What actions should a tax professional take when the firm experiences a data breach?

Few key steps to follow immediately are: Report immediately to their local IRS Stakeholder Liaison Inform client and advise them to apply for an Identity Protection PIN (IP PIN) Obtain and review clients' tax transcripts. Conduct a security risk assessment, check encryption and access control.

7 Days Free Trial

for Enterprise Subscriptions

Trusted by 250,000+ Professionals for Continuing Education

Create Your Account 1/2

Already have an account? Log In

First Name

Last Name

Phone

Company Name

Password

Confirm Password

Promo Code

I Accept MYCPE ONE Terms and Conditions

You can cancel anytime during your trial period.

Become a Valued Member of MYCPE ONE Professionals Community

Trusted by 250,000+ Professionals

"Steven was knowledgeable and thorough…”

Steven was knowledgeable and thorough in his information about the product and what is offered. He was empathetic to my situation. He went above and beyond answering all of my many questions. Excellent service!

Crystal lovejoy

"Great Customer Service”

Great service and very patient as I asked several questions. Steven answered all my questions and helped me make the right decision in my subscription purchase. Thank you.

Lori corry

"It is what it advertised to be”

It is what it advertised to be. Professional quality training and CPE tracking and certificates; systems knows AZ CPA CPE requirements and categories. I've needed help on several occasions and the assistance was quick and effective; however, there were some problems with data entry. The assistance sometimes asks for input, but when I try to type it is dissallowed for some reason. On several occasions I had to close the popup to get it out of my way.

Brian Carey

"Great customer service”

Great customer service. Classes are pertinent. Great value

Steve

1/4

Create Your Free Account

First Name

Last Name

Email Address

Password

Confirm Password

Continue

Already have an account? Log In

Card No.

Card Holder Name

Expiry Date

CVV

Address

Address 2 (Optional)

Zip Code

I Accept MYCPE ONE Terms and Conditions

Guaranteed safe & secure checkout

Pay $199

How to Prevent Tax Identity Theft: A CPA's Guide to Protecting Client Data

Amrit Singh

Published on: Jul 08, 2025
1049

Accountants and tax professionals handle more than just numbers. You're trusted to protect sensitive client data and prevent identity theft. With 1 in 3 data breaches affecting small businesses, safeguarding client information is now a critical part of your role.

Every data is information that counts. A CPA or EA deals with sensitive information from their clients every day. So, it should be your cardinal principle to protect and maintain the confidentiality and integrity of your client's data.

Understanding the Cyber Threat Landscape

Cybercriminals are becoming more sophisticated. Intensity is always changing because of new technology and laws. Tax professionals hold the most sensitive and valuable client information and become their specific target. Here you need to have a complete knowledge of 2025 Cybersecurity Essentials for Tax Professionals.

Hackers try to trick you with different approaches. Some of the common tactics include:

Phishing: Using fake emails and websites, criminals try to trick you into revealing your sensitive information, like your user ID, password, SSN, and other information. As a tax professional you need to understand and must have Incident Response Planning ready.
Identity-Based Attacks: An extremely hard to detect attack, where a valid user credential is compromised. Adversary disguises itself as a real user.
Malware: Hackers use attachments in emails to send viruses or spyware. When you open this, it infects your network, let the criminals control your computer, even your keystrokes.
DSA: Exploiting the Digital Signature Algorithm (DSA), attackers can recover your private signing key. This often happens due to a poor key generated, a very short key, or improper use. They can replace legitimate tax documents with malicious versions.

The fraud can last months longer, and you might discover this only after an IRS notice or refund delay. Federal law requires you to protect client data.

Essential Security Measures and Legal Requirements

For effective governance and safety for these traps, the government has formed different rules and guidelines. Here are some of the key areas:

IRS Guidelines: To protect taxpayers' data, the IRS has prescribed specific guidelines. Guides like IRS Publication, IR-4557 Safeguarding Taxpayer Data, DSRG 5293, or 5709 for tax professionals. This covers administrative, technical, and physical security aspects. As a tax pro, you can start with Tax Security 2.0: The Taxes-Security-Together Checklist.
AICPA Tax Standards (SSTSs): The Revised AICPA statement on Standards for Tax Services (SSTSs) can be your guide to data protection. Section 1.3 addresses data protection and prescribes the efforts of tax professionals to protect clients' data. There are no hard rules, but a general guidelines to follow.

This includes elements such as data storing practice, Laws and compliances, newly innovated digital tools, and managing third-party data storage. Review your current policies and implement the guidelines for best protection.

