Tax season brings a lot of sensitive information together in one place: Social Security numbers, bank details, payroll records and prior returns. That makes it attractive to identity thieves. In October 2026, the IRS issued two reminders about protecting tax information: IR-2026-119, tied to Cybersecurity Awareness Month, and IR-2026-127, focused on online account credentials and the Identity Protection PIN. Here is what they mean for business owners.
Everyday security habits the IRS recommends
The IRS encourages taxpayers, businesses and other organizations to make these steps part of their routine:
- Strong, unique passwords. Use different passwords for important accounts and consider a password manager.
- Multifactor authentication. Turn it on wherever it is available to add an extra layer of protection.
- Software updates. Keep computers, phones, tablets, apps, browsers and security software updated, with automatic updates on when possible.
- Secure storage. Store digital tax records securely, encrypt sensitive files and back up important information.
- Secure networks. Avoid public Wi-Fi when accessing financial accounts, tax records or IRS online services.
Watch for fake invoices and payroll schemes
The IRS specifically warns that businesses, payroll professionals and human resources offices should stay alert for phishing, fake invoices, and W-2 and payroll-related schemes designed to steal employee information, credentials or money. A common pattern is a request to change an employee's direct deposit account or a vendor's payment details.
The IRS advice is simple: verify requests to change sensitive employee or payment information through a trusted channel. In practice, that can mean calling the person at a phone number you already have on file rather than replying to the email that made the request.
Know how the IRS actually contacts you
According to the IRS, it normally makes first contact by mail. It sends emails or text messages only when taxpayers opt in, and it never sends direct messages through social media. The IRS will never call to demand immediate payment, threaten arrest or say you are due a refund. Suspicious tax-related messages can be reported through IRS.gov/SubmitATip.
Use the IRS Business Tax Account
The IRS Business Tax Account lets eligible businesses view their account balance, make and review payments, see IRS notices and letters, and access tax records such as transcripts. The IRS also notes that a new EIN verification notice can now be downloaded from the account. Availability depends on the type of entity and the user's role. For example, the IRS says the account is not yet available for LLCs that file as sole proprietors on Schedule C.
Checking your account regularly can help you spot activity you do not recognize sooner.
Request an IP PIN before November 16
An Identity Protection PIN is a six-digit number that prevents someone else from filing a federal tax return using your Social Security number or ITIN. It is known only to you and the IRS, and you can get one even if you are not required to file.
Timing matters this year. The IRS says the online IP PIN system will be offline for maintenance starting Monday, November 16, 2026, until mid-January 2027. Owners who want an IP PIN through their online account for the 2027 filing season should request it before then. The IRS will never call, email, text or use social media to ask for your IP PIN, and it should be shared only with a trusted tax professional when your return is ready to file.
A note on data held by your tax professional
Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan, or WISP, to protect client information. IRS Publication 5708 provides a sample plan. When choosing who handles your tax information, it is reasonable to ask how your data is protected.
A short security checklist
- Turn on multifactor authentication for email, banking, payroll and IRS accounts.
- Confirm any change to direct deposit or vendor payment details by phone.
- Review your IRS Business Tax Account or Individual Online Account for unfamiliar activity.
- Request an IP PIN online before November 16, 2026, if you want one for next season.
- Back up and encrypt files that contain tax records.
- Report suspicious IRS messages instead of responding to them.
Every business is different. A qualified tax professional can help you review how these steps apply to yours.
Sources
- IRS: Cybersecurity Awareness Month offers simple steps to protect tax data (IR-2026-119, Oct. 2, 2026)
- IRS: Take steps now to protect tax information (IR-2026-127, Oct. 22, 2026)
- IRS: Get an Identity Protection PIN
- IRS: Business Tax Account
- IRS Publication 5708, Creating a Written Information Security Plan for your Tax and Accounting Practice
This article is for general educational purposes and is not tax or legal advice for any specific situation.
