Your Simple Guide to Tax Security Mistakes for New Businesses
Tax account security starts with a practical boundary: protect your sign-in details, control who receives sensitive records and verify unexpected requests before acting. For a small-business owner, that boundary needs to cover personal tax information as well as the files used by the business, payroll team and accountant.
On October 22, 2026, the IRS reminded taxpayers to safeguard their online-account credentials and consider an Identity Protection PIN, or IP PIN. This is a timely reminder about existing protections, not a new tax deduction or a promise that fraud can be eliminated.
The useful response is a manageable routine. This guide to tax account security explains seven checks, the difference between account protection and return protection, and how to respond when something looks wrong. You can use the examples to start a discussion with your accountant and technology provider without putting passwords into a shared checklist.
Table of contents
- Why this IRS reminder matters
- Understand tax account security before choosing tools
- Seven practical checks for owners
- A request that deserves a second look
- Keep personal and business risks distinct
- What to do when information may be exposed
- Build a simple review routine
- Frequently asked questions
- Conclusion
Why this IRS reminder matters
The IRS reminder dated October 22 focuses on credentials and IP PINs. An individual online account can contain returns, payments, tax records, notices and other sensitive information. The IRS says taxpayers should keep their sign-in information to themselves.
For an owner, tax account security is connected to ordinary business work. A return may move between an owner and preparer; payroll data may be exported for a year-end review; a staff member may receive a request that appears to come from the accountant. Each handoff deserves a clear purpose and an approved channel.
An interruption can also absorb time that a small team needs for billing, collections and payroll. A useful response therefore protects both information and the ability to keep working. Decide who checks an unusual request before a busy employee must make that decision alone.
A tax account security review need not turn every message into a lengthy investigation. Create a repeatable rule for requests involving tax identifiers, employee records, credentials or payment changes. A short independent check is easier to follow than a vague instruction to be careful.
Understand tax account security before choosing tools
Three protections often get discussed together, but they perform different jobs. A sign-in password protects access to an account. Multifactor authentication adds a separate verification step. An IP PIN helps verify an individual’s identity when a covered federal return is filed.
The IRS IP PIN guidance describes a six-digit number associated with an SSN or ITIN. It is not an employer identification number, or EIN, and does not replace the controls needed for business records or account access.
For tax account security, the practical lesson is to avoid relying on one tool for every risk. A business can have organized files while using a shared password. An owner can have an IP PIN while sending sensitive documents to the wrong recipient. Review the handoff as well as the protection itself.
Use a simple question with your providers: which risk does this control address, and which risk remains? Write the answer in plain language. That makes it easier to explain responsibilities when a new bookkeeper, payroll provider or preparer joins the process.
Seven practical checks for owners
The following checks are operational suggestions for reviewing tax account security. Adapt them to your actual systems and obtain specialist assistance where the circumstances require it.
Keep sign-in details with the account holder
An owner may be tempted to send login details so someone else can download a document. A better working arrangement is to identify the precise document needed and agree how it will be obtained and shared. Ask the preparer about the appropriate authorized process instead of treating a personal login as a team resource.
Make tax account security expectations explicit when work begins. For example, a request can name the tax year, document type and secure delivery method. The owner then knows what to retrieve, and the recipient knows what to expect. This reduces back-and-forth without requiring a blanket account handover.
Tax account security becomes harder when an old message containing credentials remains in an inbox. If sign-in details were shared previously, discuss remediation with the account holder and the relevant provider. Avoid circulating the old message again as part of the discussion.
Review passwords and multifactor authentication
The FTC’s small-business cybersecurity guidance recommends strong, unique passwords and multifactor authentication, along with protecting sensitive data. Use those recommendations to ask whether the accounts supporting your tax work have appropriate protections in place.
Include the business email account in the conversation. Tax files and requests may arrive there, and account-recovery messages may depend on it. Ask the technology provider how recovery works if the normal device is unavailable; do not store recovery secrets in the same broadly shared folder as the review notes.
For tax account security, a useful checklist records whether a control was reviewed, who owns it and the date of the review. It does not contain the password, authentication code or recovery secret. Someone reading the checklist should be able to follow up without gaining access to the account.
Decide whether an individual IP PIN is appropriate
An eligible person who can verify their identity can request an IP PIN even without a filing requirement. The PIN is valid for a calendar year, with a new one generated for the next year. Follow the current IRS instructions for enrollment and retrieval rather than assuming last year’s number remains usable.
