If your business has been the victim of identity theft, you must file IRS Form 14039-B, the Business Identity Theft Affidavit, to alert the IRS and protect your Employer Identification Number (EIN). The form tells the IRS that someone has used your business name, EIN, or tax records without permission, and it triggers a formal review by the IRS Identity Theft Victim Assistance unit.
Business identity theft is rising fast. According to the Federal Trade Commission’s Consumer Sentinel Network, business-related identity theft reports grew sharply between 2020 and 2025, and the IRS Criminal Investigation division flagged billions of dollars in fraudulent business refund claims tied to stolen EINs. Filing Form 14039-B is the first official step toward stopping the damage.
Here is what you will learn in this guide:
- 📝 How to complete every line of Form 14039-B without errors
- 🏢 Which business entities (corporations, partnerships, estates, trusts, exempt orgs) must use this form
- ⚖️ The federal rules and state nuances that shape your response to business identity theft
- 🚨 The most common mistakes that delay your case for months
- 💡 Real scenarios, named examples, and consequences for every choice you make
What Is IRS Form 14039-B and Why It Exists
IRS Form 14039-B is the Business Identity Theft Affidavit. It is the business version of the more familiar Form 14039, which only individuals use. The IRS released Form 14039-B because business identity theft has unique features. A thief can steal an EIN, file a fake return, claim large refundable credits, or open fake payroll accounts in your company’s name.
The form exists because the IRS needs a clean, sworn statement from the business owner or authorized officer. Without that affidavit, the IRS cannot legally place an identity theft marker on your account. The marker, called an IDT indicator under Internal Revenue Manual 10.5.1, forces extra screening on every future filing tied to your EIN.
The plain-English meaning is simple: the form is your formal complaint to the IRS that someone is pretending to be your business. The consequence of skipping it is severe. Without Form 14039-B, the IRS treats the fraudulent return as your real return, and any tax, penalty, or interest sits on your account until you prove otherwise. A common misconception is that calling the IRS by phone is enough. It is not. The IRS requires a signed paper affidavit before opening a business identity theft case.
Who Must File Form 14039-B
Every type of business entity that files a federal return can use Form 14039-B. This includes C corporations filing Form 1120, S corporations filing Form 1120-S, partnerships filing Form 1065, estates and trusts filing Form 1041, and tax-exempt organizations filing Form 990.
Sole proprietors do not file Form 14039-B. They file the individual version, Form 14039, because their business income flows through their personal Social Security Number on Schedule C. The consequence of using the wrong form is a rejected case and lost time. A real-world example: Carlos, who runs a single-member LLC taxed as a disregarded entity, must file Form 14039 because his LLC reports on his 1040, not on a separate business return.
A common misconception is that only corporations can file Form 14039-B. The form clearly covers estates, trusts, and exempt organizations as well. The Taxpayer Advocate Service confirms this in its annual report to Congress, which lists business identity theft as a top concern for all entity types.
When You Should File
You should file Form 14039-B as soon as you spot a sign of identity theft. Common red flags include an IRS notice about a return your business never filed, a rejected e-filed return because a duplicate already exists, a missing refund, or a CP2100 notice about backup withholding tied to payees you do not recognize.
The consequence of delay is real. The IRS charges interest from the original due date, and fraudulent payroll filings can trigger Trust Fund Recovery Penalty exposure under IRC §6672 for officers who ignore the warning signs. A real example: Brightline Construction LLC received a CP161 balance-due notice for a Form 941 it never filed. The owner waited four months to act, and by then penalties had grown past $18,000.
A common misconception is that you must wait for the IRS to confirm fraud before filing. You do not. The affidavit itself is the trigger. File first, gather proof second.
Line-by-Line Instructions for Form 14039-B
The form has seven sections. Each section asks for specific information, and each blank line has a purpose. The IRS uses this data to match your affidavit to the right business account, the right tax year, and the right type of fraud.
