CP01A Notice: What It Means & How to Respond

Every December and January, the IRS mails millions of CP01A letters, each carrying a freshly generated six-digit code to someone whose tax identity needs extra protection: confirmed identity-theft victims, people flagged as high-risk, and a growing crowd who opted in voluntarily. If you're holding one, somewhere along the line your Social Security number earned a lock, and this letter is the year's key. The system behind it is elegantly simple, no code, no accepted return, which makes the fraudster's stolen data worthless and makes your one obligation equally simple: have the code when filing time comes.

What is a CP01A notice?

A CP01A is the annual delivery letter for your Identity Protection PIN (IP PIN), a unique six-digit number that must be included on any Form 1040-series return (1040, 1040-SR, 1040-NR, 1040-SS) filed under your SSN or ITIN. The IRS generates a new PIN every year and mails the CP01A eachDecember or January, covering returns filed in the year ahead. Last year's code dies when the new one issues.

The mechanics of the protection: once your SSN is enrolled, the IRS's systems reject any e-filed return that arrives without the correct current PIN, and route PIN-less paper returns into extended screening. A criminal holding your name, SSN and W-2 data, the complete kit that once sufficed for refund fraud, now hits a wall, because the one thing they can't steal from a data breach is a code that changes annually and travels by postal mail to your address of record. The flip side: you need the code too, and forgetting it is the entire failure mode of this system.

Why you're receiving IP PINs

• Confirmed identity theft. The largest group: after a fraudulent return incident, often discovered through a 5071C or4883C verification, the IRS enrolls the account permanently, and the annual PIN letters follow for life.
• High-risk flagging. Data-breach exposure or other risk signals can put an account into the program protectively, sometimes before any fraud was attempted.
• Voluntary opt-in.Anyone can now request an IP PIN through the IRS's "Get an IP PIN" tool, a smart move after any personal-data compromise. Opt-ins receive the same annual CP01A cycle.
• Family enrollment. Spouses and dependents can hold their own IP PINs; each enrolled person gets their own letter, and each code must appear on the return where the form calls for it.

How to read your CP01A

Then file the letter somewhere deliberate, with your tax documents, in a password manager's secure notes, wherever your important papers actually live. The CP01A's whole lifecycle is: arrive in winter, be findable in spring.

Using the PIN at filing time

E-filing:your software prompts for the IP PIN during the identity section, where it travels alongside your SSN. Enter the current year's code exactly; a wrong or stale PIN means instant rejection, refiled only after correcting it. Paper filing: the box labeled "Identity Protection PIN"sits next to the signature line, six digits, in your handwriting, every enrolled person's code in its place.

Three edge cases catch people. Late and prior-year returns filed during this calendar year take the current PIN, not the code from the year the return covers.Preparersneed the PIN from you at signing time; it's the one number the organizer packet always forgets to ask for. And rejected e-files late on deadline day are the classic IP PIN emergency, which is why the retrieval path below is worth knowing before April.

Lost the letter? The recovery path

The CP01A's paper goes missing constantly, moves, purges, the fundamental incompatibility of January mail with April needs. Recovery is built in: sign in to your IRS online account, or use the "Get an Identity Protection PIN"tool on irs.gov, and after identity verification your current PIN displays on screen. It's the same code the letter carried, retrieval doesn't reset anything. This online route is the fast lane; mailed reissues are slow and effectively unavailable in the filing-season crunch, so setting up your online account now, while nothing is urgent, is the single best move this page can recommend.

If online verification defeats you (it happens, thin credit files, new phones), the IRS phone and in-person alternatives can eventually help, but they're measured in weeks. The online account is the insurance policy; buy it early.

Your options with a CP01A

The annual routine, step by step

1. Receive and record, December/January

   Letter arrives; code goes into your secure storage (paper file plus a password-manager note is the robust combination). Note whose PIN it is.

2. Confirm the household's full set

   Spouse and dependents enrolled? Each has their own letter and code. Collect them all in one place before filing season.

3. Hand the code to whoever files

   Your software's prompt, or your preparer's checklist, the PIN joins the return at the identity step. Current year's code, exactly as printed.

4. Recover online if the paper's gone

   IRS online account → Identity Protection PIN, or the Get an IP PIN tool. Same code, instantly displayed after verification.

5. Shred the old letter when the new one lands

   Each January's CP01A obsoletes the last. One current letter in the file beats an archive of dead codes waiting to be entered by mistake.

Common mistakes with a CP01A

• Tossing it as junk mail, a plain government envelope in January is easy to discard; the April consequence is a rejected return.
• Entering last year's PIN, the classic rejection cause; codes rotate annually and only the newest works.
• Not telling the preparer, returns bounce while the one missing number sits in your drawer; add the PIN to your annual document handoff.
• Sharing the code with a caller, no legitimate party requests an IP PIN by phone, email or text. None.
• Skipping the online account, the recovery tool is the safety net, and it works best set up before it's needed.

CP01A, Frequently asked questions

Related notices

Browse the complete directory of IRS notices orlook up any notice number.