The IRS and its partners in the Security Summit are once again steering taxpayers toward a simple tool that can stop identity thieves from filing a tax return in someone else’s name. On September 4, 2026, the agency issued IR-2026-106, the fourth release in its “Protect Your Clients; Protect Yourself” summer series, urging both tax professionals and individual taxpayers to use an Identity Protection PIN, multifactor authentication, and a secured IRS Online Account. For anyone who has ever worried about a stranger claiming their refund before they can file, the mechanics of the PIN are worth understanding now, well before the next filing season starts.
How the Six-Digit PIN Locks Out a Fraudulent Return
An IRS Identity Protection PIN, or IP PIN, is a six-digit number known only to the taxpayer and the IRS. When a federal tax return is filed, the IRS uses that number to verify the filer’s identity, which means a thief who has stolen someone’s Social Security number still can’t successfully file a return in that person’s name without also knowing the PIN. The number is valid for one calendar year only, and the IRS generates a new one automatically each year, so there’s no risk of an old, possibly compromised PIN staying valid indefinitely. The IRS treats the PIN as one of the strongest single defenses available to an individual taxpayer precisely because it doesn’t depend on a bank, a credit bureau, or an employer catching the fraud after the fact; it stops the fraudulent return from being accepted in the first place.
Free retirement updates: Social Security and Medicare change every year, and nobody sends you a memo. Our free Retirement Shield newsletter breaks down what changed and what to do. Get it free in your inbox.
You Have to Get Your Own PIN: Even Your Tax Preparer Can’t
One detail in the IRS release is easy to miss: tax professionals cannot obtain an IP PIN on behalf of a client. Taxpayers have to opt in themselves, through the Get an Identity Protection PIN tool on IRS.gov, which requires verifying your identity directly with the agency. The one exception is anyone who has already been a confirmed victim of tax-related identity theft; those taxpayers are automatically issued a new IP PIN every year going forward without having to re-enroll. For everyone else, enrollment is voluntary, which means the protection only exists for the households that actually go set it up, and the IRS has been actively encouraging more people to opt in rather than wait until after they’ve already been victimized.
Multifactor Authentication Is Now a Requirement at Tax Prep Firms
The same release also addresses the professionals who hold client tax data. Under the Federal Trade Commission’s Safeguards Rule, tax preparation firms are required to use multifactor authentication to protect access to customer information, unless a Qualified Individual at the firm approves an equivalent secure access control in writing. Multifactor authentication requires at least two independent ways of verifying a user’s identity, such as a password plus a code sent to a separate device, and the IRS says the requirement applies to preparation firms regardless of size, from a solo preparer to a large regional practice. The agency’s recommended best practices include enabling MFA across every service that touches client data, from tax software to cloud storage to email, and never sharing login credentials between staff. The IRS frames this specifically as a shield for the client data preparers hold, not just their own accounts, on the theory that a firm’s login credentials are one breach away from exposing every Social Security number the firm has on file, which is exactly the kind of bulk data theft that fuels large-scale refund fraud.
The IRS Will Never Call, Email, or Text to Ask for Your PIN
The release closes with a warning that cuts against the very tool it’s promoting: the IRS says it will never call, email, or text a taxpayer to request their IP PIN, and anyone who receives such a request should treat it as an attempted scam. IP PIN holders are told to share the number only with the IRS itself and their own trusted tax preparer, never with an unsolicited caller claiming to need it to “verify” a return or release a refund. The agency is also encouraging both taxpayers and tax professionals to set up an IRS Online Account or Tax Pro Account, which it says helps prevent fraudsters from creating an account in someone else’s name in the first place. An IRS Online Account lets a taxpayer see their own tax records, payments, and notices directly, which closes off one more avenue a thief could otherwise use to intercept information before the real taxpayer ever sees it.
IR-2026-106 is one of five installments in this year’s summer education series, part of a public-private Security Summit partnership between the IRS, state tax agencies, and the tax industry that has run since 2015. IRS Chief Executive Officer Frank J. Bisignano said in the release that using an IP PIN, multifactor authentication, and other protections “adds important layers of security” for practitioners, taxpayers, and IRS systems alike. Tax professional security is also a focus of the final 2026 IRS Nationwide Tax Forum, set for September 15 through 17 in San Diego, which the release lists alongside the digital tools as part of the same push. Taken together, the three tools the IRS is highlighting this month, the IP PIN, multifactor authentication, and a secured Online Account, cost nothing to set up and don’t require waiting for filing season to start, which is exactly why the agency keeps repeating the message months before the next return is due.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
