Small business tax identity theft happens when thieves use a company’s EIN, an owner’s SSN, or payroll data to file fraudulent returns, fake W-2s, or claim refunds. Warning signs include rejected e-filed returns, unexpected IRS notices, and missing IRS mail. When those red flags appear, the IRS directs businesses to file Form 14039-B and tighten data security immediately.
By Adham Abadier, CPA — Licensed in California, License #158599
⚠️ Q3 Form 941 — date reminder
Employers’ third-quarter payroll return (Form 941) is due Monday, November 2, 2026, because October 31 falls on a Saturday. Guard the EIN and payroll records you file it with — payroll data is a known target of business tax fraud schemes.
In September 2026, the IRS and its Security Summit partners urged tax professionals and taxpayers to strengthen defenses against tax-related identity theft (IR-2026-106). The IRS is blunt about the stakes: identity theft is a serious threat to business, partnership, estate, and trust filers, and thieves may steal sensitive information to file a fraudulent return for a refund or to commit other crimes. For the sole proprietorships, LLCs, and corporations we work with in Moreno Valley, Riverside, and across the Inland Empire, the response has two halves — knowing the warning signs and moving fast when one appears. If a suspicious notice has already arrived, our small business tax services team handles IRS notice response directly.
Key Takeaways
- The IRS treats rejected e-filed returns, extension requests rejected for a duplicate EIN or SSN, unexpected transcripts or notices, IRS Letters 6042C or 5263C, and missing IRS mail as warning signs of business identity theft.
- File Form 14039-B, the Business Identity Theft Affidavit, if you receive a notice about a return your business didn’t file, a W-2 filed with the Social Security Administration that you didn’t file, a rejected e-filed return for that period, or a balance due you don’t owe.
- Letter 6042C means the IRS needs information to validate a return; Letter 5263C means it needs information to validate the entity — respond immediately to either.
- The IRS never initiates contact by email, text, or social media to request personal or financial information, never calls with threats of lawsuits or arrests, and never requests Identity Protection PINs by phone, email, or text.
- Layered prevention works: automatic-update security software, firewalls, multi-factor authentication, encryption, offline backups, employee phishing training, and current EIN responsible-party information via Form 8822-B.
Warning Signs: Has Your Business’s Tax Identity Been Compromised?
This crime often stays quiet until filing time. The FTC notes that you may not find out it has happened until you try to file your real tax return and the IRS rejects it as a duplicate filing. The IRS tells business filers to be alert if:
- You can’t e-file a return because one was already filed with the same EIN or SSN.
- You receive a rejection notice for a routine extension-to-file request because a return with a duplicate EIN or SSN is already on file.
- You get an unexpected tax transcript or IRS notice that doesn’t match anything your business submitted.
- You receive a Letter 6042C or 5263C.
- Expected or routine IRS correspondence stops arriving because the business address on file was changed.
How thieves get in matters just as much. Schemes targeting businesses commonly involve filing fraudulent tax returns using a company EIN, impersonating executives to obtain employee W-2 data, sending fake IRS correspondence, and hacking payroll or accounting systems — and sole proprietorships, partnerships, corporations, and LLCs are all targeted (Thomas Howell Ferguson). The IRS maintains a dedicated channel for reporting a Form W-2 email scam involving employee data, a reminder of how often the attack starts in an ordinary-looking inbox.
Why the IRS Sends Letters 6042C and 5263C
A validation letter doesn’t automatically mean money is gone — it can mean an IRS safeguard worked. The IRS, state tax agencies, and the tax industry operate together as the Security Summit, and their program includes safeguards that identify suspicious returns. When a business-related return looks potentially fraudulent, the IRS sends a letter seeking additional information before processing it:
| IRS Letter | What it signals | What the IRS needs |
|---|---|---|
| Letter 6042C | A business-related return was flagged as potentially fraudulent | Information to validate the return |
| Letter 5263C | The entity itself needs confirmation before processing | Information to validate the entity |
If one of these letters arrives, the IRS asks you to respond immediately. Expect authentication questions too: the IRS asks tax professionals preparing business-related returns a series of questions to help validate the return, and business tax-preparation software asks them as well.
