10/02/2026
Fall has arrived, but the Security Summit summer series information is relevant year round
The summer days have passed, and with them, the 2026 Summer Security Summit series concluded as well. Recently, the IRS and its Security Summit partners wrapped up their annual five-week Protect Your Clients; Protect Yourself campaign. The series is geared toward tax professionals and highlights the latest scams that target tax professionals, security measures and what to do if data theft occurs.
Highlights of the 2026 Security Summit summer series
New and emerging scams targeting tax pros: Tax professionals are reminded to review their security practices, train their employees, and be cautious of unsolicited requests. Some of the current most common scams are IRS impersonation via email, text, or phone, misleading tax advice on social media, “new client” schemes, and scams involving EFINs, PTINs, CAF numbers.
Evolving threats and countermeasures: Spear phishing, clone phishing and whaling are some of the most common types of phishing scams designed to trick recipients into providing personal information. There are warning signs, security measures to prevent an incident, and actions to take if there is a security incident.
The federal requirement to have a Written Information Security Plan: Tax and accounting professionals are required, by law, to have a Written Information Security Plan. A WISP includes ways to protect client data from identity theft and data breaches. The IRS has resources such as Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice to help develop, maintain, and update these plans.
Strengthen defenses against tax identity theft: There are several tools available that can aid in authentication. This includes multifactor authentication, IRS Identity Protection PIN or IP PINs and secure IRS online accounts. The benefits and best practices are highlighted for each. All these tools help protect clients’ sensitive information.
Tools and advice to help protect sensitive data: Tax pros must stay alert and utilize all tools and resources to protect sensitive taxpayer information.
What tax professionals should do if a breach occurs:
Report the incident to a local IRS Stakeholder Liaison so the IRS can take steps to block fraudulent returns.
Report the breach to the appropriate state tax agency through the Federation of Tax Administrators’ Report a Data Breach webpage.
Inform affected clients and recommend protective steps, such as obtaining an Identity Protection PIN or, when appropriate, completing Form 14039, Identity Theft Affidavit.