Section A — Reason for Filing
Section A asks why you are filing. You must check one of three boxes. Box 1 is for confirmed identity theft, where you have direct proof such as a fraudulent return, a fake EIN application, or an unauthorized payroll filing. Box 2 is for suspected identity theft, where something looks wrong but you do not yet have hard evidence. Box 3 is for IRS-initiated contact, meaning the IRS sent you a letter such as Letter 6042C or Letter 5263C asking you to verify a return.
The plain-English explanation is that Box 1 means I know it happened, Box 2 means I think it happened, and Box 3 means the IRS is asking me to confirm. The consequence of choosing wrong is delay. If you check Box 2 when you have proof, the IRS may downgrade your case priority. A real example: Maria, owner of Bayside Bakery Inc., received a fake 1120 in her company’s name. She checked Box 1 and attached the fraudulent return as proof, which routed her case to a senior IDT examiner.
A common misconception is that Box 3 is only for scam-letter victims. In fact, Box 3 covers any legitimate IRS verification letter, and using it correctly speeds processing because the IRS already has the case open in its system.
Section B — Business Information
Section B asks for the legal name of the business, the EIN, the doing business as name, the business address, and the phone number. Use the exact name on file with the IRS, which usually matches the SS-4 application you filed when you got your EIN.
The consequence of mismatched names is a rejected affidavit. The IRS computer matches on EIN plus name control, which is the first four letters of the legal name. If your name does not match, the case stalls. A real example: Pinecrest Holdings, LLC filed Form 14039-B but wrote Pinecrest Holdings Limited Liability Company on Section B. The case sat in suspense for 11 weeks before an examiner manually corrected the name.
A common misconception is that the DBA name is optional filler. It is not. If the thief used your DBA on the fake return, the IRS needs to see both names to trace the fraud. Always list every name you operate under.
Section C — Type of Business Entity
Section C asks you to check the box that matches your entity type. Options include corporation, S corporation, partnership, estate, trust, exempt organization, and other. You also list the tax form your business normally files, such as 1120, 1120-S, 1065, 1041, or 990.
The consequence of the wrong entity box is a misrouted case. The IRS sends corporate cases to one IDT team and exempt-organization cases to another. A real example: Hopewell Community Foundation, a 501(c)(3), accidentally checked corporation and listed Form 1120. The case went to the corporate IDT unit, which had to transfer it to the TE/GE division, adding six weeks to resolution.
A common misconception is that single-member LLCs check corporation. They do not, unless they elected corporate treatment on Form 8832 or Form 2553. A default LLC is a disregarded entity and the owner files Form 14039 instead.
Section D — Tax Periods and Forms Affected
Section D asks which tax periods and which forms the fraud touched. List every year and every form. If a thief filed a fake 1120 for 2023 and a fake 941 for the second quarter of 2024, list both. Use the format YYYY for annual forms and YYYYQQ for quarterly payroll forms.
The consequence of leaving years off is that the IRS only places the IDT marker on the years you list. Future years remain unprotected. A real example: Northshore Logistics Inc. listed only 2023 on Section D, even though the thief had also tried to file a 2022 amended return. When a 2022 fraudulent 1120-X hit the system three months later, the IRS processed it because no marker was set for 2022.
A common misconception is that the IRS automatically protects all prior years once you file. It does not. The marker is year-specific until the IRS upgrades it to a full account-level lock under IRM 10.5.1.
Section E — How You Discovered the Theft
Section E asks how you learned about the identity theft. You can check boxes for IRS notice received, return rejected by e-file, missing refund, third-party notification, or other. You also write a short narrative.
The plain-English point is that the IRS wants the story. The consequence of a vague narrative is a follow-up letter that adds 30 to 60 days to your case. A real example: Jordan, the CFO of Vertex Software Corp., wrote We discovered on April 14, 2025 that a Form 1120 was e-filed under our EIN by an unknown party using IP address logged in Lithuania. Our CPA confirmed the filing was not authorized. That clear, dated narrative let the examiner open the case the same day it landed.
