# Protect Your Clients; Protect Yourself > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/agency%3Airs%3A1a72e1bce717e9a0 ## Record - **Collection:** Agency decision - **Document type:** Agency decision ## Text Protect Your Clients; Protect Yourself Data Security Resource Guide for Tax Professionals The Data Security Resource Guide for Tax Professionals is intended to provide a basic understanding of minimal steps to protect client data. All tax professionals are encouraged to work with cybersecurity professionals to ensure secure systems. Protecting taxpayer data from theft and disclosure is your responsibility. Get Started The Security Summit – the partnership between the Internal Revenue Service, state tax agencies and the tax industry – reminds all tax professionals that everyone has a role in protecting taxpayer data. The Financial Services Modernization Act of 1999, also known as Gramm-Leach-Bliley Act, requires certain entities – including tax return preparers – to create and maintain a security plan for the protection of client data. Here are two publications to help you get started: „„ IRS Publication 4557, Safeguarding Taxpayer Data This publication provides an overview of tax professionals’ obligations to protect taxpayer information and provides a step-by-step checklist for how to create and maintain a security plan for your digital network and office. „„ NIST’s Small Business Information Security – The Fundamentals The National Institute of Standards and Technology (NIST) is a branch of the U.S. Commerce Department. It sets the information security framework for federal agencies. It also produced this document to provide small businesses with an overview of those steps to security data. Its focus is on five principles: identify, protect, detect, respond and recover. Don’t forget Publication 1345, Handbook for Authorized IRS e-File Providers, which outlines your responsibility as an Electronic Return Originator, including in the area of e-File security and privacy. What Can You Do? „„ Learn to recognize phishing emails, especially those pretending to be from the IRS, e-Services, a tax software provider or cloud storage provider. Never open a link or any attachment from a suspicious email. Remember: The IRS never initiates initial email contact with tax pros about returns, refunds or requests for sensitive financial or password information. „„ Create a data security plan using IRS Publication 4557, Safeguarding Taxpayer Data, and Small Business Information Security – The Fundamentals, by the National Institute of Standards and Technology. „„ Review internal controls: „„ Install anti-malware/anti-virus security software on all devices (laptops, desktops, routers, tablets and phones) and keep software set to automatically update. 1 „„ Use strong and unique passwords of 8 or more mixed characters, password protect all wireless devices, use a phrase or words that are easily remembered and change passwords periodically. „„ Encrypt all sensitive files/emails and use strong password protections. „„ Back up sensitive data to a safe and secure external source not connected fulltime to a network. „„ Make a final review of return information – especially direct deposit info - prior to e-filing. „„ Wipe clean or destroy old computer hard drives and printers that contain sensitive data. „„ Limit access to taxpayer data to individuals who need to know. „„ Check IRS e-Services account weekly for number of returns filed with EFIN. „„ Report any data thefts or losses to the appropriate IRS Stakeholder Liaison. „„ Stay connected to the IRS through subscriptions to e-News for Tax Professionals, QuickAlerts and Social Media. Learn the Signs of Data Theft You or your firm may be a victim and not even know it. Here are some common clues to data theft: „„ Client e-filed returns begin to reject because returns with their Social Security numbers were already filed; „„ Clients who haven’t filed tax returns begin to receive authentication letters (5071C, 4883C, 5747C) from the IRS; „„ Clients who haven’t filed tax returns receive refunds; „„ Clients receive tax transcripts that they did not request; „„ Clients who created an IRS online account receive an IRS notice that their account was accessed or IRS emails stating their account has been disabled; or, clients receive an IRS notice that an IRS online account was created in their names; „„ The number of returns filed with tax practitioner’s Electronic Filing Identification Number (EFIN) exceeds number of clients; „„ Tax professionals or clients responding to emails that practitioner did not send; „„ Network computers running slower than normal; „„ Computer cursors moving or changing numbers without touching the keyboard; „„ Network computers locking out tax practitioners. Stay Vigilant Stay ahead of the thieves by taking certain actions daily or weekly to ensure your clients and your business remain safe: „„ Track your daily e-File acknowledgements. If there are more acknowledgements than returns you know you filed, dig deeper. 