For the eleventh year, the Internal Revenue Service and its Security Summit partners are working to help tax professionals remain vigilant against new and ongoing threats of tax-related identity theft.
Tax professionals remain prime targets for increasingly sophisticated identity thieves because taxpayers entrust them with highly sensitive tax information. It is essential for tax professionals to stay informed, review security basics, and promptly report data theft if it occurs.
This year’s summer awareness campaign revisits several areas of continuing concern. By recognizing the risks and taking practical steps, tax professionals can better protect themselves and their clients from the theft of personal, financial, and tax information.
The IRS and Security Summit partners are emphasizing the following areas this year.
Tax Professionals Are Required to Create a Security Plan
The Gramm-Leach-Bliley Act requires financial institutions to protect customer data. Under this law, tax and accounting professionals are considered financial institutions and must implement a data security plan. As part of that plan, the Federal Trade Commission requires each firm to:
- Designate one or more employees to coordinate its information security program.
- Identify and assess risks to customer information in relevant areas of the firm’s operations and evaluate the effectiveness of its safeguards.
- Create, implement, and regularly monitor and test security safeguards.
- Select service providers that can maintain appropriate safeguards and ensure their contracts require compliance.
To help tax professionals meet this requirement, the IRS created Publication 5708, Creating a Written Information Security Plan for Your Tax and Accounting Practice. The publication helps tax professionals develop their own security plans and guides them through getting started, understanding security compliance requirements, and meeting their professional responsibilities.
For more details, see IRS News Release IR-2026-52, “IRS, Security Summit remind tax pros they need a Written Information Security Plan to protect client data.”
Phishing, Spear Phishing, Whaling, and the “Security Six”
Phishing and related scams are among the most common threats facing tax professionals. These email and, increasingly, text-message scams are designed to trick recipients into disclosing personal or financial information, such as passwords, bank account numbers, credit card numbers, or Social Security numbers.
The “Security Six” offer a starting point for protecting tax offices, computers, data, and clients from thieves and hackers:
- Anti-virus software: Install and maintain anti-virus software, and keep it updated. Anti-virus protection is an important first line of defense.
- Firewalls: Use firewalls to shield computers and networks from malicious or unnecessary web traffic.
- Multi-factor authentication: Use multi-factor authentication, as required under the Federal Trade Commission Safeguards Rule, to help protect against cloud-based schemes.
- Backup software or services: Routinely back up critical files to protect against data loss caused by cyberattacks, device failures, or natural disasters.
- Drive encryption: Encrypt sensitive client data on computers so it cannot be read by outsiders.
- Virtual private network: Use a virtual private network to create a secure, encrypted connection for transmitting data between a remote user and the company network.
For definitions of phishing, spear phishing, clone phishing, and whaling, along with warning signs of scams, see IRS News Release IR-2026-85, “Security Summit warns tax pros to watch out for phishing emails and other attacks.”
New, Emerging, and Ongoing Scams
The following are among the schemes scammers continue to use:
- “New client” schemes: Scammers pose as prospective clients and use email, text messages, direct messages (DMs), spoofed caller ID, or computer-generated calls to lure tax professionals into clicking suspicious links, opening malware attachments, or sharing sensitive financial information.
- EFIN, PTIN, and CAF scams: Scammers send phishing messages seeking tax professionals’ identification numbers and documents, including Electronic Filing Identification Numbers (EFINs) and related documentation, Preparer Tax Identification Numbers (PTINs), and Centralized Authorization File (CAF) numbers.
- IRS impersonation by email, text, and phone: Scammers use email, text messages, direct messages, spoofed caller ID, and computer-generated calls to lure victims into clicking suspicious links, opening malware attachments, or sharing sensitive financial information.
- Misleading tax advice on social media: Viral “tax hacks” can encourage taxpayers to file returns with false information or claim credits for which they do not qualify. This can lead to refund delays, audits, or penalties.
For more information, see these IRS releases:
- IRS News Release IR-2026-81, “IRS, Security Summit launch summer series to help tax pros protect clients from identity theft.”
- IRS News Release IR-2026-111, “Security Summit closes summer series with data security reminder for tax pros.”
Tools to Help Protect Your Clients and Yourself
The IRS and Security Summit partners continue to remind tax preparers and taxpayers about tools that can help protect against tax-related identity theft.
Multi-Factor Authentication
Multi-factor authentication (MFA) strengthens account security by requiring more than a username and password to confirm the identity of someone accessing a system, application, or device.
Tax preparers are also required to use MFA to protect their clients’ sensitive information under the Federal Trade Commission’s Safeguards Rule.
IRS Identity Protection PIN
Tax preparers should encourage clients to opt in to the IRS Identity Protection PIN (IP PIN) program for an additional layer of protection against tax-related identity theft.
The program is voluntary. Each individual must pass an identity verification process to obtain an IP PIN. Once assigned, the PIN must be entered on the taxpayer’s individual federal tax return and is valid for one calendar year.
IRS Online Account
Tax preparers should also encourage clients to establish an IRS Online Account. It provides a secure way for taxpayers to access their IRS account information and helps prevent fraudsters from creating an account in their name.
For more details, see IRS News Release IR-2026-106, “Security Summit: Strengthen defenses against tax identity theft.”
Additional Resources
For more information about the IRS Security Summit and the Protect Your Clients; Protect Yourself – Summer 2026 awareness campaign, visit:
- Security Summit
- Protect Your Clients; Protect Yourself – Summer 2026
- Protect Your Clients; Protect Yourself
- IRS Publication 4557, Safeguarding Taxpayer Data
- Data Theft Information for Tax Professionals
- IRS Publication 5461-D, Tax Professionals Should Review Their Security Protocol
- FTC Safeguards Rule
