CP01A: What the IP PIN Notice Actually Means

What the notice actually says

CP01A tells the taxpayer the IRS has assigned them an Identity Protection PIN (IP PIN) — a six-digit number, printed on the notice itself, good only for the calendar year it was issued — and explains how to use it. On an e-filed return, the IP PIN gets entered wherever the tax software prompts for it on Form 1040, 1040-SR, 1040-NR, or 1040-SS; on a paper return, it goes in the box marked "Identity Protection PIN" next to the signature line. If a spouse or a dependent claimed for the Earned Income Credit or Child Tax Credit has also been separately assigned an IP PIN, that PIN has to be entered too, in its own designated spot (see the IRS's Understanding your CP01A notice).

Because the IRS reissues a new PIN every year, the number on this year's CP01A supersedes whatever the taxpayer used last season — a saved PIN from a prior return won't validate. The notice also flags that the IP PIN is good for federal returns only; a state-issued identity PIN, where one exists, is a completely separate number and process.

What actually triggered it

The Taxpayer Advocate Service is direct about the usual cause: the IRS assigns an IP PIN "because you have been the victim of tax-related identity theft." Once the IRS resolves that identity-theft case, it automatically enrolls the taxpayer in the IP PIN program going forward, and CP01A is simply that year's reissuance, mailed out from mid-December through early January (see Taxpayer Advocate Service — Notice CP01A).

That's a meaningfully different path than the one taxpayers take who ask for an IP PIN voluntarily, with no identity-theft history, as a proactive security measure. Those taxpayers enroll through their IRS Online Account and retrieve each year's PIN there directly rather than by mail — so a taxpayer who opted in online may never receive a CP01A at all (see IRS.gov — Get an Identity Protection PIN). Either way, the notice arriving is not itself news of a new problem — it's routine, and for a past identity-theft victim, expected every year the case stays enrolled.

Response deadline and what happens if you miss it

There is no response deadline on CP01A, and it requires no reply to the IRS at all — it isn't asking for anything back. The only deadline that actually matters is the taxpayer's own filing deadline, because the PIN has to be entered correctly on whatever return gets filed that year. Get it wrong or leave it off an e-filed return and the IRS will reject the return outright; leave it off a paper return and processing — including any refund — simply takes longer while the IRS works around the missing PIN.

If the physical notice gets lost before filing season, that isn't a crisis either: the taxpayer can retrieve the current IP PIN through their IRS Online Account, or call the IRS to have it verified and a new one mailed to the address of record (see the IRS's IP PIN FAQ). Nothing about a missing CP01A blocks the return from eventually being filed correctly.

The practitioner's actual next step

Get the actual six-digit PIN from the client before e-filing — for the client, and separately for a spouse or any EIC/Child Tax Credit dependent who has their own — and if the physical notice is gone, confirm the current number through the client's own IRS Online Account rather than taking a remembered or guessed number at face value. A wrong PIN doesn't just create extra work; it produces a hard e-file rejection that has to be corrected and resubmitted.

If anything about the client's situation suggests the underlying identity-theft case isn't actually closed — a client who mentions an issue still in progress, or a return that's come back flagged for reasons beyond a simple PIN mismatch — pulling the full account transcript with the IRS Transcript Analyzer is the fastest way to confirm what's actually on file before advising the client on what to do next. If a specific transcript line needs translating into plain English before that conversation happens, the Transcript Decoder covers individual transaction codes one at a time.

None of this is a reason to treat CP01A as low-stakes paperwork, either. A misplaced or ignored IP PIN is what turns a routine filing into a rejected e-file or a slow-walked paper return, so it belongs with the rest of the client's tax records, not in the pile of mail that gets set aside until deadline week.

What CP01A gets confused with — and why the distinction matters

CP01A gets read as an alarm when it isn't one, and that confusion cuts both ways against notices that actually do require action. The CP5071 series — CP5071, 5071C, and CP5071F — is the notice that means something is live: the IRS has a return it can't yet confirm is genuinely the taxpayer's, and processing is on hold until the taxpayer verifies their identity, either online or by phone, following the notice's instructions (see IRS.gov — Understanding your CP5071, CP5071C or CP5071F notice). A client told to treat that notice the way they'd treat CP01A — file the PIN, move on — ends up with a return that never clears the identity check at all.

CP01A also gets confused with CP01E, which is not routine: CP01E means someone used the taxpayer's Social Security number on a Form W-2 that wasn't theirs, and it asks the taxpayer to actively respond — checking Social Security Administration earnings records, watching credit reports, placing a fraud alert, and considering an IP PIN if they don't already have one (see IRS.gov — Understanding your CP01E notice). CP01A, by contrast, tells a client the IRS specifically does not want a new Form 14039 Identity Theft Affidavit filed over it, unless a fresh identity-theft incident happens after the notice arrives — the opposite instinct from what a client who's alarmed by any IRS mail tends to reach for. Sorting out which of these three a client actually has in hand — and where it fits among the IRS's other notices — is what keeps a routine annual mailing from turning into either a missed real problem or an unnecessary one.