What CPAs and Tax Preparers Should Know About Tax Identity Theft

URGENT: PUT YOUR TAX IDENTITY INCIDENT PLAYBOOK IN PLACE BEFORE FILING SEASON.

Quick Review: Tax identity theft affects more than an individual return. Preparers hold sensitive information for many clients, may be the first to spot suspicious activity, and need a clear process for client guidance and firm security. This guide covers warning signs, IRS response steps, practice safeguards, and proactive client communication.

A New Channel for Evaluating Tax Identity Protection

For a tax practice, identity theft can arrive as an e-file rejection, a client’s unexpected IRS notice, or signs that firm systems or credentials have been compromised. Each signal deserves attention, but it does not automatically confirm what happened or establish that a preparer’s system was breached.

A consistent response helps practices separate client-level tax account issues from firm-level security incidents. It also sets clear expectations about what the preparer can document and explain, and what must be handled through IRS channels.

Why Tax Practices Are Exposed to Tax Identity Theft

Tax professionals hold concentrated collections of personally identifiable information, including Social Security numbers, dependent details, income documents, and prior-year returns. A compromised mailbox, software account, or document portal can put information for multiple clients at risk at once.

Criminals may also target preparer credentials. A PTIN, or Preparer Tax Identification Number, identifies a paid preparer on returns. An EFIN, or Electronic Filing Identification Number, is used to file returns electronically. A compromised EFIN or tax-software account can have broader filing consequences, while PTIN misuse may point to fraudulent activity involving the preparer’s identity.

The operational impact extends beyond investigating a single return. A practice may need to review e-file activity, secure accounts, assess which clients were affected, respond to anxious clients, and follow applicable reporting and notification requirements.

Warning Signs to Watch For in the Workflow

The IRS identifies several signs that tax professionals should take seriously. An individual signal may have an innocent explanation, so verify the facts before drawing conclusions. Keep a record of what appeared, when it appeared, and what steps the practice took.

Watch for:

• An e-file rejection because the taxpayer’s SSN was already used. First check for data-entry errors and confirm whether a return was already filed. If neither explains the rejection, treat it as a possible identity-theft indicator.
• Unexpected IRS letters or notices. A client may mention an authentication letter, refund, or account notice they did not expect. Ask to review the actual notice and its instructions. Clients should not ignore IRS correspondence simply because it seems confusing.
• Income mismatches on transcripts or IRS notices. Wages, withholding, or other income the client does not recognize may require further review. Request supporting documents and compare them against the client’s records.
• A dependent’s SSN reported as already used. Confirm the number is accurate and establish whether the dependent filed a separate return before concluding the SSN was improperly used elsewhere.
• Unfamiliar e-file acknowledgments or account activity. More acknowledgments than the firm’s own filing records support, unexpected login alerts, or changes to preparer accounts may signal activity that needs immediate investigation.
• Client reports of messages from the practice that no one sent. This may indicate that an email account or other communication channel has been accessed by someone else.

Responding When a Client May Be a Victim

A preparer can help the client organize facts, understand the next steps, and maintain a clear record. The preparer should not promise to resolve the IRS case or imply that filing a form guarantees a particular outcome or timeline.

A measured response can include:

1. Preserve the evidence. Keep the e-file rejection or acknowledgment, copies of relevant IRS correspondence, transcript details, and a dated record of the client’s account. Follow firm procedures for securing documents and limiting access.
2. Review the specific IRS notice. If the IRS has sent a letter asking the client to verify their identity or return, the client should follow that letter’s instructions. The IRS advises that some identity-verification letters do not require Form 14039.
3. Direct the client to the IRS’s Identity Protection Specialized Unit (IPSU) when appropriate. The IRS lists 800-908-4490 for identity-theft assistance. The client should use current IRS instructions and contact details, especially when a notice provides a specific response route.
4. Discuss Form 14039 only when the IRS guidance calls for it. The Identity Theft Affidavit is not an automatic step for every suspicious event. The IRS’s guidance explains when to file and when a taxpayer should instead respond through its verification process. Avoid duplicate submissions.
5. Explain IP PIN enrollment. An Identity Protection PIN (IP PIN) is a six-digit number the IRS uses as an additional identity check on eligible federal tax returns. Clients can review enrollment and retrieval steps through their IRS online account. Remind them that a new IP PIN is issued each calendar year and should be shared only through a secure process when the return is ready.
6. Set realistic expectations. IRS identity-theft cases may take many months to resolve. IRS materials describe a general 120-day timeframe but also report substantially longer averages during periods of elevated inventory. Do not promise a refund date or resolution window; refer clients to the IRS processing-status information for current updates.

The preparer can help organize records and explain filing logistics, but the IRS determines what identity verification and case resolution require. When a situation raises representation, legal, or other professional-scope questions, refer the client to an appropriately qualified professional.

