-2s under your EIN: business identity theft, as the IRS works it

Three things it might be

The manual's first instinct is a keying error. Its probes: did the entity type change (sole proprietor to LLC, a second EIN), did the payroll company change ("the old company may still file a return or submit Form W-2"), was the business sold or closed, was a final return filed (IRM 25.23.9.4(3)). Duplicate W-2s under an old and a new EIN after an entity change "is probably not ID theft, but an internal error made by the company or payroll company" (IRM 25.23.9.4(4)). Rule those out before you write "identity theft" on anything, because the IRS will.

First signs

• A CP 575 or an EFTPS enrollment letter for an EIN you did not request, which for an individual means their SSN was used as the responsible party (IRM 25.23.11.6.2(1)).
• Balance-due notices on employment tax returns you did not file: "One or two Form 941 modules in balance due (no payments) with matching Form W-2 data may be a sign of BMF IDT" (IRM 25.23.11.3(4)).
• A CP2100, a Form 945 non-filer letter or a 972CG for information returns you did not file; the IRS looks at IRPTRI, "any Forms W-2 and all related income documents filed under the EIN" (IRM 25.23.9.4(4)).
• Letter 6042C, which means a return filed under your EIN is being held in the Return Integrity filters and the IRS wants you to confirm or deny it.
• A transcript request that suddenly fails in Business Tax Account or e-Services: transcripts are restricted "when certain identity theft indicators are present" (IRM 25.23.9.10.3).

Form 14039-B: when it is needed and when it is not

Form 14039-B, the business identity theft affidavit, has been public since August 2020. The individual Form 14039 "is not needed for BMF ID theft" (IRM 25.23.9.2.1). The manual is clear that the -B is often unnecessary: "A Form 14039-B is NOT required if a referral or correspondence is received and internal research shows indication of IDT. Only request additional information if it is unclear what the taxpayer is claiming" (IRM 25.23.11.7.1(2)). A signed letter that says what happened, with the notice attached, sent to the address on the notice, starts a case.

Two situations where you should not file it. If your return is in Return Integrity review, which is what Letter 6042C means: "The taxpayer does NOT need to file a Form 14039 or Form 14039-B. RICS will ensure all proper actions to protect the taxpayer's account are taken" (IRM 25.23.9.4.1(12)); answer the 6042C instead. And if the person who filed had authority to file for you, it is fraud, not identity theft, and the affidavit will be rejected (IRM 25.23.11.2.2).

An individual who receives a CP 575 for an EIN they never requested files a 14039-B with Box 1 in Section A, not a Form 14039; phone assistors are told "DO NOT advise the caller to submit a Form 14039" (IRM 25.23.9.4.2). Submit by mail with the notice, or through the adaptive-forms tool on IRS.gov. The signer "must have the legal authority to act for the entity" (IRM 25.23.11.6.2.2.1).

What to send with it

"Receipt of documentation from the taxpayer does not validate an identity theft claim. Proper research MUST be performed" (IRM 25.23.9.7(10)). The documents open the case; the IRS's own research decides it.

The clocks

No reply to a document request closes the case "assuming the taxpayer is not an identity theft victim," and releases any collection hold (IRM 25.23.9.7(3)). A late reply reopens it with the original date.

The letters

What happens to the fraudulent 1099s and W-2s

This is the thin part. For a fraudulent tax return the manual is thorough: the return is "a nullity," backed out rather than netted, refunds are pulled back, liens released, penalties recomputed (IRM 25.23.9.9.2). For fraudulent income documents there is one remedy: "In situations where identity thieves filed false income documents, and a CAWR assessment has been made send a referral to the CAWR function to have the assessment reversed" (IRM 25.23.9.8.4). The 2026 revision narrowed even that: "send a referral to CAWR only to have CAWR assessments reversed." CAWR is the W-2 reconciliation program. Nothing in either manual directs anyone to delete or flag the W-2 or 1099 records on the information returns file, to notify the payees named on them, or to suppress a CP2100, a Form 945 inquiry or a 972CG that those records generate.

So a payer facing a penalty notice for information returns it never filed argues it as a penalty matter, not an identity theft matter: IRS error and reasonable cause under IRC 6724, with the identity theft case number and the 5316C as exhibits. The identity theft case will mark the account; it will not, on the text of these manuals, touch the 1099s. What you can get is copies: a legitimate business is entitled to redacted copies of the fraudulent returns and income documents, "at the time of filing all the information represented a possible liability for the business" (IRM 25.23.9.10(3)), with TINs masked to the last four, names to the first four letters, addresses to six characters, mailed only to the address of record.

Locks, and the new-EIN question

Once identity theft is confirmed, the IRS can lock the entity. The older locks (TC 971 AC 524 with literals such as EINFAB, BSCLSD or FNLRTN) generate a TC 020 that "will prevent the posting of returns and payments to a tax module that is not already established" (IRM 25.23.9.8.1(12)). The January 2025 ENTLOK is for a legitimate, operating business: it locks only name, address and responsible-party changes, so "requests for updates to the entity must be made in writing," phone address changes are refused, Form 8822-B is required, and every change is an unlock, change, re-lock cycle (IRM 25.23.11.6.2.1(3), 25.23.11.7.4.6). A closed business can ask to be locked; inactive EINs are the stated target of thieves, "an EIN they never applied for or for a business they closed years ago" (IRM 25.23.9.2(5)).

A new EIN is available only "if there is federal tax administration impact," which the manual defines to include "fraudulent income documents. This would include Forms W-2, Form 1099 series" (IRM 25.23.9.9.7). The route is a new Form SS-4 with the 14039-B attached, to Ogden BMF Entity, Mail Stop 6273, and the new number "is assigned and then merged with the old number." Misuse outside federal filings, credit applications and contracts, gets no new EIN; the only path is to close, rename at the state, and apply fresh.

If it is your SSN on someone else's 1099

An individual who receives an underreporter notice for wages or 1099 income "they did not work for" is not a business identity theft case at all. The affidavit, even a 14039-B, is re-typed as an individual case and sent to the IMF identity theft unit (IRM 25.23.11.7.4.9). Answer the CP2000 by the date on it, disagreeing, and say the income is not yours; the identity theft claim runs alongside. The payee pages cover the notice side.

Questions people ask