Someone is using your Clave SOL: what to do about identity theft with SUNAT

Why you need to move fast

The Clave SOL is your online signature with SUNAT. It is used to issue fee receipts (recibos por honorarios), change your tax address (domicilio fiscal) and handle RUC procedures. If someone else has it, they can do all of that in your name.

The key rule is article 6 of Resolución de Superintendencia N.º 109-2000/SUNAT:

“Es responsabilidad del deudor tributario tomar las debidas medidas de seguridad en el uso de la Clave SOL. En este sentido, se entenderá que la operación ha sido efectuada por el deudor tributario en todos aquellos casos en los que para acceder a SUNAT Operaciones en Línea se haya utilizado el Código de Usuario y la Clave SOL otorgadas por la SUNAT, así como los Códigos de Usuario y Claves SOL generadas por el deudor tributario.”

(The taxpayer is responsible for keeping the Clave SOL secure, and any operation made with the user code and Clave SOL is understood to have been made by the taxpayer.)

In practice: for SUNAT, whatever was done with your user and key was done by you. The rule does not say how to prove otherwise. Every day the impostor keeps logging in means more operations in your name that you will have to explain.

If you simply forgot your key and nobody used it, this is not your page: see how to get and recover a RUC and Clave SOL.

First: cut off access

Article 7 of the same resolution gives you the tool:

“El otorgamiento de un nuevo Código de Usuario y Clave SOL para el deudor tributario implicará automáticamente la anulación del Código de Usuario y Clave SOL generados por la SUNAT y los Códigos de Usuario y Claves SOL generados por el deudor tributario, de ser el caso.”

(Getting a new user code and Clave SOL automatically cancels the previous ones, including any the taxpayer created.)

This matters because an impostor may have created secondary users. Under that article, a new user code and Clave SOL cancel those too. Note that the article speaks of getting a new user code and Clave SOL, not of simply changing the password.

• If you can still log in: change your key at once. SUNAT’s guidance page says the key can be changed “las veces que considere conveniente” (as often as you see fit). Also check for secondary users you did not create.
• If you can no longer log in: recover the key with your RUC number. We explain it in the RUC and Clave SOL page.
• If they changed the email or mobile in your RUC and you cannot recover the key online: go to a Centro de Servicios al Contribuyente with your ID document and explain what happened.

Second: check what was done in your name

Your tax address

SUNAT’s guidance page says the tax address is changed “de manera virtual a través de SUNAT-Operaciones en Línea, utilizando su Clave SOL” (online through SUNAT Operaciones en Línea, using your Clave SOL). Once you have your key back, correct it the same way.

There is an exception. If your address is marked no habido (not found), or has a collection or audit restriction, SUNAT says you must “apersonarse previamente” (appear in person first) at a Centro de Servicios al Contribuyente, with a document showing the address you want to register.

Fee receipts

Here we need to be honest about what SUNAT says. Its official page reads:

“Debes revertir (anular) tu recibo si la siguiente información que presentaste es errónea”

(You must reverse your receipt if the following information you gave is wrong.)

It then lists two cases: the client’s details (name or RUC) and the income type. It adds a condition:

“Para que proceda la reversión no debe contar con pagos registrados, ni haberse emitido notas de crédito del recibo por honorarios electrónico a revertir.”

(Reversal is only possible if the receipt has no recorded payments and no credit notes.)

A receipt issued by someone else with your key is not really an “error” in the client’s details. We found no rule or official page that provides for reversal in that case. What you can do is leave a record: tell SUNAT in writing which receipts you did not issue. If the receipt already has recorded payments, the page is clear that reversal is not available.

We did not review cancelling electronic invoices (facturas) or boletas here.

Third: tell SUNAT in writing

We found no SUNAT form designed for reporting misuse of your Clave SOL. The general route is a written statement through SUNAT’s Mesa de Partes Virtual. Say which operations you did not make, since when, and what you did to cut off access. Keep the case number.

That statement does not undo what happened. It is evidence that you acted as soon as you found out, against the rule in article 6.

Fourth: file a criminal complaint

Digital identity theft is a crime. Article 9 of Ley 30096, the Computer Crimes Law, in the wording given by Decreto Legislativo 1591, says:

“El que, mediante las tecnologías digitales suplanta la identidad de una persona natural o jurídica, siempre que de dicha conducta resulte algún perjuicio, material, moral o de cualquier otra índole, será reprimido con pena privativa de libertad no menor de tres ni mayor de cinco años.”

(Anyone who uses digital technologies to impersonate a person or company, where this causes harm that is material, moral or of any other kind, faces three to five years in prison.)

Note the condition: there has to be harm. That harm can be financial, moral “o de cualquier otra índole” (or of any other kind). A receipt issued in your name or a tax address changed without your consent are facts to set out in the complaint.

You can file at a police station or with the Ministerio Público. Bring:

• screenshots of the receipts, documents or changes you did not make;
• the dates you noticed them;
• the filing receipt of your statement to SUNAT.

If your DNI was also stolen, ask for a replacement and report the loss. See how to get, renew or replace a DNI.

The «clave token» and second factors

Many people search for a “SUNAT token”. In the official sources we checked (sunat.gob.pe, orientacion.sunat.gob.pe and gob.pe) we found no product by that name for logging in to SUNAT Operaciones en Línea. What the rules do contain, since Resolución de Superintendencia N.º 000121-2026/SUNAT, is this:

• A verification code when you create your key. To create your user or Clave SOL through SUNAT Virtual or the app, “se debe validar la dirección de correo electrónico y el número de teléfono móvil registrado en el RUC, para lo cual debe ingresar el código de verificación que se envía a dicho correo y al número de teléfono móvil” (the email and mobile number in your RUC must be validated by entering the verification code sent to both).
• Validation at any time. “La SUNAT puede solicitar la validación de los datos relativos a la dirección de correo electrónico y al número de teléfono móvil en cualquier momento.” (SUNAT may ask you to validate your email and mobile number at any time.)
• Security measures at login. “La SUNAT puede adoptar las medidas de seguridad requeridas para asegurar la correcta identificación del usuario.” (SUNAT may adopt the security measures needed to identify the user correctly.) The rule does not say which ones.

In practice: keep the email and mobile in your RUC up to date and in your hands only. They are the lock on your Clave SOL. If someone asks you for a code you received from SUNAT, do not give it to them.

Check whether your identity was used elsewhere

Whoever has your Clave SOL often has other data of yours. The Ministerio Público’s guidance on identity theft recommends:

“Revisa la página de la SBS y asegúrate que no existan préstamos o tarjetas de crédito no solicitadas. En caso suceda, ve al banco, anula la transacción y efectúa el reclamo.”

(Check with the SBS, the banking regulator, that there are no loans or credit cards you did not ask for. If there are, go to the bank, cancel the transaction and file a complaint.)

If a company processes your data without your consent, you can use your ARCO rights.

What this page does not cover

We do not cover recovering a Clave SOL you simply forgot (see RUC and Clave SOL), or how to suspend or close your RUC. We did not review cancelling electronic invoices or boletas, the tax consequences of documents issued by an impostor, or Tribunal Fiscal decisions on misuse of the Clave SOL. We also did not confirm whether articles 6 and 7 of R.S. 109-2000/SUNAT changed after 2008.