An identity-theft refund claim doesn't have one universal deadline. The right deadline depends on what was taken and which payment system handled it:

• IRS tax refund: Respond to IRS notices and submit the legitimate return and requested identity-theft documents promptly. The bank's 60-day electronic-transfer rule doesn't control an IRS refund, but federal refund-claim deadlines can still matter.
• Bank account, debit card, ATM, or ACH transfer: Report the unauthorized electronic transfer immediately. Two-business-day and 60-day notice periods can affect your liability and the bank's investigation.
• Credit card: Send a written billing-error dispute so the issuer receives it within 60 days after the statement showing the charge was sent.
• FTC report: File promptly for a recovery plan and supporting report, but the FTC doesn't directly reimburse stolen money.

These are U.S. consumer rules for personal accounts. Wire transfers, business accounts, state tax returns, and payments you personally authorized after being deceived can follow different rules.

Identity-theft refund deadlines at a glance

These deadlines are separate. Filing with the FTC doesn't notify your bank. Form 14039 doesn't replace a valid tax return, and a credit card dispute doesn't protect an ACH transfer.

IRS identity-theft refund claims

The IRS must identify the legitimate return, verify your identity, and correct the affected tax account before it can release a refund. Form 14039 flags suspected tax-related identity theft, but it doesn't create a refund or guarantee a processing time.

The Taxpayer Advocate Service reported that, as of April 2024, Identity Theft Victim Assistance cases were taking about 675 days, or roughly 22 months, on average. That figure describes reported backlog conditions. It isn't an IRS promise, a current forecast, or a deadline for every case.

What to do if someone filed a return in your name

1. Save every IRS notice. Letters such as 5071C, 4883C, and 5747C contain the verification method and contact details you should use. Respond as soon as possible and follow the letter rather than general instructions found online.
2. File your legitimate return. If electronic filing is rejected because a return using your Social Security number was already filed, follow the IRS instructions for completing Form 14039 and submitting a paper return.
3. Use Form 14039 only when appropriate. If an IRS notice tells you to verify your identity, complete that process first. Don't send a separate affidavit unless the notice or current IRS instructions call for it.
4. Provide evidence through the requested channel. The IRS may request identification, a copy of the legitimate return, wage documents, or a police report. The Taxpayer Advocate Service identity-theft guidance says a police report may be submitted instead of Form 14039 in situations where the IRS accepts it.
5. Keep proof of submission. Save copies of every form, the date it was mailed or faxed, delivery confirmation, and the name or identification number of anyone you speak with.
6. Check status after identity verification. The Taxpayer Advocate Service says taxpayers can generally check refund status on IRS.gov or the IRS2Go app after allowing about two to three weeks for identity verification. The tool may not show every stage of an identity-theft case.
7. Escalate a serious hardship. Contact the IRS using the details on your notice. If the problem remains unresolved or causes significant financial hardship, review the current eligibility rules for help from the Taxpayer Advocate Service.

Tax preparation software may have its own account-security or support process, but it can't change an IRS deadline or order the IRS to release a refund. A software company's acknowledgement also isn't proof that the IRS has accepted your identity-theft claim.

The federal tax refund deadline isn't always three years from April 15

The shorthand statement that you always have three years from the tax due date is too broad. Federal law generally allows a refund claim by the later of:

• Three years after the return was filed, or
• Two years after the tax was paid.

Special rules can apply to withholding, estimated payments, amended returns, returns filed before the due date, and other situations. An identity-theft delay doesn't automatically remove these limits. If your filing or refund window may be close to expiring, submit the valid return or claim promptly and get tax-specific help rather than waiting for the IRS identity-theft unit to finish.

IP PINs: useful protection, not a refund-release tool

An IRS Identity Protection PIN is a six-digit code used when filing a federal tax return. It helps stop someone from electronically filing another return with your Social Security number or taxpayer identification number.

You can request an IP PIN through the IRS identity-verification process if you qualify. If online verification isn't available, follow the IRS's current alternative instructions, which may include Form 15227 or in-person assistance.

An IP PIN can help protect future filings, but it won't unlock a refund already held, reverse a fraudulent return by itself, or speed a pending Identity Theft Victim Assistance case. Keep the code private and enter it only through a trusted tax-filing or IRS process.

Bank account, debit card, and ACH identity theft

For many consumer electronic transfers, the controlling federal law is Regulation E, part of the Electronic Fund Transfer Act. Covered transactions can include ATM withdrawals, debit card purchases, and ACH transfers. The NCUA's Regulation E guide summarizes protections for covered consumer accounts.

The important notice windows

• Lost or stolen debit card or access device: Report the loss within two business days after learning about it when possible. This generally helps keep the maximum liability at $50.
• Unauthorized transfer shown on a statement: Notify the bank within 60 days after the statement was sent. Waiting longer can expose you to losses from later transfers.
• After the 60-day period: The bank may have stronger grounds to deny responsibility for additional losses that occurred after the notice period. Contact it anyway and explain when you discovered the problem.

