The Internal Revenue Service and the Security Summit today urged tax professionals and taxpayers to strengthen defenses against tax-related identity theft.
In the fourth installment of the “Protect Your Clients; Protect Yourself” summer series, the IRS and Security Summit partners highlight the benefits of multifactor authentication (MFA), Identity Protection PINs, and secure IRS online accounts. Under the Federal Trade Commission’s Safeguards Rule, tax preparation firms must use multifactor authentication to protect access to customer information, unless a Qualified Individual approves in writing an equivalent secure access control.
“Taxpayers and tax professionals should take advantage of the powerful tools available to help protect against identity theft,” said IRS Chief Executive Officer Frank J. Bisignano. “Using multifactor authentication, IP PINs, and other protections adds important layers of security that helps safeguard sensitive data held by practitioners, taxpayers, and IRS systems.”
What tax pros should know about MFA
Multifactor authentication strengthens account security by requiring at least two independent factors to verify a user’s identity. These factors may include a password, a security code sent to a device, or biometric information.
MFA helps protect against phishing, social engineering, and other technology attacks that exploit weak or stolen passwords.
MFA best practices include:
- Use MFA across all services and data access points.
- Regularly review current MFA methods, standards, and emerging technologies.
- Provide different authentication options to meet users’ needs.
- Enable MFA in tax software, cloud storage, email, and other services containing sensitive client information.
- Use individual accounts and never share usernames or passwords.
Tax professionals should use MFA to secure client information on computers and networks and to access client information stored in tax preparation software. The MFA requirement applies to tax preparation firms regardless of size.
IP PINs help protect tax returns
An IRS Identity Protection PIN, also referred to as an IP PIN, is a critical defense tool against identity thieves filing fraudulent tax returns. It is a six-digit number known only to the taxpayer and the IRS. It helps the IRS verify the taxpayer’s identity when a federal tax return is filed. An IP PIN is valid for one calendar year, and a new number is generated each year.
Tax professionals cannot obtain an IP PIN on behalf of clients; taxpayers must obtain their own. Taxpayers may opt in by visiting the IRS Get an Identity Protection PIN on IRS.gov. Confirmed victims of tax-related identity theft automatically receive a new IP PIN each year.
IP PIN users should never share their number with anyone but the IRS and their trusted tax preparation provider. The IRS will never call, email, or text to request an IP PIN.
IRS Online Account and Tax Pro Account
The IRS encourages taxpayers to create an IRS Online Account to securely view their tax account information and to help protect against identity theft and fraud. Creating secure IRS accounts helps prevent fraudsters from creating accounts in taxpayers’ or tax professionals’ names.
IRS Online Account is available to anyone who can verify their identity. Tax professionals can encourage clients to use IRS Online Account and use Tax Pro Account to submit power of attorney and tax information authorization requests, manage active authorizations, and access eligible client information.
Security Summit and the Nationwide Tax Forums
The “Protect Your Clients, Protect Yourself” summer series is part of an annual education effort by the Security Summit. Since 2015, the public-private partnership has worked to protect the tax system against tax-related identity theft and fraud.
In addition to the five-part series, tax professional security is a key focus of the 2026 IRS Nationwide Tax Forum. The final forum is Sept. 15 -17 in San Diego.
Yes. Under the Federal Trade Commission’s (FTC) Safeguards Rule, tax preparation firms of all sizes are legally required to use MFA to secure access to client information. The only exception is if a designated Qualified Individual formally approves an equivalent, equally secure access control in writing.
No. Tax professionals cannot apply for or retrieve an IP PIN for their clients. Taxpayers must opt in individually by verifying their identity and requesting an IP PIN through their personal IRS Online Account at IRS.gov. Once obtained, the client must provide this 6-digit PIN to their trusted tax preparer to file their return.
An IP PIN is valid for one calendar year. A new, unique 6-digit IP PIN is generated annually by the IRS for each enrolled taxpayer to ensure ongoing security against fraudulent filings.
Tax professionals should enable MFA across every access point that handles or stores sensitive client data. This includes tax preparation software, client portals, cloud storage services, business email accounts, remote access endpoints (such as VPNs), and internal networks.
When taxpayers create their own IRS Online Account, it establishes their verified presence on IRS systems, preventing cybercriminals from fraudulently opening an account in their name. Additionally, it allows taxpayers to easily manage IP PINs and approve Tax Pro Account requests (such as Power of Attorney) submitted by their tax preparer.
Manoj Sharma is a Senior Writer on the banking team at Tax Assistant. He provides information on budgeting, bank accounts, the banking industry, and other related topics. Using original data and methodologies, he helps you identify the best financial institutions, accounts, and products tailored to your needs. Manoj holds a degree in Journalism and Political Science from Syracuse University. All articles are strictly reviewed and fact-checked by our panel of expert Chartered Accountants, including CA Devendra Saini, CA Nikhil Khunteta, and CA Ankit Goyal
