Business tax identity theft: Protect your EIN and use Form 14039-B

The short answer

Business tax identity theft can involve someone using an entity's name or Employer Identification Number to file unauthorized returns, obtain refunds or submit false wage documents. An unexpected bill can also result from a payment-posting problem, a preparer's error or an unauthorized insider. Verify the records before labeling every discrepancy fraud.

The IRS business reporting instructions direct businesses, trusts, estates and tax-exempt organizations with specified tax-related misuse to Form 14039-B, Business Identity Theft Affidavit. This is not the individual Form 14039, and a data breach without a tax-related impact is not by itself a reason to send the business affidavit.

Warning signs that need investigation

The IRS lists a duplicate-return rejection for an EIN, an unexpectedly rejected extension, an unexplained transcript or notice, and missing correspondence after an address change as possible signs. A request to validate an entity or return may arrive as Letter 5263C, 6042C or 6217C. Verify the exact letter through IRS.gov.

Ask the authorized preparer whether a return or extension was already filed and obtain the acknowledgment. Check the legal entity, tax form, period and EIN on the notice against your records. For an unfamiliar balance, reconcile filed returns, deposits, payments and posted adjustments before assuming the entire amount comes from identity theft.

An unfamiliar transcript transaction is not proof of the identity of the filer. Preserve the records and ask the IRS what return or change produced the discrepancy. For a genuine payroll balance, the CP161 guide explains why business collection obligations still need prompt attention.

When Form 14039-B fits—and when it does not

The IRS's reporting page identifies these situations:

• An electronically filed return was rejected because another return is already on file for that period.
• A notice concerns a return or Forms W-2 you did not file.
• A notice claims a balance you do not owe.
• You receive a notice for a business even though you never applied for an EIN.

These are reasons to follow the IRS business identity-theft instructions, not permission to deny a real filing or debt. Resolve known duplicate submissions and ordinary accounting errors honestly.

The IRS says not to send Form 14039-B for a breach with no tax-related impact, such as exposure without evidence of fraudulent returns or W-2 filings. A breach still needs containment and appropriate reporting. The IRS also specifically directs employers to file Form 14039-B when their EIN is being used to generate fraudulent unemployment claims; that is a distinct instruction on its unemployment-fraud page.

Prepare and submit the business affidavit safely

Download Form 14039-B directly from IRS.gov. Read the current form's instructions for the applicable situation, supporting documents, signature authority and submission method. Identify the entity and periods accurately and have an authorized person sign.

The IRS warns that missing requested documents or a signature can delay processing. Keep a complete signed copy and evidence of how and when it was sent. Do not use an old address or fax number from a third-party checklist: follow the current form and any authenticated case-specific IRS instructions.

The affidavit is not a substitute for answering every outstanding notice. Record each notice's deadline separately and ask the IRS how to respond while the identity-theft issue is being investigated. There is no automatic blanket extension, guaranteed refund date or promise that collection will stop merely because an affidavit was submitted.

Entity misuse, a deceased person and an employee are different cases

An estate or trust is an entity for which the business affidavit may apply. A fraudulent personal income-tax return for a deceased individual is not automatically an estate-account case. Follow the individual IRS instructions for that person's personal return.

A sole proprietor can have both personal and business reporting issues. Decide which account and return were misused rather than choosing a form only because you own a business. Ask the IRS or a qualified adviser if the account classification is unclear.

Employees whose SSNs were used for work need their own employment identity-theft and SSA correction steps. Sending an entity affidavit does not correct every employee's Social Security earnings record. Likewise, personal tax-account recovery does not resolve an entity's separate filing problem.

Secure access and investigate unauthorized account changes

Secure business email, payroll and accounting access; revoke access that is no longer authorized; and review who can submit returns or change payment instructions. Use independent contact information to confirm changes with your preparer or payroll provider.

If the IRS address or responsible-party information is wrong, investigate whether the change was authorized. The IRS business identity-theft page points to Form 8822-B to keep EIN information current. A legitimate update is not a replacement for reporting an unauthorized return or investigating intercepted mail.

For an exposed payroll file or W-2 phishing incident, follow the IRS's separate data-security-breach and W-2 data-theft reporting resources linked on its business identity-theft page. Preserve evidence before deleting messages or wiping systems; obtain security and legal help appropriate to the incident. Do not circulate employees' SSNs in ordinary email.

Continue legitimate obligations while resolving the fraud

Keep making valid current deposits and filing genuine returns according to verified IRS instructions. Do not assume all taxes are fraudulent because one period or form was misused. Reconcile undisputed amounts separately and document any dispute over an assessment.

If a collection or hearing notice arrives, protect its specific response rights. Ask whether the IRS has associated the identity-theft report with the affected account and periods. Keep a communication log with dates, verified contact channels and requested follow-up, but do not publish private business or employee data.

What to do this week

1. Preserve the notice, rejection, return acknowledgment and relevant account records.
2. Confirm who was authorized to file or change the account, and verify the issue through IRS.gov.
3. Follow the current Form 14039-B instructions when the tax-related misuse fits.
4. Answer separate notices on time and continue undisputed filing and deposit obligations.
5. Secure business systems and follow the separate breach or employee-recovery routes where necessary.

TaxRZR does not receive EINs, tax returns, payroll files, identity documents or affidavit uploads. Submit sensitive materials only through authenticated official channels.

Official sources and review status

Official IRS guidance checked October 30, 2026 (US Eastern time). Prepared by the TaxRZR editorial team; professional review is pending. This is general education, not a case-specific determination of fraud or legal advice.

• IRS: Identity theft information for businesses
• IRS: Report identity theft for a business
• IRS: Form 14039-B and submission instructions
• IRS: Identity theft and unemployment benefits

See Source Notes for dated editorial changes.