The Internal Revenue Service today encouraged taxpayers to take simple steps to strengthen online security during Cybersecurity Awareness Month, highlighting the role everyone can play in protecting personal, financial and tax information from identity thieves and scammers.
"Criminals continue to look for new ways to steal taxpayer information and exploit trusted partnerships," said IRS Chief Executive Officer Frank J. Bisignano. "Taxpayers and tax professionals can help protect sensitive information and strengthen the security of the tax system by making cybersecurity practices part of their routine year-round."
The IRS joins the Cybersecurity and Infrastructure Security Agency and Security Summit partners in encouraging taxpayers to make cybersecurity part of their daily routine. CISA offers cybersecurity resources that individuals, families, businesses and organizations can use to strengthen their online security.
The IRS recommends using strong, unique passwords and a password manager, turning on multifactor authentication, and installing updates on computers, phones, tablets, apps, browsers and security software, with automatic updates enabled when possible. It also advises taxpayers to recognize and report scams, store digital tax records securely, encrypt sensitive files, back up important information and avoid public Wi-Fi when accessing financial accounts, tax records or IRS online services.
Scammers continue to use U.S. mail, emails, text messages, social media and phone calls to impersonate the IRS and other trusted organizations, promising larger refunds, claiming accounts are locked, demanding immediate payment or directing taxpayers to fake websites. Businesses, payroll professionals and human resources offices should remain alert for phishing, fake invoices, and W-2 and payroll-related schemes designed to steal employee information, credentials or money, and should verify requests to change sensitive employee or payment information through a trusted channel.
Tax professionals, including enrolled agents, payroll professionals, certified public accountants, attorneys and other tax return preparers, should watch for phishing emails and other schemes designed to steal sensitive taxpayer data. Scammers may pose as a prospective client or use a compromised email account to persuade tax professionals to open malicious links or attachments.
The IRS offers secure online tools including the Identity Protection PIN, Online Account for Individuals, Business Tax Account and Tax Pro Account. Federal law also requires tax and accounting professionals to create and maintain a Written Information Security Plan to protect client information.
The IRS normally contacts taxpayers the first time by mail, sends emails or text messages only when taxpayers opt in, and never sends direct messages through social media. Taxpayers who receive suspicious tax-related mail, emails, text messages or social media messages should visit IRS.gov/SubmitATip to report the issue, while tax professionals who experience a data breach should report it as soon as possible to their stakeholder liaison.