Gramm-Leach-bliley Act Safeguards Rule:

Applying to all tax professionals, GLBA requires professionals to have a written information security plan. IRS and FTC are highly involved in compliance demands, and professionals present the written strategies to protect consumers' nonpublic personal information. This is a set of rules, and noncompliance may lead to fines and even the loss of practicing rights.

Global Data Privacy Laws:

When working internationally, tax professionals may face different laws and compliance issues. Rulings like the European Union's General Data Protection Regulation (GDPR) or California Consumer Privacy Act (CCPA), and many others, have different sets of rules and practices to protect clients' sensitive information. Understand the GDPR and Data Protection Strategies for Organizations.

Strategies for Data Security

Build a concrete strategy to prevent Tax Identity Theft. Here are some of the common Data Protection Best Practice to secure your corporate information.

Effortless Progress Tracking: Oversee your entire team's development through a single, user-friendly dashboard.
Implement a Written Information Security Plan (WISP): Federal Law requires you to implement and maintain an information security plan regardless of firm size. Contact a consultant or deploy a staff member to develop data security plans.
Strengthen Email Security: Use anti-phishing software, be vigilant and careful with attachments. Verify requests before sharing sensitive client information.
Implement Strong Password and Key Pin Practice: Create strong password practices using multiple combinations of alphabets, numbers, and special characters. Use a unique password for each account and keep changing at least quarterly.
Secure Outgoing Information and Data in Transit: Use a secure private network only. Use ETE encryption in all sensitive files and emails. Keep your software and OS updated.
Implementing a Multi-Factor Authentication System: MFA is important and strongly recommended by the IRS. The secondary verification, like code, could have prevented many data thefts.

Stay Vigilant, Monito, and Keep Track: Finally, stay awake, stay vigilant, and focus on the nuances. Track your e-filing returns, check your EFIN usage, check PTIN, and review clients' tax transcripts.

Recognizing and Responding to Data Theft

Cyber threats are like chronic diseases. You might be the victim, and completely unaware of it because your identity got theft.

When you receive a larger number of e-filing acknowledgements than you actually did.
Receive clients respond to emails you never actually sent.
Your network is slow or acts abnormally
When your e-filing got rejected due to an already filed return with your SSN.

You are in danger. Your clients' sensitive, most precious information is in danger. Security is compromised. So, act immediately and fight back.

Report to IRS: The very first thing you do is report to the IRS. They will notify the IRS Criminal Investigation and other agencies on your behalf.
Contact state tax agencies: Contact your state tax agency and report your data breach to the Federation of Tax Administrators.

Conclusion

Data privacy is crucial. It has become an integral part of the study curriculum of CPAs and tax professionals. Prepare yourself for a border approach to protect and safeguard your client's private information. This includes the following laws: acting ethically, being good with technology, and managing risks proactively.

Stay updated with the latest technological developments. No single effort guarantees 100% data security. Follow these steps, take the necessary majors and precautions. This is what reasonably expected from CPAs and tax professionals.

FAQs

From adhering federal Law to work beyond the legal requirements, as a CPA you are responsible for taking every security measure to protect client data. How data is stored, adopt current digital tools and practices, level of complexity for data protection plans, software, VPNs, secure software, and strong passwords CPAs are universally expected.

The Gramm-Leach-Bliley Act (GLBA) is a mandatory rule to maintain a document for tax professionals in firms Written Information Security Plan (WISP). This outlines the strategies and procedures a firm will take to protect their clients’ nonpublic personal information.

Established in 2015, the security summit is a collective effort by IRS, state tax agencies, and tech companies to tackle and protect taxpayers' data. This is an awareness program to deal with cyber criminals and encourage strong security practices.

Few key steps to follow immediately are:

Report immediately to their local IRS Stakeholder Liaison
Inform client and advise them to apply for an Identity Protection PIN (IP PIN)
Obtain and review clients' tax transcripts.
Conduct a security risk assessment, check encryption and access control.

About the Author

Amrit Singh

Amrit Singh is a business leader with 10+ years of experience in continuing education. Helping accounting, tax, and finance professionals stay compliant with ease, he began his journey as a consultant. Learning across industries before stepping into a leadership role, he is shaped by both successes and failures. Amrit is passionate about problem-solving, building products, exploring technology, and mentoring future leaders. He is dedicated to transform continuing education, making it simpler, smarter, and more meaningful. Through his blogs and talks, he shares insights on accounting careers, CPA compliance, and the future of continuing education.

Table of Contents