WASHINGTON — The Internal Revenue Service and the Security Summit partners give details to “Protect Your Clients; Protect Yourself” by reminding tax professionals to stay vigilant and strengthen safeguards to protect against identity theft. In the first half of the year there were nearly 300 data breaches reported impacting as many as 250,000 clients.
Common schemes include:
Fake “new client” schemes: Fraudsters pose as prospective clients, sending malicious attachments or links to steal login credentials or install malware.
Phishing emails: Designed to trick people into sharing sensitive information, such as passwords, Social Security numbers, Central Authorization File (CAF) information or into clicking harmful links.
Other scams: Calls, texts, fake printed correspondence and misleading social media posts to gain access to client data. Social media scams circulating inaccurate or misleading tax information.
Tax pros should watch for red flags from clients such as:
IRS Online Account created or accessed without consent.
Unrequested tax transcripts.
Incorrect IRS balance-due statements notices.
Refunds without filing a tax return.
Business warning signs include:
Unusual computer activity, slow performance or being locked out of systems.
Returns rejected because a Social Security number was already used.
Receiving unexpected IRS authentication letters or e-filed acknowledgments.
IRS notifications involving unrepresented clients or a compromised CAF number.
Prevention tools
The IRS offers tools to help tax pros to “Protect Your Clients; Protect Yourself.”
Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice PDF. A template for writing a WISP which is required by law.
Security Six: anti-virus software, firewalls, backup software or services, encrypted drives, MFAs and virtual private networks or VPNs.
IRS Identity Protection PIN Opt-In Program: Six-digit PINS to protect clients from someone else filing a tax return using their SSN.
Beat bad actors: Report data theft immediately
If a breach occurs:
Report it to a local IRS Stakeholder Liaison to alert the IRS to take steps to block fraudulent returns.
Notify the state tax agency using Federation of Tax Administrators’ Report a Data Breach web portal.
Inform affected clients and recommend steps obtaining an Identity Protection PIN or completing Form 14039, Identity Theft Affidavit PDF.
Source-
https://www.irs.gov/pub/irs-pdf/p5293.pdf