Business identity theft kit: Form 14039-B checklist, officer statement, redacted-copy request

Template from tincompliance.com. Three documents for a business whose EIN was used on returns or on Forms W-2 or 1099 it did not file: the checklist of what to send with Form 14039-B (IRM 25.23.9.7, Oct. 1, 2025; IRM 25.23.11.6.2.2.1, Oct. 1, 2024), the officer authority statement the IRS requires from a corporation, partnership, LLC, exempt organization, estate or trust, and a request for redacted copies of the fraudulent documents (IRM 25.23.9.10). Fraudulent information returns alone are enough to open a case; a fraudulent tax return is not required (IRM 25.23.9.2(3)).

Part 1. Before you file Form 14039-B

The IRS opens most business identity theft cases from a letter and a copy of the notice; Form 14039-B is often not required. File it when the IRS asks for it, when you have no notice to respond to, or when an individual received a CP 575 or EFTPS letter for an EIN they never applied for. Do not file it while a return is under RICS review (Letter 6042C); reply to that letter instead.

Rule out the two things the IRS checks first

☐ Mixed entity: another business keyed our EIN by mistake (a Form 941 we never filed, a payroll company that changed, a second EIN after an entity change). This is corrected as an account error, not identity theft.

☐ Fraud by someone with authority: a rogue employee or former payroll provider who could file for us. The IRS treats this as fraud, not identity theft, and Form 14039-B will be returned.

Which box in Section A

☐ Box 1: an individual who never applied for the EIN and has no business (complete C, D, F; give the nine-digit EIN).

☐ Box 2: the entity in Section B is the victim (complete B, C, D, E, F).

Documents to attach, by claimant

Filling it in

☐ Section B line 5: the forms affected (for information returns, list "Forms W-2" or "Forms 1099-[type]" and the return the IRS is asking about, if any).

☐ Section B line 6: tax years and periods in the IRS format, for example "2025" or "202512".

☐ Section B line 8: active or not active, with the final-return period if the business closed.

☐ Section D: a detailed explanation with dates: when you learned of it, what you found, what you have already done. Attach the notice.

☐ Section E: the perpetrator, if known, or the police report number.

☐ Section C is signed by someone with legal authority to act for the entity. If that person is not an officer of record, attach a Form 2848.

Where to send it

☐ Responding to a notice: with a copy of the notice, to the address or fax number on that notice.

☐ No notice: per the form's own instructions, by mail or through the online submission tool on IRS.gov.

☐ Asking for a new EIN because of fraudulent filings: a new Form SS-4 with Form 14039-B attached, to Ogden BMF Entity, 1973 N Rulon White Blvd, Mail Stop 6273, Ogden UT 84404. The IRS issues a new EIN only where fraudulent returns or income documents were filed, and merges it with the old number.

What to expect

• Acknowledgment (Letter 5316C) within 30 days of receipt; resolution target 120 days.
• Requests for more information give 30 days (45 days for foreign addresses). No reply closes the case as not identity theft; a late reply reopens it.
• Fraudulent W-2s: the documented remedy is reversal of any CAWR assessment. The IRS procedures contain no step that voids the W-2 or 1099 records themselves or notifies the payees named on them; if a 972CG or CP2100 arrives for returns you did not file, it must be answered on its own timetable.
• Keep a copy of everything. Case notes are part of the file and can be requested.

Part 2. Officer authority statement (corporate letterhead)

Required, in place of the organizing documents, from a corporation, partnership, LLC, exempt organization, estate or trust: "a statement signed by an officer or director on corporate letterhead stationery stating that the person who signed Form 14039-B has authority to legally bind the company." The officer who signs this statement must not be the person who signed Section C of the form (IRM 25.23.9.7(2); IRM 25.23.11.6.2.2.1). Print on letterhead.

[Letterhead: entity legal name, address, EIN]

[Date]

Internal Revenue Service

[Address on the notice, or as directed by the Form 14039-B instructions]

Re: Form 14039-B, Business Identity Theft Affidavit, for [entity legal name], EIN [00-0000000]

Statement of authority to bind the entity

I, [name], am [title: an officer / a director / a general partner / a managing member / the trustee] of [entity legal name], a [state] [corporation / limited liability company / partnership / trust / other] ("the entity").

I state that [name of the person who signed Section C], [that person's title], is authorized to act for the entity, to legally bind the entity, and to receive the entity's return information under IRC 6103, and was so authorized on [date the form was signed], the date on which that person signed the enclosed Form 14039-B on the entity's behalf.

[Optional: This authority arises from [the entity's bylaws / the operating agreement / a resolution of the board of directors dated [date] / the trust instrument], a copy of which is available on request.]

I am not the person who signed Section C of the Form 14039-B.

Under penalties of perjury, I declare that the statements above are true, correct and complete to the best of my knowledge and belief.

[Signature]

[Printed name]

[Title]

[Date]

Part 3. Request for redacted copies of the fraudulent returns or information returns

A legitimate business, active or inactive, is entitled to redacted copies of the returns and income documents filed under its EIN, because at the time of filing they represented a possible liability of the business (IRM 25.23.9.10(3), Sept. 15, 2020). Copies are sent only to the business address of record. Expect redaction of all but the last four digits of every TIN, all but the first four letters of names, all but the first six characters of addresses, all bank and routing numbers, and signatures; on 1099s and W-2s the recipient name, address and TIN are masked (IRM 25.23.9.10.2(3)). If more than about 1,000 forms are involved the IRS sends enough to let you confirm you did not file them.

[Entity legal name]

EIN: [00-0000000]

[Business address of record]

[Date]

Internal Revenue Service

[Address on the notice / the BMF identity theft unit handling the case]

Re: Request for redacted copies of documents filed under EIN [00-0000000]; identity theft case [reference or Form 14039-B date]

Dear Sir or Madam:

[Entity] has reported to the IRS that the following were filed under its EIN without its authority: [Forms W-2 for tax year [year] / Forms 1099-[type] for [year] / Form [941 / 1120 / other] for [period]]. [Entity] requests redacted copies of those documents under IRM 25.23.9.10, so that it can [confirm the filings are not its own / identify the payees or employees named / respond to [notice number] dated [date]].

[Entity] is [an active business / a business that ceased operations on [date] and filed its final return for [period]]. The address above is the entity's address of record with the IRS. [If the fraudulent filing changed the address: The IRS address of record was altered by the fraudulent filing on or about [date]; the correct address is the one above, which is the address on [our most recent legitimate return / our state registration], and a Form 8822-B correcting it is enclosed.]

Please send the copies to the address above. If the volume is large, copies sufficient to establish that [Entity] did not file the documents are acceptable. Questions may be directed to [name, title], [phone].

[Signature]

[Name], [Title: an officer or other person with authority to receive the entity's return information]

[Date]

Enclosures: copy of the notice; [Form 8822-B]; [Form 2848]