Security Summit Summer Series Wrapped Up, but the Data Security Lessons Apply All Year
The IRS recapped its 2026 Protect Your Clients; Protect Yourself series: current scams, the WISP requirement, ID theft tools and breach steps.
What the IRS announced
In Tax Tip 2026-72 (Oct. 1, 2026), the IRS said that it and its Security Summit partners have wrapped up their annual five-week Protect Your Clients; Protect Yourself campaign. The series is aimed at tax professionals. It covers the latest scams that target them, security measures, and what to do if data theft occurs.
The IRS notes that the information is relevant year round, not only during the summer. If you prepare returns for self-employed clients and small businesses, including those who file Schedule C, you hold a lot of sensitive data. This is a good time to review how you protect it.
Scams targeting tax professionals
The IRS reminds tax pros to review their security practices, train their employees, and be cautious of unsolicited requests. Some of the most common scams right now are:
- IRS impersonation by email, text or phone
- Misleading tax advice on social media
- "New client" schemes
- Scams involving EFINs, PTINs and CAF numbers
The IRS also names three common types of phishing scams designed to trick people into giving up personal information: spear phishing, clone phishing and whaling. The series covers warning signs, security measures to prevent an incident, and actions to take if one happens.
A Written Information Security Plan is required by law
Tax and accounting professionals are required by law to have a Written Information Security Plan (WISP). A WISP describes ways to protect client data from identity theft and data breaches. The IRS offers Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, to help you develop, maintain and update your plan.
If your office does not have a plan yet, or has not looked at it in a while, Publication 5708 is the IRS resource to start with.
Tools to fight tax identity theft
The series highlights several tools that help with authentication, along with their benefits and best practices:
- Multifactor authentication
- IRS Identity Protection PIN (IP PIN)
- Secure IRS online accounts
The IRS says all of these help protect clients' sensitive information, and that tax pros should stay alert and use every tool and resource available.
If a breach occurs
The IRS lists three steps for tax professionals:
- Report the incident to a local IRS Stakeholder Liaison so the IRS can take steps to block fraudulent returns.
- Report the breach to the appropriate state tax agency through the Federation of Tax Administrators' Report a Data Breach webpage.
- Inform affected clients and recommend protective steps, such as getting an Identity Protection PIN or, when appropriate, completing Form 14039, Identity Theft Affidavit.
What to tell your team and your clients
- Staff: be cautious with unsolicited emails, texts, calls and "new client" requests, and review your security practices and training.
- Your practice: confirm that you have a WISP and that it is kept up to date, using Publication 5708.
- Clients after a data incident: tell them promptly and recommend protective steps such as an IP PIN or Form 14039 when appropriate.
For more information and tools, the IRS points to Identity Theft Central and Data Theft Information For Tax Professionals on IRS.gov. It also lists IRS verified social media platforms and e-News subscription services where tax-related information is available.
Informational only, based on the IRS source linked above; not tax or legal advice for a specific situation.