When a paid tax preparer sits down to open a client’s return this season, a federal security rule now stands between that preparer and the file. Under the Federal Trade Commission’s Safeguards Rule, tax preparation firms must use a second layer of login verification, not just a password, before anyone on staff can view a taxpayer’s Social Security number, bank routing details or income history. The Internal Revenue Service and its Security Summit partners spotlighted the requirement this month as part of a broader push to keep identity thieves out of the tax system. For households that hand a preparer their most sensitive paperwork every spring, the rule answers a question that rarely gets asked out loud: what actually stops someone at that office, or a hacker who breaks into it, from reading everything in the file?
The FTC’s Safeguards Rule Puts a Login Gate on Every Client File
The requirement comes from the FTC’s Standards for Safeguarding Customer Information, known as the Safeguards Rule, which the commission overhauled in 2021 and phased in through mid-2023. The rule already lists tax preparation firms by name among the financial institutions it covers, alongside mortgage brokers, check cashers and collection agencies, because those businesses handle the same kind of nonpublic personal information banks do. One of its core technical requirements is multifactor authentication for anyone accessing customer information on the firm’s systems, meaning a password alone is no longer enough.
The IRS and Security Summit partners restated that duty this month, in the fourth installment of their summer “Protect Your Clients; Protect Yourself” series. As the IRS put it, tax preparation firms must use multifactor authentication to protect access to customer information unless a Qualified Individual, the staffer or contractor responsible for the firm’s data security program, approves an equivalent secure access control in writing. The obligation applies to a solo preparer working out of a spare bedroom just as much as a regional chain, since the FTC rule draws no size exception for the multifactor requirement itself.
In practice, that means a preparer logging into tax software or a client portal has to clear a second checkpoint beyond a password, commonly a one-time code sent to a phone, a physical security key or a fingerprint scan. The FTC’s compliance guidance describes three acceptable factor types: something the user knows, like a password; something the user has, like a token; and something the user is, biometric data. A firm needs at least two of those before an employee can open a return that contains a client’s Social Security number or refund destination.
Free retirement updates: Keep more of your Social Security and savings with plain-English updates on the changes, deadlines, and costly mistakes retirees miss. Subscribe free.
Why a Preparer’s Office Is a Prime Target for Refund Theft
Tax season concentrates an unusual amount of financial detail in one place. A single preparer’s file cabinet or software account can hold Social Security numbers, dates of birth, bank account and routing numbers, W-2 and 1099 income, and prior-year returns for hundreds of households at once. That density is exactly what makes preparers, especially small and mid-size firms without a dedicated IT staff, an attractive target for criminals who would otherwise have to steal that information one household at a time.
When a thief gets into that data, the most common outcome is not a drained bank balance but a fraudulent tax return filed in the client’s name before the real one goes in. The IRS then has to sort out which return is legitimate, a process that can delay a household’s actual refund by months while the agency verifies identity and issues a paper check instead of a fast direct deposit. For a family counting on that refund to cover a bill or catch up on rent, the delay itself is the financial damage, even when no money is ultimately lost for good.
The IRS’s Own Backstop: The Identity Protection PIN
Multifactor authentication protects the preparer’s side of the transaction; the Identity Protection PIN protects the taxpayer’s side. An IP PIN is a six-digit number known only to the taxpayer and the IRS, and it has to be entered correctly for a return to be accepted under that Social Security number. It is valid for one calendar year, and the IRS generates a new one annually.
Any taxpayer can opt in to an IP PIN by verifying their identity through the IRS’s Get an Identity Protection PIN tool. Confirmed victims of tax-related identity theft do not have to ask; the IRS automatically issues them a new IP PIN every year going forward. Tax professionals cannot request or retrieve an IP PIN on a client’s behalf, which means the decision to add this layer of protection sits with the taxpayer, not the preparer.
Tax Pro Account and Online Account Close the Other Login Gap
MFA and the IP PIN address two different points of failure, but the IRS is also pushing preparers and taxpayers toward its own secure portals rather than paper forms or unsecured email. An IRS Online Account lets an individual taxpayer view tax records, refund status and notices after verifying their identity, and having one makes it harder for a fraudster to create an account in that person’s name first and intercept information meant for them.
On the preparer side, a Tax Pro Account lets a practitioner request power of attorney or tax information authorization from a client and manage those authorizations in real time, without mailing a paper form that could be intercepted or forged. Encouraging both sides of the relationship to use verified, login-gated accounts is part of the same defense as multifactor authentication: fewer places where a thief can insert a fake document or an unauthorized login and have it accepted as real.
A Decade-Old Partnership Behind This Month’s Reminder
The Security Summit, the public-private partnership issuing this month’s guidance, has worked since 2015 to shore up defenses against tax-related identity theft, bringing together the IRS, state tax agencies and the tax preparation industry. This month’s release is the fourth in a five-part summer series aimed at tax professionals, and the topic is also getting attention in person at the 2026 IRS Nationwide Tax Forum, whose final stop runs September 15 through 17 in San Diego.
IRS Chief Executive Officer Frank J. Bisignano framed the push as a matter of using tools that already exist rather than waiting on new ones. Multifactor authentication, IP PINs and secure online accounts, he said, add important layers of security that help safeguard sensitive data held by practitioners, taxpayers and IRS systems. For a household deciding whether to ask a preparer about login security this season, that is the concrete list of what to check.
The Benefits Filed For Too Rarely
This story is about a cybersecurity rule, not a benefit program, but the same theme runs through both: a protection or a program only works if someone actually uses it. Every year, a large share of older adults who qualify for help with heating bills, Medicare premiums or a veteran’s pension never apply, because the programs are opt-in and no agency automatically signs anyone up.
The Benefits Checklist is a 69-page guide covering 11 programs, including LIHEAP heating and cooling assistance, Medicare Savings Programs and VA Pension with Aid & Attendance, and it prints the 2026 income limits and a 50-state phone directory alongside each one.
Look up the income limits and the number to call for LIHEAP, Medicare Savings Programs and VA Pension with Aid & Attendance in The Benefits Checklist.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
