Here’s how tax preparers can protect themselves and their clients

Notice: Historical Content


This is an archival or historical document and may not reflect current law, policies or procedures.

IRS Tax Tip 2018-189, December 7, 2018

Cybercriminals are stepping up their attacks on tax professionals. Because of this, the IRS urges tax preparers to take steps to protect client data and their computer networks from these threats.

Thieves search for client data so they can create a fraudulent tax return that looks legit and might bypass IRS filters. They also impersonate tax professionals, using stolen Electronic Filing Identification Numbers, Preparer Tax Identification Numbers, and Centralized Authorization File numbers.

Here are some basic security steps that tax preparers can take to protect themselves and their clients. Tax preparers should:

  • Learn to recognize phishing emails. They can be on the lookout for emails from thieves pretending to be from the IRS, e-Services, a tax software provider, or cloud storage provider.
  • Never open a link or any attachment from a suspicious email. Remember: The IRS never initiates initial contact with a tax pro via email.
  • Create a data security plan using IRS Publication 4557PDF, Safeguarding Taxpayer Data, and Small Business Information Security – The Fundamentals PDFby the National Institute of Standards and Technology.
  • Install anti-malware/anti-virus security software on all devices. This includes laptops, desktops, routers, tablets and phones. They should also consider keeping their software set to automatically update.
  • Create passwords of at least eight characters.
  • Use different passwords for each account.
  • Password protect wireless devices and consider a password manager program.
  • Encrypt all sensitive files and emails.
  • Back up sensitive data to a safe and secure external source not connected fulltime to a network.
  • Wipe clean or destroy old computer hard drives and printers that contain sensitive data.
  • Limit access to taxpayer data to individuals who need to know.
  • Check IRS e-Services account weekly for number of returns filed with EFIN.
  • Report any data theft or data loss to the appropriate IRS Stakeholder Liaison.
  • Stay connected to the IRS through subscriptions to e-News for Tax Professionals, Quick Alert, and Social Media.

More information:

Subscribe to IRS Tax Tips