On October 2, 2026, the IRS issued IR-2026-119, encouraging taxpayers, tax professionals, and businesses to make online security part of their routine during Cybersecurity Awareness Month and throughout the year.
What the IRS Recommended
The IRS highlighted everyday steps that help protect personal, financial, and tax information:
- Use strong, unique passwords for important accounts and consider a password manager.
- Turn on multifactor authentication when available.
- Install updates for devices, apps, browsers, and security software; enable automatic updates when possible.
- Be cautious of unexpected messages or calls requesting sensitive information or pressuring you to act immediately.
- Store digital tax records securely, encrypt sensitive files, and back up important information.
- Avoid public Wi-Fi when accessing financial accounts, tax records, or IRS online services.
These practices can reduce risk, but they do not guarantee protection against every scam or data breach.
Watch for Impersonation and Payment Scams
Scammers may impersonate the IRS through mail, email, text messages, social media, or phone calls. Their messages may promise a larger refund, claim an account is locked, demand immediate payment, or direct taxpayers to fake websites.
Businesses, payroll professionals, and human resources teams should also watch for fake invoices and W-2 or payroll-related schemes. Verify requests to change employee or payment information through a trusted channel rather than relying on the message itself.
The IRS normally makes its first contact with taxpayers by mail. It sends emails or text messages only when taxpayers opt in and never sends direct messages through social media. Although the IRS may call about account matters, private collection agencies may call only after the IRS has sent written notice to the taxpayer and the taxpayer’s representative and the agency has sent its own confirmation letter. The IRS will not call to demand immediate payment, threaten arrest, or say a taxpayer is due a refund.
Do not click links, open attachments, or respond to unexpected messages claiming to be from the IRS. Start from IRS.gov to locate official services and reporting guidance.
IRS Tools and Reporting Options
An Identity Protection PIN (IP PIN) is a six-digit number that helps prevent another person from filing a federal tax return using your Social Security number or individual taxpayer identification number. It is not a substitute for protecting account credentials and business records.
The release also points to Individual Online Account, Business Tax Account, and Tax Pro Account for available secure account services. Taxpayers who receive suspicious tax-related contacts can visit IRS.gov/SubmitATip to find the appropriate reporting option. Tax professionals who experience a data breach should report it promptly to their IRS stakeholder liaison.
Why It Matters for Small Business Owners
Tax records, payroll information, and payment instructions can all be targets for criminals. Pair organized bookkeeping with secure storage, backups, and independent verification of sensitive requests.
Simple-C helps Schedule C filers organize income, expenses, and supporting records. Keeping records organized does not replace cybersecurity safeguards or the need to verify suspicious contacts.
This article provides general information, not tax or cybersecurity advice. Confirm current IRS guidance and consult a qualified professional about your circumstances.