The shape of legitimate IRS contact also helps you spot fakes. The IRS states that it will never initiate contact with taxpayers by email, text, or social media to request personal or financial information, will never call with threats of lawsuits or arrests, and will never call, email, or text to request Identity Protection PINs. Anything following that script is an imposter — the FTC describes IRS impersonators demanding immediate payment, often by gift card or prepaid debit card, a pattern that should end the conversation on the spot.
Just received IRS Letter 6042C, 5263C, or a rejection for a return you never filed? The IRS asks business filers to respond immediately to correspondence, and improvising under pressure leads to mistakes. Adham Abadier, CPA, reviews suspicious notices and the right response steps with Inland Empire business owners — bring your letter to a free call.
📞 (951) 223-1826 | Book a free 30-min diagnostic →
How to Report Small Business Tax Identity Theft to the IRS
The IRS and its Security Summit partners continue to see identity theft schemes targeting businesses, and the agency’s designated reporting tool is Form 14039-B, the Business Identity Theft Affidavit. File it if your business receives a notice about any of the following (IRS):
- A rejected e-filed return because a return is already on file for that same period.
- A tax return your business didn’t file.
- A Form W-2 filed with the Social Security Administration that your business didn’t file.
- A balance due that isn’t owed.
The IRS offers several other reporting channels depending on what happened: reporting suspected identity theft by submitting an affidavit, reporting through its business help line, reporting a suspected business data security breach, and reporting a Form W-2 email scam involving employee data.
If the entry point was email, forward any IRS-related phishing message to phishing@irs.gov. The IRS’s standing advice: never open or download attachments from unknown senders — even apparent new clients — and verify that a message is authentic by calling the sender directly. Responding also means knowing what your business actually filed; clean, current records are what let you answer that question fast, which is one reason our bookkeeping team keeps clients’ books reconciled month after month.
For fraud that touches an owner’s personal SSN, IdentityTheft.gov lets you report the theft to the IRS and FTC and generates a personal recovery plan, including filing the IRS Identity Theft Affidavit (Form 14039) online as a first step. And when notices start stacking up — validation letters, balances for returns you never filed — that is exactly where IRS problem resolution support earns its keep for Riverside County business owners.
Tax Identity Theft Prevention: What the IRS Tells Businesses to Do Now
Lock down the technical basics
The IRS’s baseline list for protecting business data: install anti-malware/anti-virus security software with automatic updates enabled on every device — laptops, desktops, routers, tablets, and phones; deploy firewall protections on your network; use multi-factor authentication when available; encrypt sensitive files and emails with strong password protection; and back up sensitive data to a secure, external source not connected to your network. Use responsible passwords: at least eight characters (longer is better), mixing special and alphanumeric characters — or use passphrases instead of passwords, a unique password for each account, and a password manager. Round it out by destroying old computer hard drives and printers that contain sensitive data, limiting access to personal data to only those who need to know, and entering personal data only on sites whose addresses begin with “https.”
Put a written data security plan in place
The IRS calls creating and maintaining a data security plan key. If you can afford one, hire a cybersecurity consultant; if not, build your plan from free authoritative materials — IRS Publication 4557, Safeguarding Taxpayer Data, the FTC’s Start with Security: A Guide for Business, and NIST’s Small Business Information Security – The Fundamentals. Publication 5293, the Data Security Resource Guide, consolidates the material, and Publication 5199 speaks directly to tax preparers.
Train employees — phishing is the most common tactic
The IRS identifies phishing emails as the most common tactic used to steal data. Train your team not to respond to suspicious or unknown emails, to email documents only when they are password-protected and encrypted, to keep separate personal and business email accounts, and to protect email accounts with strong passwords and two-factor authentication. The IRS also suggests sharing Publication 4524, Security Awareness for Taxpayers, with your people.
Keep your EIN current and safe
Every entity with an Employer Identification Number should keep the number safe and keep its application up to date with accurate responsible party and contact information, updated with Form 8822-B. If the IRS ever needs to validate your entity, current contact information is what makes that possible.
Shrink the window thieves use
The FTC’s prevention checklist applies to business filers too: file your return as early in the tax season as you can, use a secure internet connection when filing electronically or mail the return directly from the post office, research any tax preparer thoroughly before handing over personal information, and check your credit report at least once a year for free at annualcreditreport.com to confirm no one has opened a new account in your name.
