CP01A: What the IP PIN Notice Actually Means

What the notice actually says

CP01A tells the taxpayer the IRS has assigned them an Identity Protection PIN (IP PIN) — a six-digit number, printed on the notice itself, good only for the calendar year it was issued — and explains how to use it. On an e-filed return, you enter the IP PIN wherever the tax software prompts for it on Form 1040, 1040-SR, 1040-NR, or 1040-SS; on a paper return, it goes in the box marked "Identity Protection PIN" next to the signature line. The IRS says every taxpayer who receives an IP PIN must enter it on the return, and that includes a spouse and a dependent. A dependent's IP PIN also goes on Form 2441 and Schedule EIC (see the IRS's Understanding your CP01A notice).

Because the IRS reissues a new PIN every year, the number on this year's CP01A supersedes whatever the taxpayer used last season — a saved PIN from a prior return won't validate. The notice also flags that the IP PIN is good for federal returns only; a state-issued identity PIN, where one exists, is a completely separate number and process.

What actually triggered it

The Taxpayer Advocate Service is direct about the usual cause: the IRS assigns an IP PIN "because you have been the victim of tax-related identity theft." Once the IRS resolves that identity-theft case, it automatically enrolls the taxpayer in the IP PIN program going forward, and CP01A is simply that year's reissuance, mailed out from mid-December through early January (see Taxpayer Advocate Service — Notice CP01A).

That's a meaningfully different path than the one taxpayers take who ask for an IP PIN voluntarily, with no identity-theft history, as a proactive security measure. Those taxpayers enroll through their IRS Online Account and retrieve each year's PIN there directly rather than by mail — so a taxpayer who opted in online may never receive a CP01A at all (see IRS.gov — Get an Identity Protection PIN). Either way, the notice arriving is not itself news of a new problem — it's routine, and for a past identity-theft victim, expected every year the case stays enrolled.

Response deadline and what happens if you miss it

The IRS page for the CP01A notice states no response deadline. It tells you to enter the 6-digit IP PIN in the correct place on your federal tax return when you file that return, so your own filing deadline is the date that matters. Get it wrong or leave it off an e-filed return and the IRS will reject the return outright; leave it off a paper return and processing — including any refund — simply takes longer while the IRS works around the missing PIN.

If the taxpayer loses the physical notice before filing season, that isn't a crisis either: the taxpayer can retrieve the current IP PIN through their IRS Online Account, or call the IRS to have it verified and a new one mailed to the address of record (see the IRS's IP PIN FAQ). Nothing about a missing CP01A blocks the return from eventually being filed correctly.

What to do next

Get the actual six-digit PIN from the client before e-filing — for the client, and separately for a spouse or any dependent who has their own IP PIN, whatever credit the return claims — and if the physical notice is gone, confirm the current number through the client's own IRS Online Account rather than taking a remembered or guessed number at face value. A wrong PIN gets the e-file rejected, so you must correct the PIN, check it against the notice, and resend the return.

If anything about the client's situation suggests the underlying identity-theft case isn't actually closed — a client who mentions an issue still in progress, or a return that's come back flagged for reasons beyond a simple PIN mismatch — running the client’s full account transcript through the IRS Transcript Analyzer is a direct way to confirm what's actually on file before advising the client on what to do next. If a specific transcript line needs translating into plain English before that conversation happens, the Transcript Decoder covers individual transaction codes one at a time.

None of this is a reason to treat CP01A as low-stakes paperwork, either. A misplaced or ignored IP PIN is what turns a routine filing into a rejected e-file or a slow-walked paper return, so keep it with the client's tax records, not in the pile of mail you set aside until deadline week.

What people mistake CP01A for

People read CP01A as an alarm, but it is not one, and that confusion cuts both ways against notices that actually do require action. The CP5071 series — CP5071, 5071C, and CP5071F — is the notice that means something is live: the IRS has a return it can't yet confirm is genuinely the taxpayer's, and processing is on hold until the taxpayer verifies their identity, either online or by phone, following the notice's instructions (see IRS.gov — Understanding your CP5071, CP5071C or CP5071F notice). A client told to treat that notice the way they'd treat CP01A — file the PIN, move on — ends up with a return that never clears the identity check at all.

People also confuse CP01A with CP01E, which is not routine: CP01E means someone used the taxpayer's Social Security number on a Form W-2 that wasn't theirs, and it asks the taxpayer to actively respond — checking Social Security Administration earnings records, watching credit reports, placing a fraud alert, and considering an IP PIN if they don't already have one (see IRS.gov — Understanding your CP01E notice). CP01A, by contrast, tells a client the IRS specifically does not want a new Form 14039 Identity Theft Affidavit filed over it, unless a fresh identity-theft incident happens after the notice arrives — the opposite instinct from what a client who's alarmed by any IRS mail tends to reach for. Sorting out which of these three a client actually has in hand — and where it fits among the IRS's other notices — is what keeps a routine annual mailing from turning into either a missed real problem or an unnecessary one.

Common Questions