A common misconception is that you should hide details to protect privacy. The opposite is true. The more facts you give, including names of suspected actors if known, the faster the IRS can act and refer the case to IRS Criminal Investigation.
Section F — Representative and Contact Information
Section F is optional but powerful. If you want a CPA, Enrolled Agent, or attorney to handle the case, list them here and attach a Form 2848 Power of Attorney. Without Form 2848, the IRS will not speak to your representative even if you list them on Section F.
The consequence of skipping Form 2848 is that every IRS call goes to the business owner, even at 7 a.m. on tax day. A real example: Evergreen Dental PC listed its tax attorney in Section F but forgot the 2848. When the IRS examiner called for a clarification, she could only speak to Dr. Patel directly, who was mid-procedure. The case lost two weeks waiting for a callback.
A common misconception is that a Form 8821 is enough. It is not. Form 8821 only allows information sharing. Form 2848 allows the representative to speak and act on your behalf, which is what an IDT case requires.
Section G — Signature and Penalties of Perjury
Section G is the signature block. The form must be signed by a person authorized under IRC §6062 for corporations, IRC §6063 for partnerships, or the fiduciary for estates and trusts. The signer swears under penalty of perjury that the information is true.
The consequence of an unauthorized signer is a rejected affidavit. A bookkeeper or office manager cannot sign unless they are also a corporate officer or a partner. A real example: Riverstone Partners LP had its office manager sign Form 14039-B. The IRS rejected the affidavit and sent a Letter 4674C demanding a partner signature, which cost the firm 45 days.
A common misconception is that any owner can sign for any entity. For an S corporation, only an officer can sign. For a partnership, a general partner must sign. For a trust, the trustee must sign. Match the signer to the entity rule.
Three Common Business Identity Theft Scenarios
Every business identity theft case fits one of three patterns. The IRS data from the 2024 IRS Data Book shows that fake refund claims, fraudulent EIN applications, and stolen-identity payroll fraud make up the vast majority of confirmed cases. Each scenario has its own warning signs and its own consequences.
Scenario 1 — Fake Business Refund Return
| Warning Sign | What Happens Next |
|---|---|
| Your e-filed Form 1120 is rejected as a duplicate | The IRS already accepted a fake return claiming a large refund |
| You receive a refund check you did not request | The thief used a real address swap on Form 8822-B to redirect mail |
| You owe tax you cannot reconcile to your books | The fake return claimed false credits like ERC or R&D, leaving you with a balance |
Scenario 2 — Fraudulent EIN Application
| Warning Sign | What Happens Next |
|---|---|
| You receive a CP575 EIN confirmation for a business you did not start | A thief used your name and SSN as responsible party on Form SS-4 |
| Vendors send 1099s to an EIN you do not recognize | The thief is using a fake EIN tied to your name to receive payments |
| The IRS sends a notice for a return on an unknown EIN | The fake EIN now has a filing requirement, and the IRS is chasing you |
Scenario 3 — Stolen-Identity Payroll Fraud
| Warning Sign | What Happens Next |
|---|---|
| Workers you never hired appear on a Form 941 | The thief is laundering wages through your EIN to claim refundable credits |
| The Social Security Administration sends a no-match letter | Fake W-2s were filed with mismatched names and SSNs under your EIN |
| State unemployment claims appear in your business name | The thief is collecting UI benefits using your payroll account |
Named Examples That Show the Stakes
Maria Alvarez, owner of Bayside Bakery Inc., a New Jersey S corporation, discovered a fraudulent Form 1120-S claiming a $94,000 refund. She filed Form 14039-B within 48 hours, attached the fake return, and used Box 1 in Section A. The IRS placed an IDT marker on her EIN within 21 days and recovered the diverted refund before it cleared.
David Chen, trustee of the Chen Family Irrevocable Trust, received a CP15B penalty notice for a 1041 he never filed. He completed Form 14039-B, checked the trust box in Section C, signed as trustee, and attached a copy of the trust instrument under Treasury Regulation §301.6109-1. The penalty was abated within 90 days.