Frequently Asked Questions
What is small business tax identity theft?
It’s fraud in which criminals use a company’s identifying information — its EIN, an owner’s SSN, or payroll records — to file false tax returns, file W-2s the business never filed, open fraudulent accounts, or commit other financial crimes. The IRS warns that identity theft is a serious threat to business, partnership, estate, and trust filers. Many victims discover it only when a legitimate filing is rejected as a duplicate.
When should my business file Form 14039-B?
File the Business Identity Theft Affidavit when your business receives an IRS notice about a rejected e-filed return because a return is already on file for that same period, a tax return your business didn’t file, a Form W-2 filed with the Social Security Administration that your business didn’t file, or a balance due that isn’t owed.
Why did my business receive IRS Letter 6042C or 5263C?
These letters mean the IRS’s safeguards flagged a business-related return as potentially fraudulent, and the agency needs more information before processing it. Letter 6042C requests information to validate the return; Letter 5263C requests information to validate the entity. The IRS asks recipients to respond immediately.
Does the IRS ever email, text, or call asking for our information?
No. The IRS states it never initiates contact by email, text, or social media to request personal or financial information, never calls with threats of lawsuits or arrests, and never calls, emails, or texts to request Identity Protection PINs. Forward any suspicious IRS-related email to phishing@irs.gov.
What if a scam exposes our employees’ W-2 data?
The IRS maintains a dedicated reporting channel for a Form W-2 email scam involving employee data — use it. Meanwhile, don’t open or download attachments from unknown senders, even apparent clients, and verify any request by calling the sender directly. Share documents only when they are password-protected and encrypted.
How do Moreno Valley and Inland Empire businesses get help?
Start by gathering every notice and filing record related to the suspect return, then respond to the IRS promptly — these cases compound when letters sit unanswered. A CPA can coordinate the affidavit, notice responses, and any amended filings alongside your normal compliance calendar. Catalyst CPA Corporation serves Moreno Valley, Riverside, Corona, Temecula, and the wider Inland Empire from its Moreno Valley office, with remote service nationwide.
FREE FOR INLAND EMPIRE BUSINESS OWNERS
Free 30-Min Tax Strategy Call
Bring any IRS letter, rejected e-filed return, or duplicate-filing notice to the call. Adham will help you determine whether it fits a Form 14039-B scenario, what the IRS needs to validate your return or entity, and which data-security upgrades the IRS recommends tackling first.
Protect Your Business’s Tax Identity Before Someone Else Uses It
Identity theft response touches real deadlines — including the Q3 Form 941 due November 2, 2026 — so it pays to work with someone who handles both the IRS correspondence and the underlying compliance. Catalyst CPA Corporation, led by Adham Abadier, CPA (California License #158599, QuickBooks Gold ProAdvisor, AICPA and CalCPA member), supports business owners in Moreno Valley, Riverside, Corona, Eastvale, Murrieta, Temecula, and throughout Southern California — and remotely nationwide. You can review our full CPA services or reach us directly.
Call (951) 223-1826 or email adham@catalyst-cpa.com. Office: 13114 Yellowwood St, Moreno Valley, CA 92553.
By Adham Abadier, CPA
California CPA License #158599 · QuickBooks Gold ProAdvisor
Adham Abadier leads Catalyst CPA Corporation from its Moreno Valley office, serving small businesses across the Inland Empire and remotely nationwide. His practice centers on small-business tax preparation, bookkeeping, and IRS notice response for owners throughout Riverside County and Southern California.
Contact: (951) 223-1826 · adham@catalyst-cpa.com
Disclaimer: This article is for general information only and does not constitute tax, legal, or accounting advice, nor does reading it create a CPA–client relationship. Tax matters are fact-specific; consult a licensed professional about your circumstances before acting. IRS forms, letters, and programs described here are as published by the IRS at the time of writing and may change.
Catalyst CPA Newsletter
Get 2026 tax-saving tips in your inbox
Real, CPA-written guidance for Inland Empire small businesses — bookkeeping, tax planning, IRS updates. No spam, unsubscribe anytime.
By subscribing you agree to receive emails from Catalyst CPA. We never share your email. Unsubscribe with one click anytime. Questions? Call (951) 223-1826.
