Most IRS notices arrive with bad news. The CP301 is different — in most cases it’s simply a confirmation that someone set up an IRS online account using your information.
But that one phrase — someone — is exactly why this notice deserves your full attention.
If that someone was you, you can set this letter aside in thirty seconds. If it wasn’t, you may be looking at the early warning sign of tax-related identity theft, and how quickly you respond matters significantly.
What CP301 means
CP301 is a confirmation notice the IRS sends whenever a new online account is registered using a taxpayer’s Social Security number and personal information. The IRS online account system — accessed at irs.gov — allows taxpayers to view balances, download transcripts, set up payment plans, and manage their federal tax account directly.
Because this system contains sensitive financial information, the IRS sends a CP301 to the address on file every time a new registration occurs. It’s a security notification, not a compliance issue. The notice itself doesn’t indicate any problem with your tax return, your balance, or your filing history.
The entire purpose of the CP301 is to make sure the person whose information was used to create the account actually authorized it.
The two scenarios
You registered the account yourself. This is by far the most common situation. If you recently created or attempted to create an IRS online account, the CP301 is simply the IRS confirming that registration. No action is required. File the notice somewhere accessible in case you need to reference your account later, and move on.
You did not register the account. This is the scenario that requires immediate attention. If you received a CP301 and have no recollection of registering for an IRS online account — or if you know with certainty that you didn’t — someone else used your personal information to access or attempt to access your federal tax account. This is a form of identity theft, and it needs to be addressed before the situation escalates.
What to do if you didn’t register
The speed of your response matters here. Tax-related identity theft tends to escalate quickly once someone has access to your IRS account — from viewing your transcripts and filing history to potentially filing a fraudulent return in your name to claim a refund.
Your first call should be to the IRS Identity Protection Specialized Unit at 1-800-908-4490. This unit handles identity theft cases specifically and can flag your account for additional verification requirements, making it significantly harder for someone else to file on your behalf or make changes to your account.
At the same time, place a fraud alert on your credit report by contacting one of the three major credit bureaus — Equifax, Experian, or TransUnion. A fraud alert requires businesses to verify your identity before opening new accounts in your name. A credit freeze goes further and blocks new credit applications entirely until you lift it.
File IRS Form 14039 — the Identity Theft Affidavit — as soon as possible. This formally notifies the IRS that your information has been compromised and triggers additional protections on your account, including an Identity Protection PIN for future filings. An IP PIN is a six-digit number that must be included on your return each year and prevents anyone else from filing a return using your Social Security number.
Consider also checking whether a fraudulent return has already been filed for the current tax year. If you attempt to file electronically and the IRS rejects your return because one has already been filed under your Social Security number, that’s a strong signal that someone beat you to it. In that case you’ll need to file a paper return with Form 14039 attached.
Why tax identity theft is more disruptive than most people expect
Tax-related identity theft doesn’t just mean someone filed a return in your name. It can delay your legitimate refund for months while the IRS investigates. It can create discrepancies in your account that take multiple filing seasons to fully resolve. And because the IRS verification process is thorough by design, the resolution timeline is often longer than people expect — sometimes a year or more for complex cases.
Acting quickly when you receive a CP301 you didn’t initiate is the single most effective thing you can do to limit the damage. The earlier the IRS flags your account, the harder it becomes for someone else to use your information successfully.
Frequently asked questions
I registered for an IRS account a few weeks ago — is this notice about that? Almost certainly yes. The CP301 is sent after every new registration. If you recently created an account, this notice is simply the confirmation. No action needed.
What if I’m not sure whether I registered or not? Try logging into irs.gov with the credentials you would have used. If you can access your account and the information looks correct, the registration was likely yours. If you can’t access the account or don’t recognize the registration, treat it as unauthorized and contact the IRS Identity Protection line.
How long does it take the IRS to resolve an identity theft case? The IRS has significantly improved its identity theft resolution timelines in recent years, but cases can still take several months to over a year depending on complexity. Filing Form 14039 promptly and requesting an IP PIN are the most effective steps you can take to protect yourself going forward.
Will my tax refund be delayed because of this? If the CP301 was the result of your own registration, no. If it indicates unauthorized access and you file Form 14039, your return will be subject to additional verification which can delay processing. The delay is a consequence of the protection, not an additional problem.
What is an Identity Protection PIN? An IP PIN is a six-digit number issued by the IRS that must be included on your federal tax return each year. It prevents anyone else from filing a return using your Social Security number without it. Once you have one, it renews annually. Any taxpayer can now request an IP PIN voluntarily — you don’t need to be an identity theft victim to get one.
Should I also report this to local police? If you believe your identity has been stolen, filing a report with your local police department creates an official record that can be useful when disputing fraudulent accounts or working with creditors. It’s not required for the IRS process, but it can be helpful documentation.