IRS warns tax preparers that cyberattacks can delay taxpayer refunds
The IRS and its Security Summit partners are warning tax professionals that a compromised preparer account or computer system can expose taxpayer information, enable fraudulent filings and delay legitimate refunds.
The national warning is part of the five-week “Protect Your Clients; Protect Yourself” campaign launched July 7, 2026. The campaign is being reinforced through the IRS Nationwide Tax Forums, including the New Orleans forum taking place August 4-6.
What the IRS is warning about
The campaign identifies several schemes aimed at tax professionals. They include IRS impersonation by email, text, phone or direct message; misleading tax advice posted on social media; malicious messages from supposed new clients; and attempts to steal professional credentials and records, including an Electronic Filing Identification Number, or EFIN, a Preparer Tax Identification Number, or PTIN, and Centralized Authorization File, or CAF, information.
The IRS says criminals may pose as prospective clients and send links or attachments disguised as tax documents. Preparers are being urged to verify unusual requests through trusted channels instead of clicking unexpected links or opening files from unfamiliar contacts.
Why taxpayers can be affected
Taxpayers may not know when a preparer’s system has been compromised, but stolen Social Security numbers, income records or tax-account information can be used to submit fraudulent returns. A return can also be selected for identity verification, delaying a refund even when the taxpayer filed a legitimate claim.
The Taxpayer Advocate Service reported that, from January 1 through April 18, 2026, the IRS selected about 2.6 million returns for review through its Taxpayer Protection Program and released about 1.2 million of the associated refunds. The report said 887,000 refunds were released after taxpayers completed identity verification, while 269,000 were released using IRS records without taxpayer interaction.
Those selections do not mean every return was fraudulent. The Taxpayer Advocate Service has warned that IRS filters can also hold legitimate returns, creating delays while taxpayers verify their information.
The watchdog also reported that more than 500,000 identity-theft victim assistance cases remained open and that victims were waiting about 20 months on average for the IRS to resolve their cases or release refunds. That is an identity-theft case-resolution figure, not the normal timeline for an IRS refund.
Safeguards the IRS is emphasizing
The IRS is telling tax professionals to use multifactor authentication, train employees, verify unusual requests and keep security procedures current. It also says tax professionals must maintain a written information security plan under applicable law.
The plan should be tailored to the size, scope and complexity of the business and to the sensitivity of the customer information it handles. IRS guidance says the plan should address employee training, information systems, system failures, risk assessment, safeguards and oversight of service providers. It should also be reviewed and updated as the business changes.
If a tax professional suspects a data breach, the IRS says the incident should be reported quickly to the agency’s Stakeholder Liaison and to the appropriate state tax agency. Early reporting can give the IRS a chance to block fraudulent returns filed in clients’ names and help guide the preparer through the response process.
Steps taxpayers can take
People who use a paid preparer can ask how the firm protects client data, whether it uses multifactor authentication and whether it maintains a written information security plan. Taxpayers should be cautious about unsolicited messages requesting passwords, tax credentials, payment information or an Identity Protection PIN.
Taxpayers with a Social Security number or Individual Taxpayer Identification Number can request a free IRS Identity Protection PIN. The PIN is a unique six-digit number known to the taxpayer and the IRS and is issued for use on federal tax returns. It helps verify the taxpayer’s identity, but it is not a guarantee against every type of tax fraud and does not promise an immediate refund.
The IRS says taxpayers must verify their identity before receiving an IP PIN. People who cannot complete the process online or by phone may have other options, including submitting Form 15227 when eligible or making an appointment at a Taxpayer Assistance Center.
What happens next
The IRS forums and summer campaign provide guidance and prevention measures; they do not create new tax rules or enforcement powers. After the New Orleans session, the remaining 2026 Nationwide Tax Forums are scheduled for New York City on August 18-20, Orlando on September 1-3 and San Diego on September 15-17.
Sources
Discover more from Interactive News
Subscribe to get the latest posts sent to your email.