The October reminder also highlights the usual annual online-system maintenance period beginning in mid-November, with availability generally returning in mid-January. If you are considering enrollment before the next filing season, review the current service information directly on IRS.gov. Enrollment now does not make a 2026 PIN valid for a return filed in 2027.
Treat the PIN as a limited filing credential within your tax account security process. Share it with a trusted tax professional only when it is needed for preparing and submitting the return. An unsolicited request for it should not become part of your normal document-gathering routine.
Verify unexpected requests through a known route
A message may use a familiar name, a professional signature or a tax deadline to create urgency. Those details do not establish that the request is authentic. Before sending information or changing a payment instruction, contact the person through a route you already know.
Tax account security checks should be specific enough for a team member to use. Instead of asking whether an email looks suspicious, ask whether the requested action matches the agreed work. Is this the expected recipient? Is this the expected document? Was a change in delivery method confirmed independently?
Keep a short escalation route for uncertainty. A payroll assistant should know which manager can confirm a request for employee data. A temporary staff member should not have to decide alone whether an urgent message justifies sending a full tax package.
Share the minimum information needed for the task
Before exporting a folder, clarify what the recipient actually needs. A question about a particular transaction may call for selected support rather than a complete return, all payroll records and every bank statement. This is a practical way to make the handoff easier to review.
The IRS’s business identity-theft guidance recommends limiting access to personal data and protecting sensitive files. Apply that principle to recurring requests. Agree the scope of each workstream and review access when the task or relationship changes.
Good tax account security also requires accurate records. A confusing file name can lead someone to send the wrong year’s return. The practices in our guide to good bookkeeping and tax records can help you organize supporting documents so the correct files are easier to identify.
Check who still has access
Review the people and providers who can reach tax folders, payroll exports and relevant business systems. Include former staff, temporary workers and providers whose engagement has ended. Ask whether each person’s access still has a defined business purpose.
For tax account security, record a named owner for each review rather than assuming another team has handled it. If access is removed, retain an appropriate record of that action without placing confidential credentials in the log. If an exception remains, document who approved it and when it will be reconsidered.
This matters as a team grows. Our discussion of systems for a growing workforce explains why informal handoffs become difficult to manage. A short access review can make responsibilities clearer without creating a large administrative project.
Decide how a concern will be reported
Choose the person who receives reports of suspicious requests and the person who coordinates the response. They may need help from the owner, accountant, technology provider or bank. Make the contact route available before a problem occurs, including when the usual manager is away.
Tax account security procedures should make it easy for an employee to say that something may have gone wrong. Ask for a factual description of what was clicked, entered, sent or changed. Prompt, clear reporting is more useful than trying to establish blame before anyone takes action.
Use your business compliance calendar to schedule a review of the procedure. Keep reporting instructions separate from ordinary filing deadlines so an employee understands that an incident should be raised when it occurs.
A request that deserves a second look
Suppose an office manager receives a message that appears to come from the business’s tax preparer. It asks for the owner’s IRS login and a complete employee wage file, explaining that the firm has changed its document process. The message says the information is needed immediately.
This hypothetical example is useful because it contains several separate decisions. The team needs to verify the sender, question the requested access and confirm the file-delivery method. A familiar signature alone does not resolve those questions.
Following the tax account security procedure, the manager pauses the transfer and contacts the preparer using the number already in the engagement records. The preparer confirms that no such request was sent. The manager preserves the message and informs the person responsible for the business’s response procedure.
Tax account security worked here because the team had a decision rule, not because someone recognized a particular spelling error. The same rule would help if the message were polished, used the correct client name or arrived during a busy filing period.
If the preparer had confirmed a legitimate need for a document, the manager would still clarify the scope and agreed channel. Verifying a sender does not mean every requested file or form of access is necessary. Confirm the task as well as the identity.
Keep personal and business risks distinct
An owner’s personal return and a company’s tax administration may be connected in day-to-day work, but the protections are not interchangeable. Tax account security should identify which person, entity, account and return a concern actually involves.
An IP PIN addresses individual return filing using an SSN or ITIN. It should not be presented as a blanket safeguard for returns filed under a business EIN. Likewise, protecting a company’s payroll folder does not establish that the owner’s individual IRS account is secure.
The IRS lists business warning signs such as duplicate-return rejections, unexpected correspondence and missing expected mail after an address change. These are reasons to investigate, not reasons to assume every mismatch proves fraud. Keep the notice or rejection information available for the adviser reviewing it.
