Identity thieves are increasingly targeting tax data, but utilizing multifactor authentication, Identity Protection PINs, and IRS online accounts creates overlapping layers of security to block fraudulent activity. 1. Multifactor Authentication (MFA): MFA strengthens access points by requiring at least two distinct verification methods, such as a password combined with a biometric scan or a security code sent to your device. This severely limits the damage from stolen passwords, social engineering, and phishing attacks. For added security across the industry, the Federal Trade Commission's Safeguards Rule explicitly requires tax preparation firms to implement MFA to protect sensitive customer information. 2. Identity Protection PIN (IP PIN): An IP PIN is a unique six-digit number, known only to you and the IRS, that prevents criminals from filing fraudulent returns using your Social Security Number or ITIN. The IRS generates a new IP PIN every calendar year for participating taxpayers. While confirmed victims of tax-related identity theft receive one automatically, any taxpayer can proactively opt into the program to lock down their federal return. You should never share this PIN with anyone other than your trusted tax preparer, as the IRS will never call, text, or email you to request it. It's a good preemptive strategy to prevent scammers from filing a false return and claiming a refund. 3. Secure IRS Online Accounts: Registering for an Individual Online Account gives you direct access to view your tax information while immediately blocking a fraudster from setting up a rogue account in your name. This account portal is also the fastest way to opt into the IP PIN program and retrieve your new number each year. Receive a notice or a scam phone call? You can verify the provided information is correct by cross referencing what is on the IRS Online Account. Relying on just one of these methods is no longer sufficient; combining strong password practices with an IP PIN and a verified online account provides a much stronger defense against unauthorized access than using any single tool alone.
