The Internal Revenue Service today encouraged taxpayers to take simple steps to strengthen online security during Cybersecurity Awareness Month, highlighting the role everyone can play in protecting personal, financial and tax information from identity thieves and scammers.
"Criminals continue to look for new ways to steal taxpayer information and exploit trusted partnerships," said IRS Chief Executive Officer Frank J. Bisignano. "Taxpayers and tax professionals can help protect sensitive information and strengthen the security of the tax system by making cybersecurity practices part of their routine year-round."
The IRS joins the Cybersecurity and Infrastructure Security Agency and Security Summit partners in encouraging taxpayers to make cybersecurity part of their daily routine. CISA offers cybersecurity resources that individuals, families, businesses and organizations can use to strengthen their online security.
The IRS recommends using strong, unique passwords for important accounts and considering a password manager, turning on multifactor authentication where available, and installing updates on computers, phones, tablets, apps, browsers and security software, with automatic updates turned on when possible.
Taxpayers should also recognize and report scams, be cautious of unexpected emails, texts, social media messages, phone calls or letters requesting personal or financial information or pressuring them to act immediately, store digital tax records securely with encryption and backups, and avoid using public Wi-Fi to access financial accounts, tax records or IRS online services.
Scammers continue to use U.S. mail, emails, text messages, social media and phone calls to impersonate the IRS and other trusted organizations, promising larger refunds, claiming accounts are locked, demanding immediate payment or directing taxpayers to fake websites. Businesses, payroll professionals and human resources offices should remain alert for phishing, fake invoices, and W-2 and payroll-related schemes, and should verify requests to change sensitive employee or payment information through a trusted channel.
Tax professionals, including enrolled agents, payroll professionals, certified public accountants, attorneys and other tax return preparers, should watch for phishing emails and other schemes designed to steal sensitive taxpayer data, with scammers sometimes posing as prospective clients or using compromised email accounts.
The IRS offers secure online tools including the Identity Protection PIN, Online Account for Individuals, Business Tax Account and Tax Pro Account. Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan to protect client information.
The IRS normally contacts taxpayers the first time by mail, sends emails or text messages only when taxpayers opt in, and never sends direct messages through social media. Taxpayers who receive suspicious tax-related messages should visit IRS.gov/SubmitATip to report the issue, and tax professionals who experience a data breach should report it as soon as possible to their stakeholder liaison.