- Use unique strong passwords, enable multifactor authentication, keep software updated, and avoid public Wi-Fi for tax-related tasks.
- Recognize common tax scams involving fake emails, texts, or calls impersonating the IRS, and verify any requests for sensitive information through trusted channels.
- Taxpayers can obtain an Identity Protection PIN, use secure IRS online accounts, and report suspicious contacts at IRS.gov/SubmitATip.
Who Should Take Action This Cybersecurity Awareness Month
The Internal Revenue Service is encouraging all taxpayers, tax professionals, businesses, payroll providers, and other organizations in the tax community to strengthen their online security habits. These practical steps are especially relevant for anyone handling personal, financial, or tax records online.
Cybersecurity Awareness Month serves as an annual reminder that everyday actions can reduce risks from identity thieves and scammers targeting tax data. The IRS, along with the Cybersecurity and Infrastructure Security Agency and Security Summit partners, emphasizes that these practices should become routine year-round rather than limited to October.
Practical limits exist: not every recommended action will apply equally to individuals versus large organizations, and some tools like an Identity Protection PIN are geared toward specific taxpayer situations.
Everyday Steps to Protect Tax Information
The IRS recommends several straightforward measures to strengthen cybersecurity. These include using strong, unique passwords for different accounts and considering a password manager to keep track of them. Enabling multifactor authentication adds an important extra layer of protection where available.
Users should regularly update software, operating systems, apps, browsers, and security programs on computers, phones, and tablets, turning on automatic updates when possible. Tax records should be stored securely, with sensitive files encrypted and important data backed up.
It is advisable to avoid public Wi-Fi networks when accessing financial accounts, tax records, or IRS online services. Being alert to unexpected communications requesting personal or financial details, or that create urgency, helps in recognizing potential scams.
Republic Tax Relief notes that individuals already dealing with IRS tax debt questions unrelated to this awareness campaign may have additional concerns about protecting their information during resolution processes; the firm offers a free, no-obligation initial consultation to evaluate private tax-resolution services and discuss suitability, scope, fees, and IRS communication options.
Common Tax Scams and How to Spot Them
Scammers frequently impersonate the IRS through mail, email, text messages, social media, or phone calls. These attempts may promise larger refunds, claim an account is locked, demand immediate payment, or lead to fake websites. Businesses and payroll offices should watch for phishing, fake invoices, or schemes targeting employee data or W-2 information.
Tax professionals such as enrolled agents, CPAs, attorneys, and preparers face risks from phishing emails that may appear to come from prospective clients or compromised accounts, potentially leading to the theft of sensitive taxpayer data. Any request to change employee or payment details should be verified independently through a trusted method.
The IRS generally contacts taxpayers by mail first. It sends emails or texts only after taxpayers have opted in and never uses social media direct messages. Official calls will not demand immediate payment, threaten arrest, or claim a refund is due without prior notice.
IRS Tools and Resources for Added Protection
Several IRS resources can help secure tax information. An Identity Protection PIN is a six-digit code that can prevent unauthorized filing of a federal tax return using a taxpayer’s Social Security number or ITIN. Individuals can access their Online Account to view notices, make payments, and handle other tasks securely.
Businesses have access to a Business Tax Account for managing certain responsibilities online, while tax professionals can use a Tax Pro Account to handle client authorizations. Federal law also requires many tax and accounting professionals to maintain a Written Information Security Plan to safeguard client data.
Those who suspect a data breach or receive suspicious messages should report them appropriately. Taxpayers can use IRS.gov/SubmitATip, while tax professionals should contact their stakeholder liaison promptly.
Where to Find More Details and Verify Information
Additional guidance is available through the IRS Identity Theft Central and Tax Scams pages, as well as the Cybersecurity and Infrastructure Security Agency’s Cybersecurity Awareness Month resources. The official IRS announcement dated October 2, 2026, provides the primary source for these recommendations.
Readers should always verify the latest details directly on IRS.gov rather than relying on secondary summaries, as guidance can be updated.
Announcement covered: Oct 2, 2026.
General information only, not individual tax, legal, or financial advice. Rules, deadlines, and eligibility depend on your circumstances. Check current official guidance or consult a qualified professional.
Request a correction →
