Open the drawer where you keep your important papers. If you’re like most people, there’s a stack of old tax returns in there going back five, ten, maybe even twenty years. Each one contains your full name, Social Security number, employer information, bank account number (if you set up direct deposit), and a complete picture of your financial life for that year.
Now ask yourself: who else has access to that drawer?
A Goldmine Sitting in a Filing Cabinet
A single tax return contains virtually everything an identity thief needs to steal your identity. Your 1040 alone includes your SSN, your spouse’s SSN, your dependents’ SSNs, your address, your employer’s name and EIN, your income, and potentially your bank routing and account numbers.
W-2s stapled to those returns add another layer of detail. 1099 forms reveal your investment accounts. Schedules and attachments can show business income, rental property details, and charitable giving patterns that help build a complete profile of your financial life.
Most people wouldn’t leave their Social Security card sitting on the kitchen counter. But they’ll keep a decade’s worth of documents containing that same number (and much more) in an unlocked desk drawer or a cardboard box in the closet.
Who’s Actually Getting Into These?
You might be thinking this is only a risk if your house gets broken into. But the reality is more mundane and more common than a burglary.
Roommates and house guests. Anyone who stays in your home has potential access to your files. College students sharing apartments are especially vulnerable since multiple people cycling through a shared space with minimal privacy.
Service workers. Housekeepers, babysitters, contractors, maintenance workers. These are people you’ve invited into your home, many of whom are trustworthy. But it only takes one person in a difficult financial situation to find an opportunity.
Family members. This is an uncomfortable truth, but family and friends account for a significant percentage of identity theft cases. A relative with bad credit might use a child’s or parent’s SSN from documents they have easy access to.
Moving and storage. People throw tax documents into boxes during a move without a second thought. Those boxes end up in garages, storage units, or temporarily sitting on a curb. Storage unit break-ins are common, and anything inside with personal information is fair game.
Natural disasters. Floods, fires, and storms scatter personal documents. After Hurricane Harvey, identity theft reports in affected Texas zip codes spiked 23% in the following year. When your filing cabinet is floating down the street, your SSN is floating with it.
The Paper Problem
Physical documents are uniquely dangerous because they can’t be changed or updated with a new password. If a digital account gets compromised, you can change the credentials. If someone photographs your 2019 tax return, that Social Security number is compromised permanently. You can’t reset it like a password.
Paper also creates copies you might not think about. Tax preparers’ offices, accountant files, old faxes, photocopies you made for a mortgage application or apartment lease. Each copy is another potential exposure point that exists outside your control.
And unlike a data breach at a corporation, where there’s at least a chance of notification and monitoring services, a physical document theft might never be discovered. You won’t get a letter informing you that someone went through your desk. The first sign will be a fraudulent account or a rejected tax return, months or years later.
How Long Should You Actually Keep Tax Returns?
The IRS recommends keeping tax returns for at least three years from the date you filed, or two years from the date you paid the tax, whichever is later. In certain situations (if you underreported income by more than 25% or didn’t file a return), the IRS can go back six or seven years.
For most people, keeping returns for seven years covers every reasonable scenario. Anything older than that is creating risk without providing value.
That said, some financial advisors recommend keeping returns indefinitely if you own a business, have complex investments, or own property where the cost basis might be relevant. In those cases, secure storage becomes even more important.
What To Do With Your Old Returns
Shred anything you don’t need. If your tax returns are more than seven years old and you don’t have a specific reason to keep them, destroy them. A cross-cut shredder is the standard for sensitive documents. Strip-cut shredders aren’t secure enough because determined individuals can reassemble strip-cut documents.
If you have a large volume of old documents, many communities offer free shredding events, often hosted by banks or local government offices. Some office supply stores like Staples and Office Depot offer shredding services by the pound.
Lock up what you keep. Returns you need to retain should be stored in a fireproof safe or a locked filing cabinet, not a desk drawer, cardboard box, or open shelf. A basic fireproof document safe costs between $30 and $80 and protects against both theft and disaster.
Go digital where possible. Scan important documents and store them in an encrypted digital format. Services like your tax preparer’s portal, encrypted cloud storage, or even password-protected zip files on an external drive are all more secure than paper in a drawer. Once you’ve securely digitized a document, shred the physical copy.
Secure your tax prep process. If you work with an accountant or tax preparer, ask how they store and dispose of your documents. Do they shred paper copies after filing? Is their digital storage encrypted? If they can’t answer these questions clearly, that’s a concern.
Get an IRS Identity Protection PIN. Regardless of how you store your documents, request an IP PIN at irs.gov/ippin. This prevents anyone from filing a tax return with your Social Security number, even if they have every other detail from your old returns.
Don’t Overlook the Obvious
We spend a lot of energy worrying about sophisticated cyber attacks and data breaches. And those threats are real. But sometimes the biggest vulnerability is the simplest one: sensitive documents sitting in an accessible place inside your home.
Take 30 minutes this weekend. Go through your files. Shred what you don’t need. Lock up what you do. It’s one of those tasks that feels tedious until you actually do it, and then you wonder why you waited so long.
