On September 4, 2026, the IRS and Security Summit issued IR-2026-106, encouraging taxpayers and tax professionals to strengthen their defenses against tax-related identity theft.
Add More Than a Password
Multifactor authentication, or MFA, requires at least two independent factors to verify a user’s identity. Depending on the service, those factors may include a password, a code sent to a device, or biometric information.
The IRS recommends enabling MFA anywhere sensitive tax or client information is stored or accessed, including tax software, cloud storage, and email. It also advises using individual accounts rather than sharing usernames or passwords. Tax preparation firms are subject to the Federal Trade Commission’s Safeguards Rule and generally must use MFA to protect access to customer information unless a Qualified Individual approves an equivalent control in writing.
Consider an Identity Protection PIN
An IRS Identity Protection PIN, or IP PIN, is a six-digit number known only to the taxpayer and the IRS. It helps the IRS verify a taxpayer’s identity when a federal return is filed. The number is valid for one calendar year, and the IRS generates a new one each year.
Taxpayers must obtain their own IP PIN; a tax professional cannot obtain one for a client. The IRS says an IP PIN should be shared only with the IRS and a trusted tax preparation provider. The agency will not call, email, or text to request it.
Use Secure IRS Accounts
The IRS also encourages taxpayers to create an IRS Online Account after completing identity verification. A secure account lets eligible users view tax account information and can help prevent a fraudster from creating an account in the taxpayer’s name.
Tax professionals can use Tax Pro Account for supported authorization requests and eligible client information. Availability and permitted actions depend on the account, authorization, and current IRS service rules.
Why It Matters for Schedule C Filers
A sole proprietor may keep tax returns, income and expense records, payment details, and other sensitive information online. MFA, unique credentials, careful handling of IP PINs, and secure access to IRS services can reduce exposure when a password is stolen, although no single control prevents every form of identity theft.
Simple-C helps Schedule C filers keep bookkeeping records organized — while strong account security and appropriate access controls remain essential for protecting sensitive data.
This article provides general information, not tax or cybersecurity advice. Security requirements and IRS services can change. Confirm current details on IRS.gov and applicable regulatory guidance.