2 „„ Track your weekly EFIN usage. The number of returns filed with your Electronic Filing Identification Number (EFIN) is posted weekly. Go to your e-Services account, access your e-file application and check “EFIN Status.” If the numbers are off, contact the e-Help desk. Keep your EFIN application up-to-date with all phone, address or personnel changes. „„ If you are a ‘Circular 230 practitioner’ or an ‘annual filing season program participant’ and you file 50 or more returns a year, you can check your PTIN account for a weekly report of returns filed with your Preparer Tax Identification Number (PTIN.) Access your PTIN account and select “View Returns Filed Per PTIN.” File Form 14157, Complaint: Tax Return Preparer, to report excessive using your PTIN or misuse of PTIN. „„ If you have a Centralized Authorization File (CAF) Number, make sure you keep your authorizations up to date. Remove authorizations for taxpayers who are no longer your clients. See Publication 947, Practice Before the IRS and Power of Attorney. „„ Create your IRS online accounts using the two-factor Secure Access authentication, which helps prevent account takeovers. See IRS.gov/secureaccess to review necessary steps. Data Lost or Stolen? Report It Quickly Contact the IRS and law enforcement: „„ Internal Revenue Service, report client data theft to your local Stakeholder Liaison. „„ Federal Bureau of Investigation, your local office (if directed.) „„ Secret Service, your local office (if directed.) „„ Local police – To file a police report on the data breach. Contact states in which you prepare state returns: „„ Email the Federation of Tax Administrators at StateAlert@taxadmin.org to get information on how to report victim information to the states. „„ State Attorneys General for each state in which you prepare returns. Most states require that the attorney general be notified of data breaches. Contact experts: „„ Security expert – to determine the cause and scope of the breach, to stop the breach and to prevent further breaches from occurring. „„ Insurance company – to report the breach and to check if your insurance policy covers data breach mitigation expenses. For a complete checklist, see Data Theft Information for Tax Professionals. 3 Stay Connected The IRS attempts to alert tax professionals as quickly as possible when it learns of a new scam, which are especially common during the filing season. Sign up so you can stay up to date with the latest alerts and tax administration issues: „„ e-News for Tax Professionals – A weekly digest of important tax news geared for tax practitioners „„ QuickAlerts – An urgent messaging system regarding e-File for tax professionals who have e-Services accounts. „„ IRS social media – The IRS uses several social media outlets to connect with tax pros and with taxpayers. You can follow us at: „„ Twitter.com/IRStaxpros. „„ Twitter.com/IRSnews. „„ Facebook.com/IRStaxpros. IRS Security Bookmarks: „„ Identity Protection: Prevention, Detection and Victim Assistance – Main identity theft page „„ Data Theft Information for Tax Professionals – How to report client data loss to the IRS „„ Protect Your Clients; Protect Yourself – Awareness campaign and scam alerts for tax pros „„ Taxes. Security. Together. – Awareness campaign for taxpayers „„ Identity Theft Information for Tax Professionals – An overview „„ Report Phishing and Online Scams – How to report IRS-related scams „„ How IRS Identity Theft Victim Assistance Works – What clients can expect „„ Maintain, Monitor and Protect Your EFIN – Protect your IRS-issued identification numbers „„ Secure Access – How to authenticate your identity to access IRS online tools „„ Security Summit – Track safeguards enacted by IRS, states and industry „„ Newsroom – Stay in the know by subscribing to IRS News Releases „„ Stakeholder Liaisons Local Contact – find your local contact to report data losses Publication 5293 (5-2018) Catalog Number 71256E Department of the Treasury Internal Revenue Service www.irs.gov 4 --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/agency%3Airs%3A1a72e1bce717e9a0. Public record. Not legal advice.