A Business Return Is Rejected as Already Filed: Check for Identity Theft

A duplicate-return rejection is a signal to investigate

A business tries to file its return and receives a rejection indicating that a return already exists for that period. The explanation might be a legitimate filing by another authorized preparer, a software submission issue, or suspected identity theft. Confirm the entity name, EIN, form, tax period, and prior filing acknowledgments with the people actually authorized to file. Do not assume the newest preparer has the complete submission history.

If legitimate duplication does not explain the problem, involve the tax professional promptly. IRS guidance identifies a rejection because a return is already on file, a notice about an unfiled return, or unexpected W-2 reporting as possible reasons to submit Form 14039-B, the Business Identity Theft Affidavit. Use the business process and current instructions; an individual owner’s identity-theft form does not automatically resolve misuse of the company’s EIN.

Identify the tax impact separately from the technology incident

An email account compromise or stolen laptop can create a security incident without evidence that a fraudulent tax return has been filed. The IRS says not to submit Form 14039-B merely for a data breach with no tax-related business impact. That does not make the breach unimportant. It means the technology response and the tax identity-theft reporting decision have different triggers and evidence requirements.

For a hypothetical example, a company receives a notice describing payroll forms for a quarter when it had no employees. The owner should compare the notice with actual payroll history, provider filings, and the company’s filing obligations. Preserve the notice and relevant records rather than try to make the books match the unexplained IRS information. The objective is to determine whether the reported forms were authorized and accurate, not to normalize a suspicious balance.

Build a chronology showing when the first rejection or notice appeared, who investigated it, which legitimate filings were confirmed, and what remained unexplained. Keep the exact tax periods visible. An incident involving one year’s income-tax return does not establish that every employment-tax period is affected, while a second notice may reveal a broader problem that needs to be added to the investigation.

Prepare a complete affidavit and the required evidence

Form 14039-B requires identifying information, an explanation of the incident, signatures, and supporting documentation under its instructions. Have an authorized person and the advisor review the package for completeness. Missing requested documents or an unsigned form can delay processing. Use the response route indicated in applicable IRS instructions or correspondence; do not copy an address from an unrelated taxpayer’s case.

Keep sensitive business and personal information in controlled storage and transmit it through the authorized secure process. A public help forum, general shared spreadsheet, or unsolicited email link is not an appropriate place for the affidavit package. Verify communications independently where authenticity is uncertain. The owner should know who can access the case file and who is authorized to speak with the IRS.

Continue legitimate compliance while resolving the incident

Ask the preparer how to meet the company’s actual filing and payment obligations when electronic submission is blocked. A rejected return is not the same as an accepted filing, and an identity-theft report does not by itself confirm that required tax was paid. Preserve submission attempts, instructions received, mailing evidence where relevant, and payments applied to the proper entity and period.

Review access to payroll, tax software, email, and business financial accounts with the appropriate professionals. Remove access that is no longer authorized through the normal security process and protect legitimate credentials. Inform the payroll provider or other relevant filing service if its records may be involved. Coordinate these steps without casually circulating the company’s full tax identity or banking details to everyone involved in operations.

Track each IRS notice and follow-up date until the tax records and legitimate filings are reconciled. If the owner receives an EIN that was never requested, first rule out an authorized request by an accountant, partner, family member, or other legitimate representative, then follow the IRS process for an unrequested EIN if needed. This guide supports a structured response; it does not diagnose identity theft from a single rejection message or guarantee a resolution date.