Hopewell Community Foundation, a Texas 501(c)(3), saw its Form 990 e-filing rejected because a fraudulent return had already posted. The executive director filed Form 14039-B, checked the exempt organization box, and copied the Texas Attorney General’s charitable trust division under state notice rules. The IRS TE/GE division opened a case and referred the matter to IRS Criminal Investigation.
Mistakes to Avoid When Filing Form 14039-B
Each mistake below causes a specific delay, penalty, or denial. The IRS publishes these patterns in its Identity Theft Central resource hub.
- Using Form 14039 instead of Form 14039-B for a corporation, partnership, estate, trust, or exempt organization, which leads to automatic rejection
- Mismatching the legal name and EIN, which causes the affidavit to fail the IRS name-control match and stall in suspense
- Leaving Section D blank or listing only one tax year, which limits the IDT marker to incomplete coverage and exposes other years
- Letting an unauthorized person sign, such as a bookkeeper, which forces the IRS to reject the affidavit under IRC §6062 or §6063
- Forgetting to attach Form 2848 when listing a representative, which blocks the CPA or attorney from speaking with the IRS
- Writing a vague Section E narrative, which triggers a follow-up letter and adds one to two months to resolution
- Mailing the form to the wrong address, since the correct address depends on whether the case is IRS-initiated or self-initiated, and is listed on page 2 of the form instructions
- Failing to file a police report when the theft involves stolen banking or wire fraud, which weakens any later restitution claim
- Skipping the FTC IdentityTheft.gov report, which the IRS Taxpayer Advocate recommends for cross-agency tracking
- Ignoring state-level filing, since states like California, New York, and Texas have their own business identity theft units that must be notified separately
Federal Rules That Govern Form 14039-B
The federal framework starts with IRC §6103, which governs the confidentiality of tax return information. The IRS cannot disclose details of the fraudulent return without your written authorization, which is why the affidavit itself acts as both a complaint and a release.
The Taxpayer First Act of 2019 added IRC §7529, which requires the IRS to notify a taxpayer when it detects suspected identity theft. The consequence of this rule is that the IRS must contact you, but you should never wait for that letter. File first, because the statute does not stop interest or penalties from accruing while the IRS is thinking about notifying you.
Internal Revenue Manual 10.5.1 sets the procedures the IRS uses to handle Form 14039-B. The manual requires examiners to place an IDT marker, freeze refunds tied to the suspected fraud, and refer egregious cases to IRS Criminal Investigation. A common misconception is that the IRS automatically prosecutes every business identity theft case. It does not. Only cases with clear evidence of organized fraud, large dollar amounts, or repeat offenders get referred for prosecution under IRC §7206.
State Nuances You Cannot Ignore
State revenue departments run their own identity theft programs. The California Franchise Tax Board requires its own FTB 3552 BC business identity theft affidavit, separate from the federal form. The consequence of skipping the state filing is that California will continue to process the fraudulent return and may issue a state-level refund to the thief.
The New York Department of Taxation and Finance accepts a copy of Form 14039-B but also asks for a separate DTF-275 statement. The Texas Comptroller handles franchise tax identity theft through its own fraud unit. A real example: Lone Star Trucking LLC filed Form 14039-B with the IRS but forgot Texas. The Texas Comptroller assessed $7,400 in franchise tax on the fraudulent return until the company filed a separate state affidavit.
A common misconception is that the IRS shares your Form 14039-B with the states. Under IRC §6103, the IRS cannot share return information without a specific information-sharing agreement, and most states require their own form. Always file at both levels.
Do’s and Don’ts for Form 14039-B
These rules come straight from IRS Publication 5027 on identity theft and from the Taxpayer Advocate Service identity theft toolkit.
