Journey logoJourney

For your clients: staying safe with your tax information

A page to share with clients: what your tax firm will and will not ask for, how to send documents safely, how the IRS really contacts you, and how to report a scam.

Tax season is scam season. Criminals pretend to be tax firms, the IRS and banks because people expect to hear from them. A few simple habits protect you, and they also protect your tax firm.

What your tax firm will and will not ask for

Every firm works a little differently, so ask yours how it communicates. As a general rule:

  • Your firm will not ask you to email sensitive information such as your Social Security number, bank account numbers or copies of ID in an ordinary email. The IRS tells tax professionals that a legitimate business will never ask for personal or sensitive information to be sent by email unless it is through a secure mail service.
  • Your firm will not ask for your passwords or sign-in codes, by phone, email or text. Nobody needs them but you.
  • Be wary of any message saying your firm's bank details have changed, or asking you to pay somewhere new. Call your firm on the number you already know before paying.
  • If a message from your firm feels off, call them. Use the number you have used before, not one in the message.

Send documents through your portal, not email

Email is a poor way to send tax documents. Attachments sit in inboxes indefinitely, get forwarded by mistake, and are exposed if either email account is broken into. The IRS advises tax professionals to avoid sending files by plain email, and the FTC guidance it reproduces tells businesses to caution customers against sending sensitive data by email.

If your firm uses a client portal, upload your documents there instead. And if you ever receive an email that claims to be from your firm and asks you to "log in" through a link, go to the portal the way you normally do rather than clicking.

How the IRS really contacts you

According to the IRS:

  • It normally contacts you the first time by mail, delivered by the U.S. Postal Service.
  • It sends emails or text messages only if you have opted in.
  • A direct message on social media is never from the IRS.
  • A phone call, email or text message is not from the IRS if it is unexpected, rushes you, threatens you, asks for personal or financial information, or demands payment now.
  • The IRS does not call to demand immediate payment with a prepaid debit card, gift card or wire transfer, and does not threaten to have you arrested for not paying.

If you get a letter you are unsure about, send a copy to your tax firm before you act on it.

Reporting a scam

The IRS asks people to report impersonation scams:

  • Email: forward it to phishing@irs.gov.
  • Text message: forward it to 7726 (SPAM), which helps your wireless provider block similar messages.
  • Phone call: report it to the Treasury Inspector General for Tax Administration (TIGTA) Hotline at 800-366-4484.

Get an Identity Protection PIN

An Identity Protection PIN (IP PIN) is a six-digit number from the IRS that prevents anyone else from filing a tax return with your Social Security number or ITIN. Anyone with an SSN or ITIN who can verify their identity can get one, and parents can request one for dependents. A new IP PIN is issued each year.

The IRS says it will never ask for your IP PIN, and that calls, emails or texts asking for it are scams. Give it only to the tax professional preparing your return, when you are ready to sign and file. Get one at irs.gov/ippin.

Protect your own accounts

  • Use a different, strong password for your email, your bank and your tax portal. A password manager makes this easy.
  • Turn on two-step sign-in (multi-factor authentication) wherever it is offered, especially on your email. Your email is the key to resetting everything else.

How Journey helps

If your firm uses Journey:

  • Your portal can ask for a code sent to your email each time you sign in. It is on by default, and your firm's owners and General Managers can turn it off. When it is on, signing in to the portal asks for the emailed code as well as your password. The code is six digits and expires after ten minutes. If the portal can't confirm your code, it asks you to try again rather than opening.
  • You upload documents to your portal rather than attaching them to email. When you or your firm open a file later, Journey hands the browser a link that expires within minutes, rather than a permanent web address.

Sources

Can't find what you need? .