The 60-day period isn't a promise that every claim will be reimbursed. Regulation E coverage can depend on the account, transaction, timing, and whether the transfer was truly unauthorized. If a scammer persuaded you to enter a payment yourself, tell the bank exactly what happened. The bank may classify that situation differently from a transfer made without your permission.

How to file a bank fraud claim

1. Call the fraud number on the back of your card, account statement, or the bank's verified website.
2. Lock the card or account and change online banking, email, and payment-app passwords.
3. Ask whether the transaction is covered by Regulation E and whether provisional credit is available.
4. Provide the transaction date, amount, account, merchant or recipient, and the date you noticed it.
5. Follow up in writing or through the bank's secure message system if requested.
6. Record the claim number, the investigation deadline, and any provisional credit.
7. Don't assume provisional credit is final. A bank may reverse it if it concludes the claim doesn't qualify.

A bank generally has 10 business days to investigate a reported error. If it needs more time, it can usually extend the investigation by issuing required provisional credit and may take up to 45 days. Longer periods can apply to some new-account, point-of-sale, or foreign transactions.

A wire transfer, business account, or payment you intentionally authorized may not follow this process. For a fraudulent wire, contact the bank's wire-fraud team immediately and ask whether it can recall or freeze the transfer.

Credit card identity-theft disputes

Credit card fraud uses a different process from debit card or ACH fraud. To protect your federal billing-error rights, send a written dispute that reaches the card issuer within 60 days after the first statement showing the unauthorized charge was sent.

The FTC's credit card dispute guidance recommends writing to the issuer and sending the dispute to the billing-inquiries address shown on the statement, not simply the payment address.

Include:

• Your name and account number
• The transaction date and amount
• A clear statement that you didn't authorize the charge
• A copy of the statement with the charge marked
• Copies, not originals, of supporting documents

Calling the issuer can stop further transactions quickly, but a phone call alone may not preserve the federal written-dispute procedure. Send the letter as directed and keep a copy and delivery evidence.

The issuer generally must acknowledge a written dispute within 30 days unless it has already resolved the matter. It generally must complete the investigation within two billing cycles, and no later than 90 days. Pay the undisputed portion of the bill on time and follow the issuer's instructions while the investigation is pending.

A charge for an item you bought but didn't receive, a canceled subscription, or a defective product may be a different billing dispute. Describe the facts accurately instead of labeling every problem as identity theft.

FTC reports, credit freezes, and fraud alerts

Use the FTC's IdentityTheft.gov recovery plan to document what happened and create step-by-step recovery tasks. The report can help when dealing with creditors, credit bureaus, or other organizations, but it doesn't make the FTC issue a refund or act as a live status tracker for an IRS or bank investigation.

The FTC's guidance on credit freezes and fraud alerts explains the difference:

• A credit freeze is free and remains in place until you ask the bureau to remove it. Place one with Equifax, Experian, and TransUnion.
• A fraud alert tells businesses to take extra steps to verify your identity before opening new credit. A standard alert generally lasts one year, and an extended alert may be available with an identity-theft report.
• Review your credit reports and account statements for additional accounts or transactions you don't recognize.

A freeze helps prevent new-account fraud, but it won't recover a stolen tax refund or reverse an existing bank transaction.

Evidence checklist for any identity-theft refund claim

Create one timeline before making repeated calls. Include:

• The date you discovered the theft
• The date each statement or IRS notice was issued
• Transaction dates, amounts, and account or card numbers
• When you called, wrote, or submitted an online report
• Claim, case, confirmation, and tracking numbers
• Copies of tax returns, Form 14039, police or FTC reports, and supporting documents
• The name or department of each representative who helped you
• Any promised response date or provisional credit

Use only the phone number, mailing address, or secure upload method on an official notice, statement, or verified website. Don't email your Social Security number, full account number, or identity documents to an address supplied in an unsolicited message.

Common mistakes that delay recovery

• Waiting for an IRS response before reporting an unauthorized bank or card transaction
• Assuming the bank's 60-day rule applies to a tax refund
• Missing the credit card issuer's written-dispute deadline
• Filing Form 14039 when an IRS verification letter requires a different process
• Treating an IP PIN as a way to release an old refund
• Assuming a 22-month average is a guaranteed deadline or waiting period
• Relying on a tax software company's status page instead of the IRS or financial institution
• Sending duplicate forms without tracking the first submission
• Disputing an authorized purchase as fraud instead of describing the actual billing problem

If you noticed a bank, debit, ACH, or credit card transaction today, report it to the financial institution before waiting on an FTC or IRS response. Then follow the IRS notice or filing instructions that apply to the tax issue, and save confirmation of every submission. For additional background, USAGov's identity-theft guidance provides general U.S. recovery steps.