Millions of Americans have already fallen prey to tax identity theft, and it looks like the problem is growing fast. In fact, one survey found that during the 2016 tax season, nearly 60% of CPAs had at least one client who had fallen victim to this fraud. What’s even more alarming: Most of the victims had no idea that the theft had occurred until they went to file their own returns.

Here’s how the scam works: A criminal gets a hold of your basic personal information, including your social security number. Then he goes to the IRS website to get a copy of your actual last year’s tax return, which gives him a wealth of additional information. The thief uses that information to create and file a fake tax return, directing the refund to himself. When you to file your federal tax return, it’s rejected because a refund has already been issued to your social security number.

This malicious crime takes a terrible toll on the victims, both emotionally and financially. And, as you can imagine, it can take a while to resolve this problem and get the refund that’s really owed to you. So it’s important to take every step you can to keep your personal information from falling into the wrong hands.

To protect your financial identity, make sure to

  • Keep your computer, tablet, and smart phone secure
  • Use complicated passwords and change them frequently
  • Encrypt sensitive data, like tax returns
  • Never click on links or attachments from unknown email addresses
  • Secure your social security card and physical copies of tax returns and records, bank statements, and credit card statements
  • Shred old tax returns and other financial documents before disposing of them
  • Only give personal information on secure websites with https addresses
  • Don’t enter any personal or banking information over unsecured or public Wi-Fi
  • Beware of IRS impersonators
  • Check your credit report and Social Security records at least once a year

And what if you do fall victim to identity theft? Report the fraud immediately at identitytheft.gov. That’s the first step toward reclaiming your financial identity and your tax refund.

If your tax return gets rejected because a return has already been filed with your social security number, the next step is to fill IRS Form 14039 (Identity Theft Affidavit). Print out the filled-in form, attach it to your tax return, and mail it to the IRS address in the instructions (which may vary based on your circumstances and where you live).

File your taxes by mail if you can’t e-file. They can’t send you a refund if you don’t file your return, and filing as soon as possible can help speed up the process.

If you do get a notice from the IRS, respond immediately – their letter will provide a phone number for you to call, and may require that you verify your identification at IDVerify.irs.gov.