Tax refund or benefits stolen: what to do

Your tax return was rejected as already filed, or benefits were claimed in your name. Contact the tax or benefits agency, file the identity-theft form and lock down your government online account.

Do right now

· Within minutes

Identify which agency: CRA, Service Canada (EI/SIN), provincial benefits, IRS, state unemployment, or Social Security. The playbook differs for each.
🇨🇦 CA
Canada (CRA): call 1-800-959-8281, press 'suspected identity theft'. Log into CRA My Account and check direct-deposit info, mailing address, and recent return filings.
CRA · 1-800-959-8281
🇨🇦 CA
Canada (Service Canada / EI): call 1-800-808-6352 and ask for the EI fraud unit. They'll pause the claim and investigate; you won't owe repayment for money sent to a thief.
🇺🇸 US
US (IRS): file Form 14039 (Identity Theft Affidavit) at identitytheft.gov or by mail; request an IP PIN — once issued, no return can be filed in your name without it.
identitytheft.gov
🇺🇸 US
US (state unemployment): report to the state agency that issued the claim and request a corrected 1099-G — don't ignore it or the IRS will tax you on income you never received.
🇺🇸 US
US (SSA): call 1-800-269-0271. Create or take control of your 'my Social Security' account; request a copy of your earnings record to spot employment fraud.

Do today

· Within hours

Make a folder: every letter, every email, every reference number, sorted by date. Agency processes take months — documentation is what keeps things moving.
Freeze your credit at all bureaus and notify your bank to require additional verification on any direct-deposit changes for the next 12 months.

Do this week

· Within days

Set up the agency's online account if you don't already have one — sometimes the thief has access to a 'my account' portal you didn't know existed.
If you have an employer, tell HR — some payroll systems are involved as a data-leak source.
🇨🇦 CA
File with the Canadian Anti-Fraud Centre (CRA / Service Canada cases feed a coordinated CRA + RCMP file).
CAFC

Ongoing protection

· Build the habit

File your taxes early next year — the single best defense against duplicate-return fraud is getting your real return in first.
Set a calendar reminder every 30 days to call the agency back. Cases that resolve cleanly are the ones where someone keeps following up.

Identity Stolen

Someone using your name or ID? Freeze your credit, file a report and close fraudulent accounts with these steps.

Medical Identity Theft

Medical bills or insurance claims that aren't yours? Correct your records, dispute charges and report the theft.

Deceased Family Member Identity Misuse

Someone using a deceased family member's identity? Notify agencies, flag credit files and close accounts.

Is this happening at work?

If a business account, company device or customer data is involved, the steps change. Get help built for organizations.

Go to business help →

· Printed October 7, 2026