Security Summit: Identity Protection PINs, IRS Online Account protect against tax-related identity theft

In the fourth part of a special summer series, the Security Summit partners today reminded tax professionals and taxpayers about the special IRS Identity Protection PIN program and the IRS online accounts that can help protect against tax-related identity theft.

These two tools help protect against the threat of tax-related identity theft, both for the taxpayers who sign up and the tax professionals who hold their sensitive tax information.

Identity Protection PINs, also referred to as IP PINs, serve as a critical defense against identity thieves. The IRS is encouraging all tax pros and taxpayers to establish their IRS Online Account that allows access to IRS account information online, but it also guards against fraudsters trying to trick tax pros and taxpayers into creating such an account.

“To protect against continuing and evolving threats from identity thieves, these two special tools provide an extra layer of security for taxpayers and tax professionals,” IRS Commissioner Danny Werfel said. “The IRS and the Security Summit urge people to sign up for both IP PINs and the Online Account to help protect their valuable information as well as avoid tax problems down the road.”

The IRS, state tax agencies and the nation’s tax industry – working together as the Security Summit – need assistance from tax professionals to let their clients know that IP PINs and the IRS Online Account are available to anyone who can verify their identity.

In addition to enrolling in the IP PIN program, the IRS is encouraging all people to establish their IRS Online Account. Doing so not only provides access to IRS account information that’s now available online, but it also guards against fraudsters trying to trick tax pros and taxpayers into creating such an account. Tax pros also have access to the Tax Pro Account.

This is the fourth week of an eight-part Protect Your Clients, Protect Yourself summer series, part of an annual education effort by the Security Summit, a group that includes tax professionals, industry partners, state tax agencies and the IRS. The public-private partnership has worked since 2015 to protect the tax system against tax-related identity theft and fraud.

Security is a key focus of the Nationwide Tax Forum, being held in five cities this summer throughout the U.S. In addition to the series of eight news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The forums continue today in Orlando, Florida, though the event is already sold out, and carry on the week of August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego. The IRS reminds tax pros that registration deadlines are quickly approaching for the Baltimore and Dallas forums, as San Diego has also sold out.

More than 10.4 million taxpayers have taken the steps to obtain an IP PIN, a six-digit number that once issued to a taxpayer must be included on their tax return prior to filing electronically. Many, many more taxpayers should consider getting one to add another layer of protection against identity theft.

To do so, taxpayers should visit the IRS Get an IP PIN online tool. Doing that will establish a taxpayer’s access to their IRS Online Account, making themselves less likely to fall victim to social engineering schemes that trick taxpayers into setting up an IRS Online Account controlled by a bad actor.

Beginning this summer, taxpayers who enroll in the program will have the ability to unenroll if for some reason they decide they no longer want to participate in the future.

ETAAC notes IP PIN “effectively locks out” many fraudsters

The Electronic Tax Administration Advisory Committee, or ETAAC, is again this year highlighting the importance of the IP PIN to taxpayers and tax professionals, echoing past endorsements from the same independent IRS advisory group.

“The IP PIN method provides strong protection against stolen identity tax refund fraud and effectively locks out many fraudsters from e-filing using that taxpayer’s social security number,” said ETAAC’s annual report to Congress.

But the report added that IP PINS should be more widely used, calling it an overlooked tool in the fight against fraud. Underscoring the point, the ETAAC report said only 525,000 taxpayers opted into the IP PIN program in 2022, even though the Federal Trade Commission received more than 1.1 million reports of identity theft that same year.

The importance of someone’s IP PIN can be a tempting target for identity thieves, given the IP PINs’ inherent strength. Summit partners urged taxpayers and tax professionals to be careful and protect the IP PIN from identity thieves, and noted these key tips:

Taxpayers should share their IP PIN only with their trusted tax provider.
Tax professionals should never store clients’ IP PINs on computer systems. This reduces taxpayer risk if a tax pro’s system is compromised by an identity thief or cyberattack.
The IRS will never call, email or text either taxpayers or tax professionals to request the IP PIN. This is a sign of a scam.

Tax professionals who experience a data theft can assist clients by urging them to quickly obtain an IP PIN. Even if a thief already has filed a fraudulent return, an IP PIN would still offer protections for later years and prevent taxpayers from being repeat victims of tax-related identity theft.

Key facts about IP PINs

Here are a few other things taxpayers and tax professionals should know about the IP PIN:

It’s a six-digit number known only to the taxpayer and the IRS.
The opt-in program is voluntary, though strongly encouraged.
In cases of proven identity theft, an IP PIN is assigned to a taxpayer to use for future filings.
The IP PIN should be entered on the electronic tax return when prompted by the software product or on a paper return next to the signature line.
The IP PIN is valid for one calendar year; a new IP PIN is generated each year.
Only taxpayers who can verify their identities may obtain an IP PIN.
IP PIN users should never share their number with anyone but the IRS and their trusted tax preparation provider. The IRS will never call, email or text a request for the IP PIN.
Tax professionals cannot obtain an IP PIN on behalf of clients. Taxpayers must obtain their own IP PIN.

Taxpayers have the opportunity to opt out if they previously opted into the program. Taxpayers who are confirmed victims of identity theft will not have the option to opt out of the program.

How to get an IP PIN

To obtain an IP PIN, the best option is to start at Get an IP PIN. Taxpayers need to validate their identities through ID.me to access the tool and their IP PIN. Before attempting this thorough process, the IRS recommends taxpayers first check out How to register for IRS online self-help tools.

If taxpayers are unable to validate their identity online and if their income is less than $79,000 for individuals or $158,000 for married couples, they may file Form 15227, Application for an Identity Protection Personal Identification Number PDF. The IRS will call the telephone number provided on Form 15227 to validate their identity. Once verified, the taxpayer will receive an IP PIN via the U.S. Postal Service within four to six weeks.

Taxpayers who cannot validate their identities online or on the phone with an IRS employee after submitting a Form 15227, or who are ineligible to file a Form 15227, may call the IRS to make an appointment at a Taxpayer Assistance Center. They’ll need to bring one picture identification document and another identification document to prove their identity. Once verified, the taxpayer will receive an IP PIN via U.S. Postal Service within three weeks.

The IP PIN process for confirmed victims of identity theft remains unchanged. These victims will automatically receive an IP PIN each year.

Additional resources

If a tax pro or their firm are the victim of data theft, they should:

Report the incident to their local IRS stakeholder liaison. Speed is critical. IRS stakeholder liaisons will ensure all the appropriate IRS offices are alerted. If reported quickly, the IRS can take steps to block fraudulent returns in the clients’ names and will assist tax pros through the process.
Visit the Federation of Tax Administrators to find state contact information. Tax professionals can share information with the appropriate state tax agency by visiting the special Report a Data Breach.
Review Publication 5293, Data Security Resource Guide for Tax Professionals PDF, which provides an overview and resources about how to avoid data theft.
Tax professionals can also get help with security recommendations by reviewing IRS Publication 4557, Safeguarding Taxpayer Data PDF, and the IRS’ Identity theft information page for tax pros.
Read Small business information security: The fundamentals PDF, by the National Institute of Standards and Technology.