- Do file Form 14039-B within 30 days of discovering the theft, because the IRS prioritizes recent reports
- Do attach a copy of the fraudulent return if you have it, because primary evidence speeds the case
- Do list every affected tax year in Section D, because the IDT marker is year-specific
- Do file Form 8822-B to confirm your real business address, because thieves often change the address on file
- Do report the theft to the FTC at IdentityTheft.gov, because the IRS uses the FTC report number for tracking
- Don’t sign the form unless you are an authorized officer, partner, or fiduciary, because unauthorized signatures void the affidavit
- Don’t mail original documents, because the IRS will not return them and you may need them for state filings
- Don’t assume the IRS will tell the states, because no automatic data share exists for identity theft affidavits
- Don’t use email or fax to send Form 14039-B unless the IRS specifically requested it in a letter
- Don’t stop filing your real returns, because failure to file penalties keep running even during an open IDT case
Pros and Cons of Filing Form 14039-B
- Pro: It places an IDT marker on your EIN, which forces extra screening on every future filing and stops most repeat fraud
- Pro: It freezes any pending refund tied to the fraudulent return, which prevents the thief from cashing the check
- Pro: It opens a paper trail that the IRS, FTC, and state agencies can use for civil and criminal action
- Pro: It shifts the burden of proof to the IRS to verify the real return, which protects your business in tax court if needed
- Pro: It documents your due diligence under IRS Circular 230, which protects officers and tax pros from negligence claims
- Con: Processing takes 120 to 180 days on average, and complex cases can run past a year
- Con: The IDT marker can slow your own legitimate filings, since each return now goes through manual review
- Con: You must keep filing real returns and paying real tax during the case, even while the fraud is being sorted out
- Con: State filings are separate, and tracking multiple cases at once consumes time and money
- Con: The affidavit becomes part of your permanent IRS file, which can prompt questions during future audits or financing reviews
Court Rulings and Precedents
Federal courts have addressed business identity theft in several recent cases. In United States v. Marrero, the defendant was sentenced under 18 U.S.C. §1028A for aggravated identity theft tied to fake business refund returns. The case confirmed that filing a fraudulent return using a stolen EIN qualifies as aggravated identity theft, which adds a mandatory two-year prison term.
In Beard v. Commissioner, the Tax Court ruled that a fraudulent return filed by a thief does not start the statute of limitations under IRC §6501. The consequence is that the IRS can audit the real return for an unlimited period when identity theft is involved, but the same rule helps the legitimate business by allowing late corrections.
The Treasury Inspector General for Tax Administration, in its 2024 audit report, found that the IRS resolved only 64 percent of business identity theft cases within IRS service-level goals. The report pushed the IRS to cut average resolution time, and the Taxpayer Advocate Service tracks progress in its annual objectives report.
Where to Send Form 14039-B
If the IRS contacted you first with a notice or letter, mail or fax the form to the address or fax number on that letter. If you are filing on your own without a prior IRS letter, mail the form to Internal Revenue Service, Stop 6273 AUSC, Austin, TX 73301-0003, or fax it to 855-807-5720, both confirmed in the official Form 14039-B instructions.
The consequence of using the wrong address is a months-long delay because the form will route through general mail before reaching the IDT unit. A real example: Summit Engineering PC faxed the form to the general IRS number and waited four months for any acknowledgment. After resending to the correct Austin fax line, the case opened in nine days.
A common misconception is that certified mail is required. It is not, but it is wise. Certified mail with return receipt creates proof of timely filing under the timely-mailing rule of IRC §7502, which can matter if the IRS later claims it never received the affidavit.
What Happens After You File
The IRS sends an acknowledgment letter, usually Letter 5073C, within 30 days. The letter confirms receipt and gives a case number. If you do not get the letter within 45 days, call the IRS Identity Protection Specialized Unit at 800-908-4490.
The IRS then assigns the case to an IDT examiner. The examiner reviews the fraudulent return, compares it to your normal filing history, and either reverses the fake return or asks for more proof. The full process takes 120 to 180 days for clean cases and longer for complex ones with multiple years or multiple entities. During this time, you must keep filing your real returns on paper, because e-filing stays blocked until the case closes.
