How to Protect Your Tax Information from Identity Theft

Your tax return tells a detailed story about your life: where you work, what you earn, who depends on you, and where your money goes. Unfortunately, that makes it valuable to someone trying to steal your identity.

The IRS's Protect Your Clients; Protect Yourself campaign reminds tax professionals that criminals target accounting firms to steal taxpayer information and submit fraudulent returns. For clients, the message is just as relevant: protecting your tax information takes attention on both sides of the relationship.

Whether you are filing an individual return or running a Tampa Bay business, a few practical habits can help keep sensitive information out of the wrong hands.

Why Tax Information Is a Target for Identity Thieves

Criminals do not always need to break into a computer system. Sometimes, they persuade someone to open an attachment, enter a password on a fake website, or respond to a convincing message.

The IRS warns that attackers target tax professionals through email, phone calls, and other methods to obtain passwords, steal professional identification numbers, or take control of computer systems. Stolen client data can then help criminals create fraudulent returns that look more believable.

That is why tax document security matters throughout the year, including when you are sending payroll records, answering a document request, or updating account information.

1. Pause Before Clicking on a Tax-Related Message

A familiar name in your inbox does not guarantee a legitimate message. The IRS's 2026 security guidance describes scams that copy real emails, impersonate trusted organizations, or target specific people with convincing requests.

Watch for messages that:

• Pressure you to act immediately to prevent an account from being closed.
• Ask you to verify sensitive information through an unexpected link.
• Include an attachment or document request you were not expecting.
• Use an address or website domain that is almost, but not quite, correct.
• Appear to repeat a previous email but introduce a different link or attachment.

If a request feels unusual, verify it through contact information you already trust. Call your tax professional using a saved number or open the portal through your usual bookmark. Avoid using contact details supplied only in the suspicious message.

An urgent subject line does not deserve automatic access to your Social Security number.

2. Use a Secure Portal to Share Tax Documents

Tax documents often contain Social Security numbers, bank details, income information, and dependent information. Give them more protection than an ordinary email attachment.

As a practical precaution, use the secure document-sharing method your tax professional provides. If you are unsure which portal or upload request is legitimate, contact the office before sending anything.

Avoid putting sensitive identification numbers in an email subject line or text message. If you receive an unexpected request to change where documents should be sent, confirm the change independently.

For business owners, these same habits belong in everyday payroll and bookkeeping workflows. Everyone who handles employee records or financial documents should know how to verify a request and where to share sensitive files.

3. Turn On Multifactor Authentication

A password alone provides only one layer of protection. Multifactor authentication, or MFA, adds another verification step, such as a code or biometric check.

The IRS recommends enabling MFA for email, tax software, cloud storage, and other services holding sensitive information. It also advises using individual accounts rather than sharing usernames and passwords.

Start with your email account, then review your financial accounts and tax document portals. Use a unique password for each account, and do not approve an authentication request you did not initiate.

For tax preparation firms, MFA is also a requirement under the FTC Safeguards Rule, unless a qualified individual approves an equivalent secure access control in writing.

4. Consider an IRS Identity Protection PIN

An IRS Identity Protection PIN, commonly called an IP PIN, is a six-digit number that helps the IRS verify your identity when a federal tax return is filed. It adds protection against someone using your information to file a fraudulent return.

According to the IRS:

• An IP PIN is valid for one calendar year, and a new number is generated each year.
• Taxpayers must obtain their own IP PIN. A tax professional cannot obtain one on a client's behalf.
• You should share it only with the IRS and your trusted tax preparation provider.
• The IRS will never call, email, or text to request your IP PIN.

Visit the official IRS IP PIN page to review the process. If you have an IP PIN, provide the current year's number to your preparer through a secure method when your return is being prepared.

5. Set Up Your IRS Online Account

The IRS encourages taxpayers to create a secure IRS Online Account. Beyond giving you access to your tax information, establishing your own account can help prevent a fraudster from creating one in your name.

Go directly to the IRS Online Account page rather than following an unexpected email or text link. Follow the identity verification instructions and protect your sign-in information.

Your IRS account and your tax firm's client portal serve different purposes. Keep both accounts secure, and verify unexpected messages about either one.

What Should You Expect from a Tax Professional?

The IRS explains that tax and accounting professionals must maintain a Written Information Security Plan, often called a WISP, to protect client information.

Its 2026 guidance identifies responsibilities such as assessing security risks, training employees, monitoring safeguards, and selecting service providers that can protect customer data. A plan should also be reviewed and updated as operations and risks change.

As a client, it is reasonable to ask how you should submit documents, how to confirm unusual requests, and whom to contact if you suspect your information has been exposed.

What If You Suspect Tax Identity Theft?

If you think you shared information with a scammer or received a suspicious tax-related request, contact your tax professional promptly through a trusted channel. Explain what happened and what information may have been involved.

If an account may be compromised, secure it through the provider's official website or support process. For tax-specific next steps, use the IRS's Identity Theft Central. The appropriate response depends on what happened, so avoid assuming that every suspicious message requires the same form or action.

Tax Security Starts Before You File

Protecting your tax information is part of managing your finances, whether you are organizing household paperwork or overseeing a growing business. Verified requests, secure document sharing, MFA, and an IP PIN can each add a useful layer of protection.

Have questions about sending documents for your tax return? Contact Kamish & Associates for guidance on the appropriate submission process. We help individuals and businesses in Brandon and throughout Tampa Bay with tax preparation, bookkeeping, and tax planning.

Frequently Asked Questions About Tax Information Security

Can a scam email look like it came from my accountant?

Yes. The IRS warns about targeted and cloned emails that imitate trusted senders. Verify unexpected links, attachments, and sensitive information requests through a known phone number or your usual portal access method.

Is an IP PIN the same as my tax portal password?

No. An IP PIN helps the IRS verify your identity when your federal tax return is filed. Your portal password controls access to your tax firm's document-sharing account. Protect both and share your IP PIN only with the IRS and your trusted preparer.

Can my tax preparer request an IP PIN for me?

No. The IRS states that taxpayers must obtain their own IP PIN. Your preparer can explain its purpose and how it fits into the filing process.

Sources

• IRS: Protect Your Clients; Protect Yourself
• IRS: Security Summit warns tax pros to watch out for phishing emails and other attacks, August 4, 2026.
• IRS: Tax pros need a Written Information Security Plan to protect client data, August 18, 2026.
• IRS: Strengthen defenses against tax identity theft, September 4, 2026.

This article provides general educational information. Security tools and IRS procedures may change; consult the linked IRS resources for current instructions.