IRS: unexpected W‑2s flag identity theft

An unexpected W-2 is not just a paperwork problem. The IRS says a wage statement from an employer a taxpayer never worked for can be a sign of employment-related identity theft, a form of fraud in which someone uses another person’s Social Security number to get a job. (irs.gov) CyberGuy, in a June 3 article on identity-theft warning signs, listed an unexpected W-2 or 1099-K alongside missing mail, unfamiliar accounts and unexplained charges as clues that fraud may already be underway. (cyberguy.com) That matches IRS guidance that tax-related identity theft often first appears through a letter, notice, rejected return or income record that does not belong to the taxpayer. (irs.gov) ### Why would a fake wage form show up in the first place? The IRS defines employment-related identity theft as the use of someone else’s Social Security number for work. In those cases, the victim may later receive a W-2 from an unknown employer or see wages posted to their account that they never earned. (irs.gov) A 1099-K can raise a similar alarm. CyberGuy said an unexpected 1099-K from a platform a person never used may indicate someone used that person’s identifying information to generate reportable income. (cyberguy.com) ### How is that different from a scam letter or a simple mistake? The IRS says taxpayers should first determine whether the contact is real and whether the income document reflects actual misuse of their identity. Its Identity Theft Central hub separates fake IRS contacts from legitimate notices and points taxpayers to identity verification tools when the agency needs confirmation. (irs.gov) A simple misunderstanding is also possible. Taxpayers sometimes confuse corrected forms, duplicate mailings or payer errors with fraud, but the IRS says tax-related identity theft usually involves a more specific sign — such as income that is not theirs, a return already filed under their Social Security number, or an IRS notice tied to activity they do not recognize. (cyberguy.com) ### What other clues tend to show up with a “weird W-2”? CyberGuy’s June 3 checklist named missing mail, small unauthorized card charges, unfamiliar account alerts and medical bills for care never received as early warning signs. (irs.gov) The article said those signals often appear before a debt collector, lender or tax agency makes contact. The IRS lists related warning signs on its guide for individuals, including an e-file rejection because a return with the taxpayer’s Social Security number is already on file, an IRS letter about a return the person did not file, or online account activity the person does not recognize. (irs.gov) ### What should a taxpayer do after spotting income that is not theirs? The IRS says taxpayers who believe their identity was stolen should stop interacting with the suspected thief, review whether they received an IRS letter, and use the agency’s identity-theft guide to determine the correct reporting path. (cyberguy.com) The agency says Form 14039, the Identity Theft Affidavit, should be filed only in certain cases, including when the IRS instructs the taxpayer to do so, when the taxpayer cannot use the Identity and Tax Return Verification Service, or when reporting possible tax-related identity theft not already on file. (irs.gov) The IRS also says victims can contact its specialized identity theft assistance line at 800-908-4490 and review Publication 5027 for taxpayer guidance. Its central identity-theft page also points taxpayers to the Identity Protection PIN program and to reporting channels for tax scams and fraud. ### What if the problem involves a child or another kind of false tax form? The Identity Theft Resource Center says a rejected return because a dependent’s Social Security number has already been used can be a sign of child identity theft. The group advises families to document the activity, contact the credit bureaus, file a report with the Federal Trade Commission and contact the IRS if a tax return was filed using the child’s information. (irs.gov) The IRS gives separate instructions for other false income forms as well. Its scams and fraud page says an unexpected Form 1099-G for unemployment compensation can signal identity theft and should not be reported as income if the taxpayer never received those benefits. (irs.gov) ### Where does the IRS send people now? The IRS has consolidated its public guidance through Identity Theft Central, the identity-theft guide for individuals, and related pages for employment and unemployment fraud. Those pages were updated in May and June 2026 and now serve as the main routing point for verification, reporting and recovery steps. (irs.gov 1) (irs.gov 2) (irs.gov 3)