Build Security into the Practice

The IRS Security Summit’s Security Six is a practical baseline for protecting taxpayer data. It includes anti-malware software, firewalls, multifactor authentication, backups, drive encryption, and a secure virtual private network for remote access. These safeguards should be part of a broader security program, not treated as a one-time checklist.

Tax and accounting practices also need a Written Information Security Plan (WISP) under applicable federal requirements, including the FTC Safeguards Rule. A WISP describes how the firm assesses risks, protects customer information, manages service providers, and responds to security events. The IRS provides a template in Publication 5708.

Practical measures to incorporate into the firm’s security and operating procedures include:

• Require multifactor authentication (MFA) on tax software, email, cloud storage, e-file accounts, and IRS e-Services wherever available.
• Use secure client portals or encrypted methods for document exchange. Avoid relying on ordinary email for sensitive documents unless appropriate safeguards are in place.
• Limit access to client information according to job responsibilities, and promptly remove access when staff or vendors no longer need it.
• Secure PTIN, EFIN, and related accounts with unique credentials. Review e-file acknowledgments and EFIN activity for filings the practice cannot reconcile.
• Maintain protected, tested backups and keep devices, applications, and security tools updated.
• Train staff to verify unusual requests through a trusted channel, particularly urgent messages that appear to come from the IRS, a client, or a software provider.
• Keep a written incident-response process. If the practice suspects data theft, the IRS directs tax professionals to contact their local Stakeholder Liaison promptly and consult state reporting requirements.

Prepare Clients Before Filing Season

A brief, consistent client message can reduce confusion when an issue surfaces. It can explain what information the firm needs, how the practice will communicate securely, and which IRS resources the client may need to use directly.

Before filing begins, consider reminding clients to:

• Check their IRS online account and review notices or account changes they do not recognize.
• Ask how to enroll in or retrieve an IP PIN, including for eligible dependents.
• Send tax documents through the practice’s approved secure channel.
• Contact the practice through a known phone number if they receive a suspicious request or a message that appears to come from the firm.
• Treat unsolicited IRS texts, emails, and social media messages requesting personal information or an IP PIN as suspicious. The IRS says it does not initiate contact that way to request sensitive information.

Key Findings for Tax Professionals

• Tax identity theft can affect both client tax accounts and the security of a practice’s systems and credentials.
• Duplicate-SSN rejections, unexpected notices, unfamiliar transcript income, and unexplained e-file activity warrant careful review.
• The preparer’s role is to guide, document, and explain next steps, not to promise IRS case outcomes.
• Form 14039 is not required in every suspected case. Clients should follow the instructions for their specific IRS notice.
• A current WISP, the Security Six safeguards, secure document workflows, and account monitoring support a more prepared practice.

A Supplementary Monitoring Option for Clients

Some clients may want ongoing visibility into IRS account activity in addition to the guidance they receive from their tax professional. Tax Guardian continuously monitors IRS accounts and transcripts for suspicious activity and provides instant text and email alerts. Recovery support is available on eligible plans. It is designed to complement, not replace, a preparer’s professional services, and Tax Guardian does not provide tax or legal advice.

Make Preparedness Part of the Client-Service Standard

A clear process helps a practice respond consistently when a return is rejected, a client brings in an unfamiliar notice, or a security concern arises. Reviewing the firm’s safeguards, defining escalation steps, and setting expectations with clients before filing season can make a difficult situation more manageable without overstating what the preparer or the IRS can do.

Frequently Asked Questions

Does an e-file rejection for a previously used SSN prove identity theft?
No. It is a warning sign, not proof by itself. Confirm the SSN was entered correctly and whether a return may already have been filed before deciding on next steps.

Should every client with a suspicious IRS letter file Form 14039?
No. The IRS may instruct a client to verify their identity through a notice-specific process instead. Clients should follow the letter’s directions and consult IRS guidance on when Form 14039 is appropriate.

Can a preparer resolve an IRS identity-theft case for a client?
A preparer can help document the issue and explain filing-related steps, but should not promise to resolve an IRS case. The IRS determines the required identity verification and case action.

How long can IRS identity-theft resolution take?
It can take many months. IRS materials state a general 120-day timeframe but also report longer averages when inventories are elevated. Clients should check current IRS processing information and avoid relying on a promised completion date.

IRS resource: Identity theft information for tax professionals

Disclaimer: This article is for informational purposes only and does not constitute tax, legal, cybersecurity, or other professional advice. Requirements and IRS procedures may change. Tax professionals should consult current IRS and FTC guidance and qualified advisers regarding their specific obligations. Tax Guardian does not provide tax or legal advice.

© 2026 Tax Guardian. All rights reserved.