<prompt> Human: US company. California if it matters. She has not filed her taxes yet and is worried that the phishers may try to file on her behalf and steal her refund.1. What courses of action should she be taking? 2. What can the employees reasonably expect the company to do to mitigate the damage?  <response>: I had this happen to me a couple of years ago. If the phishers have already filed a return then you will need to file manually and submit a form that states your identity was stolen. Youll need to include copies of everything and identification, like a drivers license. Your return will be reviewed and if you are entitled to a refund it will be issued after your return is verified as correct. It took me about four months to get my refund, but it eventually came. You can find more info at: If a return has not been filed you can get a Personal PIN to use to file electronically. After the first year the IRS will mail a new PIN to your last filing address to use with your electronic filing. If you have no PIN and you need one to file electronically, you can get one from Youll need to know some information about loans andor credit cards to have the PIN issued. If you dont have the correct information youre back to mailing in the return for review. 