- Multifactor authentication is required for tax preparation firms under the FTC Safeguards Rule unless an approved alternative is documented.
- Taxpayers must apply for their own IP PIN annually through IRS.gov; professionals cannot obtain it on their behalf.
- IRS Online Accounts require identity verification and help prevent unauthorized account creation by fraudsters.
Understanding the Security Recommendations
The Internal Revenue Service and its Security Summit partners are reminding taxpayers and tax professionals to review available protections against tax-related identity theft. In a September 2026 update, officials highlighted multifactor authentication (MFA), Identity Protection PINs (IP PINs), and secure IRS online accounts as important layers of defense.
These tools address risks from phishing, social engineering, and stolen credentials. Before implementing any measure, individuals and firms should confirm how the specific tool works, its limitations, and whether it fits their situation. The announcement stresses that no single step eliminates all threats.
Multifactor Authentication Requirements and Best Practices
MFA requires at least two independent verification factors, such as a password plus a code sent to a device or biometric data. The Federal Trade Commission’s Safeguards Rule generally mandates its use by tax preparation firms to protect client data, unless a Qualified Individual provides written approval for an equivalent control.
Tax professionals should verify that MFA is activated across email, tax software, cloud storage, and any system holding sensitive information. Best practices include using unique accounts without shared credentials, reviewing current methods regularly, and offering multiple authentication options to accommodate different users. This requirement applies regardless of firm size.
Before relying on MFA, confirm that all access points are covered and that the chosen methods align with the latest standards. Weak implementation could leave gaps that identity thieves might exploit.
How Identity Protection PINs Function and Their Limits
An IP PIN is a six-digit number issued by the IRS that helps verify a taxpayer’s identity when filing a federal return. It is valid for one calendar year only, with a new PIN generated annually. Confirmed victims of tax-related identity theft receive an IP PIN automatically each year.
Taxpayers must obtain their own IP PIN by using the Get an Identity Protection PIN tool on IRS.gov; tax professionals cannot request it for clients. Users should share the number only with the IRS and their trusted tax preparer. The IRS will never request an IP PIN by phone, email, or text.
Before applying, taxpayers should understand that an IP PIN adds a verification step but does not replace other filing requirements. Those considering this option need to verify their eligibility and the exact application process directly with the IRS.
IRS Online Accounts for Taxpayers and Professionals
Creating an IRS Online Account allows eligible taxpayers to view their tax information securely and reduces the chance of fraudsters opening accounts in their name. Tax professionals can use a separate Tax Pro Account to manage power of attorney forms, authorizations, and eligible client data.
Anyone who can successfully verify their identity may create an account. Before setting one up, individuals should confirm they have the necessary documentation for identity proofing and understand what information the account will display.
The IRS encourages both taxpayers and professionals to review account security settings periodically. This step can help detect unauthorized activity early.
Questions to Ask Before Taking Action
The risk checklist for these protections includes verifying current MFA coverage across all systems, confirming the annual renewal process for an IP PIN, and ensuring identity verification succeeds before creating an IRS Online Account. Taxpayers should also check whether their tax preparer follows the Safeguards Rule requirements.
Because rules can evolve and individual circumstances vary, readers should consult official IRS resources for the most current details. The announcement does not guarantee protection against every form of identity theft.
Republic Tax Relief can answer questions about existing tax debt or IRS communications that fall outside this identity-theft prevention guidance. Individuals may contact the firm for a free, no-obligation initial consultation to evaluate suitability, scope, fees, and availability of private tax-resolution services for unresolved IRS or state tax issues.
Announcement covered: Sep 4, 2026.
General information only, not individual tax, legal, or financial advice. Rules, deadlines, and eligibility depend on your circumstances. Check current official guidance or consult a qualified professional.
Request a correction →