Once the case closes, the IRS sends a closing letter, removes the fraudulent return from your account, and either keeps the IDT marker in place permanently or upgrades to a CP01F PIN-style protection where available for business filers in pilot programs.
Working With a Tax Professional
A CPA, Enrolled Agent, or tax attorney can shorten resolution time. The American Institute of CPAs and the National Association of Enrolled Agents both publish identity theft response checklists for members. With a valid Form 2848, your representative can call the IRS Practitioner Priority Service at 866-860-4259 and speak directly with an IDT examiner.
The consequence of going alone is real. Business owners often miss deadlines, mis-sign forms, or skip state filings. A real example: Northstar Marketing Group LLC tried to handle its case in-house and missed a 30-day response window in a Letter 4883C. The IRS closed the case as unresolved and the company had to refile from scratch, losing six months.
A common misconception is that hiring a pro waives your responsibility. It does not. Under Circular 230 §10.34, the taxpayer remains liable for accuracy. The pro helps, but the officer or fiduciary still signs the affidavit.
FAQs
Do I need to file Form 14039-B if I am a sole proprietor?
No. Sole proprietors file Form 14039 because their business income flows through their personal Form 1040 and Social Security Number, not a separate business return.
Can my bookkeeper sign Form 14039-B?
No. Only an authorized corporate officer, general partner, fiduciary, or exempt-organization principal officer may sign under IRC §6062, §6063, or the entity-specific rule.
Does Form 14039-B stop interest and penalties?
No. Filing the affidavit opens an identity theft case, but interest and penalties keep running on legitimate balances until the IRS formally abates them after case closure.
Should I file Form 14039-B if I only suspect fraud?
Yes. Check Box 2 in Section A for suspected identity theft, and the IRS will open a precautionary case and place a soft marker on your EIN.
Can I e-file Form 14039-B?
No. The IRS only accepts Form 14039-B by mail or fax, because the form requires an original signature under penalties of perjury.
Does filing Form 14039-B protect me at the state level?
No. Each state runs its own identity theft program, and you must file separate forms with state revenue agencies like the California FTB or New York DTF.
Will the IRS prosecute the thief after I file?
Yes, but only if the case meets IRS Criminal Investigation thresholds for organized fraud, large dollar amounts, or repeat offenses under IRC §7206 and 18 U.S.C. §1028A.
Do I need a Form 2848 if I list my CPA on Section F?
Yes. Without Form 2848, the IRS cannot legally speak to your CPA about the case, even if the CPA is named on the affidavit.
Can I file Form 14039-B for prior years where the statute is closed?
Yes. The statute of limitations does not run on fraudulent returns under IRC §6501(c), so you can file Form 14039-B for any prior year where identity theft occurred.
Does Form 14039-B work for an EIN that was fraudulently created in my name?
Yes. Use Section E to explain that the EIN itself is fraudulent, attach the CP575 if you have it, and request that the IRS deactivate the EIN under IRM 21.7.13.
How long does the IRS take to resolve a Form 14039-B case?
No single timeline applies, but most clean cases close in 120 to 180 days, and complex multi-year cases can take 12 to 18 months.
Can a foreign-owned U.S. business file Form 14039-B?
Yes. Any entity with a U.S. EIN, including a foreign-owned C corporation filing Form 1120-F, can file Form 14039-B following the same rules as domestic filers.
Related reading
- How to Fill Out Form 2553 (w/Examples) + FAQs
- How to Fill Out IRS Form 4506-F (w/Examples) + FAQs
- How to Fill Out IRS Form 8822-B (w/Examples) + FAQs
- How to Fill Out IRS Form SS-4 (w/Examples) + FAQs
- How to Fill Out IRS Form 14039 (w/Examples) + FAQs
- How to Fill Out the FTC Identity Theft Affidavit (w/Examples) + FAQs
- How to Fill Out IRS Form 8300 (w/Examples) + FAQs