If a letter arrives, first establish what it is asking for and how to respond through an authentic channel. Our article on responding to an IRS notice provides a useful record-gathering approach. An account problem should not cause a genuine response deadline to disappear from the team’s attention.
When discussing tax account security with advisers, use precise language. Say whether an issue involves a suspected false return, an account-access alert, a payroll-data disclosure or a suspicious message. The correct next steps depend on that distinction.
What to do when information may be exposed
If someone may have disclosed information or sent money, use the IRS guidance for people who were scammed to identify the relevant response route. It advises stopping interaction with the scammer, avoiding further payments or disclosures, contacting the financial institution when relevant and using official identity-theft reporting resources.
For tax account security, separate immediate containment from later explanation. Tell the appropriate internal contact what happened and involve the relevant service provider. Preserve evidence such as the message, time of the event and the type of information involved. Avoid opening a suspicious attachment again merely to describe it.
Create one factual incident log. It can record who was contacted, what action was advised and which tasks remain open. Store sensitive evidence appropriately, and share it only with the people handling the matter. The log itself should not become another unprotected copy of confidential records.
Ask qualified advisers about any legal, contractual or state notification obligations that may apply. An internal checklist is not a substitute for that assessment. The correct reporting process can differ depending on whether the issue concerns an individual, a business return, employee data or a wider systems incident.
Tax account security recovery also includes checking that ordinary work can continue safely. Confirm which files and systems the team can use, who is responsible for communicating with the preparer and whether any genuine filing or payment matter needs separate attention.
Build a simple review routine
Make the review small enough to repeat. A short scheduled meeting can cover changes in people, providers, shared folders and account-recovery arrangements. Ask each owner to bring a status update, not a list of passwords.
Use the following operational worksheet to turn tax account security into assigned work. Adjust the suggested roles to your organization; they are examples, not legally prescribed responsibilities.
| Review item | Useful question | Example owner |
|---|---|---|
| People | Does everyone with access still need it? | Business manager |
| Files | Is each shared folder limited to a defined purpose? | Accounting lead |
| Accounts | Are shared sign-ins or stale recovery contacts present? | Account holder and technology provider |
| Requests | Do staff know how to verify an unexpected instruction? | Process owner |
| Follow-up | Are exceptions assigned and reviewed? | Owner or designated manager |
Keep your tax account security review brief: reviewed, action needed or specialist follow-up required. Give each open task a named person and a date. That makes the process easier to revisit after staff changes or a new provider starts work.
The goal of tax account security is not to produce a long policy nobody uses. It is to make the safe next action clear during ordinary work. A practical review should answer who is responsible, what is needed and where uncertainty goes for help.
Frequently asked questions
Does an IP PIN replace a strong password?
No. An IP PIN helps verify identity for covered individual return filing. A password and multifactor authentication address account access. Tax account security needs the appropriate protection for each task rather than treating these tools as interchangeable.
Can I give my IRS password to my accountant?
The IRS says taxpayers should not share their sign-in information. Ask your accountant which documents or authorized process are needed. A request for information should specify the task and an appropriate delivery method without assuming your personal account must be handed over.
Will a PIN obtained now work for a return filed next year?
For tax account security planning, remember that an IP PIN is valid for one calendar year. Use the PIN that applies when the return is filed and follow the current IRS retrieval instructions. Do not assume the number obtained in 2026 can be reused in 2027.
Does a suspicious message mean the business has been compromised?
Not necessarily. Receiving a message is different from disclosing information or allowing account access. Record what actually happened and seek the appropriate guidance. Tax account security responses should be based on the facts rather than the sender’s claims or the team’s first impression.
What should a staff member do first with an unusual request?
Pause the requested transfer or disclosure and use the business’s agreed escalation route. Verify the request independently through a known contact. If information or money has already been sent, raise that fact promptly so the response can address the actual exposure.
Conclusion
The latest IRS reminder gives owners a useful reason to review tax account security before the next filing season. Start with credentials, clarify the role of an individual IP PIN and make sensitive document requests easier to verify.
Choose one concrete next action: review who can access the tax folder, confirm how staff contact the preparer or assign responsibility for unusual requests. Keep the process understandable and repeat it as people and systems change.
This article provides general US federal information checked October 24, 2026. It is educational guidance, not a cybersecurity assessment or individualized tax or legal advice.
GET IN TOUCH
Schedule a FREE Call
Connect on our Socials!
