IR-2025-88: Security Summit: IRS reminds tax pros to guard against identity theft as summer series wraps up
Issue Number: IR-2025-88
Inside This Issue
Security Summit: IRS reminds tax pros to guard against identity theft as summer series wraps up
Week 5 of “Protect Your Clients; Protect Yourself” offers tax pros tools and advice to help protect important data.
WASHINGTON — The Internal Revenue Service and the Security Summit partners are closing out the fifth and final week of the “Protect Your Clients; Protect Yourself” awareness series by reminding tax professionals to stay vigilant and strengthen safeguards to protect against identity theft. In the first half of the year there were nearly 300 data breaches reported impacting as many as 250,000 clients.
The Security Summit – a public-private partnership of tax professionals, industry partners, state tax agencies and the IRS – has worked since 2015 to protect the tax system from identity theft and fraud. Tax pros can find the full series at IRS.gov.
This summer’s special awareness campaign coincides with the IRS Nationwide Tax Forum, being held in five cities this summer across the U.S. In addition to the series of five news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The Orlando event begins today, and space remains for the Sept. 9-11 event in Baltimore. The Sept. 16-18 event in San Diego is sold out.
Ongoing threats
Identity thieves constantly adapt their tactics, and attacks on tax professionals remain frequent.
Common schemes include:
- Fake “new client” schemes: Fraudsters pose as prospective clients, sending malicious attachments or links to steal login credentials or install malware.
- Phishing emails: Designed to trick people into sharing sensitive information, such as passwords, Social Security numbers, Central Authorization File (CAF) information or into clicking harmful links.
- Other scams: Calls, texts, fake printed correspondence and misleading social media posts to gain access to client data.
- Social media scams circulating inaccurate or misleading tax information.
Know the warning signs
Tax pros should watch for red flags from clients such as:
- IRS Online Account created or accessed without consent.
- Unrequested tax transcripts.
- Incorrect IRS balance-due statements notices.
- Refunds without filing a tax return.
Business warning signs include:
- Unusual computer activity, slow performance or being locked out of systems.
- Returns rejected because a Social Security number was already used.
- Receiving unexpected IRS authentication letters or e-filed acknowledgments.
- IRS notifications involving unrepresented clients or a compromised CAF number.
Prevention tools
The IRS offers tools to help tax pros to “Protect Your Clients; Protect Yourself.”
- Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice. A template for writing a WISP which is required by law.
- Security Six: anti-virus software, firewalls, backup software or services, encrypted drives, MFAs and virtual private networks or VPNs.
- IRS Identity Protection PIN Opt-In Program: Six-digit PINS to protect clients from someone else filing a tax return using their SSN.
Beat bad actors: Report data theft immediately
If a breach occurs:
- Report it to a local IRS Stakeholder Liaison to alert the IRS to take steps to block fraudulent returns.
- Notify the state tax agency using Federation of Tax Administrators’ Report a Data Breach web portal.
- Inform affected clients and recommend steps obtaining an Identity Protection PIN or completing Form 14039, Identity Theft Affidavit.
Stay informed
- Subscribe to e-News for tax professionals and IRS social media sites.
- For detailed security guidance review:
- Visit Identity Theft Central and Data Theft Information For Tax Professionals for more information and tools.
- Connect with the IRS on social media sites.
