IRS E-File Account Security Requirements for Tax Pros

IRS e-file account security is not a single setting you turn on. Tax professionals must protect Electronic Filing Identification Number (EFIN) access, keep their IRS e-file application information accurate, safeguard taxpayer data, and maintain a written information security program where applicable. In 2026, the practical baseline is unique user access, multi-factor authentication (MFA) wherever the IRS system supports it, strong account recovery controls, documented procedures, staff training, and a tested response plan for suspicious activity.

IRS Publication 3112 is the IRS guide for becoming and remaining an authorized e-file provider. It requires providers to protect their EFIN and related credentials from unauthorized use and to report changes that affect their application information. Your EFIN is an authorization identifier, not a shared office login.

Start with the IRS rules that apply to your firm

The IRS publishes several documents that work together. Publication 3112 covers the IRS e-file application, suitability process, EFINs, responsible officials, and provider responsibilities. Publication 4557 gives tax return preparers security guidance for protecting taxpayer data. Publication 5708 explains the security expectations for tax professionals and discusses a written information security plan.

The Federal Trade Commission (FTC) Safeguards Rule can also apply to professional tax preparation firms because they handle customer information as financial institutions under the rule. The FTC's Safeguards Rule guidance describes requirements such as a written security program, a qualified individual, risk assessment, safeguards, service-provider oversight, and incident-response planning. Whether a particular requirement applies to your structure is a legal and compliance question to review with counsel.

For a working explanation of these operational duties, see our guide to tax safeguard compliance 4557.

Protect the account around the IRS portal

A firm can follow IRS portal instructions and still create risk through the systems surrounding the account. An attacker who gets into a preparer's email, password manager, workstation, or phone number may be able to reset accounts, impersonate staff, or search for taxpayer records.

Use access controls that are easy to audit

• Give every employee a separate work email and separate application accounts.
• Require MFA for email, tax software, cloud storage, remote access, and password-manager access.
• Use a password manager so staff can create long, unique passwords without storing them in browsers, notes, or spreadsheets.
• Restrict EFIN-related records and taxpayer documents to staff who need them for their role.
• Keep an access-change log that shows who approved new access and when former access was removed.

The NIST password guidelines 2026 guide can help you set a password policy that emphasizes unique passwords, password managers, and phishing-resistant sign-in methods where available. Pair that policy with the role-based controls in our tax-firm access control guide.

Make your written security plan usable during tax season

A written information security plan, often called a WISP, should connect your policy to actual office behavior. It should identify the taxpayer data you hold, the systems that store or transmit it, the people responsible for safeguards, the risks you have assessed, and the controls you use to address those risks. It also needs a process for staff training, vendor review, access changes, backups, and incident response.

Do not file a WISP away as a template. Review it after a material change, such as opening another location, adopting new tax software, adding a managed service provider, or changing how remote staff access client data. Firms with more than one office should define who can grant access and who reviews alerts centrally. Our guide to multi-location tax office centralized security management explains why that ownership matters.

If you need a starting point, review the practical WISP requirements first. Bellator also offers a custom WISP starting at $749 for up to 5 users, with a custom quote for larger practices. For a small firm, a tailored plan can reasonably avoid 20 to 40 billable hours of assembling, adapting, and organizing documentation, but it does not replace the firm's responsibility to follow and review the plan.

What to do if you suspect unauthorized access

Act quickly, preserve evidence, and avoid making assumptions about what an alert means. Change exposed credentials from a known-clean device, revoke active sessions where the affected service supports it, document the time and indicators you observed, and contact your technology provider or incident-response resource. Your reporting obligations can depend on the facts, contracts, insurance policy, and applicable law, so involve counsel when appropriate.

The IRS provides reporting channels and instructions for suspected tax-related identity theft and e-file concerns. Start with the IRS's current Identity Theft Central resources, then follow the escalation procedures in your firm's WISP. For prevention, train staff on the patterns behind phishing attacks on tax professionals, especially credential-reset lures and fake document-sharing notices.

The practical standard for 2026

For most tax firms, the best next step is not a new product. It is confirming that named people, protected accounts, documented procedures, and monitored devices match the way your office actually works. That creates evidence you can review, makes staff changes safer, and gives you a clearer starting point if something goes wrong.