IRS Offers Security Tips for Tax Professionals

Image courtesy AARP Foundation.

According to the IRS, tax professionals are responsible for protecting access to their IRS e-Services account and safeguarding their Electronic Filing Identification Number (EFIN) from thieves.

National and international criminal syndicates routinely attempt to steal tax professionals’ usernames and passwords so they may access IRS e-Services to obtain the EFIN, which allows a criminal to steal clients’ sensitive information.

To increase awareness, the IRS, state tax agencies and the tax industry are working together to urge practitioners to learn to protect themselves from password thefts.

“For tax professionals working with the IRS, protecting these account numbers is critical,” said IRS Commissioner John Koskinen. “Practitioners should maintain, monitor and protect their Electronic Filing Identification Number. Failing to do so can be disastrous for their business and their clients.”

Cybercriminals routinely use spear phishing emails to target tax practitioners. The emails impersonate IRS e-Services, trying to trick practitioners into disclosing their username and password. Once the thieves have these credentials, they access e-Services accounts and steal EFINs to file fraudulent tax returns.

Cybercriminals also are savvy enough to know to steal Centralized Authorization File (CAF) numbers, which are unique, nine-digit ID numbers assigned to those who represent others before the IRS. The con artists also know how to file fraudulent powers of attorney documents to access clients’ accounts.

Password thefts are one reason the IRS has moved to Secure Access, a two-factor authentication process, to offer more protection for online tools. Secure Access requires not only a username and password but also a security code that is sent to a mobile phone previously registered with the IRS. The IRS is moving toward multi-factor protections for e-Services as well, and hopes to have this system in the near future.

Authorized IRS e-file providers should maintain contact with the IRS to learn of any e-file updates. E-Service users can subscribe to Quick Alerts. Tax practitioners also can sign up for e-News for Tax Professionals or e-News for Payroll Professionals.