IRS Form 14039-B: Data Theft Reporting for Preparers

IRS Form 14039-B, the Business Identity Theft Affidavit, is the form a business files when its own Employer Identification Number (EIN) has been used to file a fraudulent business tax return. It is not the form most tax preparers need when a client's Social Security number is stolen from their office systems. That distinction matters, because filing the wrong form, or skipping the actual breach-reporting process, can slow down the IRS response and leave clients exposed longer than necessary.

If your firm has experienced a data breach, ransomware attack, or stolen device containing client tax data, this guide explains which form applies to your situation and what the IRS actually requires you to do first.

What Form 14039-B Actually Covers

Form 14039-B lets a business report that its EIN was used without authorization to file a fraudulent business tax return, such as a Form 1120, 1120-S, 1065, 1041, or an employment tax return. This is distinct from Form 14039 (the individual Identity Theft Affidavit), which a person files when their SSN is used to file a fraudulent individual return.

For a tax preparation firm, Form 14039-B applies in a narrower scenario than most people assume: it's the correct form if your firm's own EIN was hijacked and used to file a return you didn't submit, or if someone impersonated your business to claim a fraudulent refund or credit under your business tax ID. It is not designed as the reporting channel for a breach where a hacker steals your clients' personal information from your office network.

What to Do When Client Data Is Stolen

The IRS treats a client-data breach as a separate event from business identity theft, with its own reporting sequence outlined in IRS Publication 4557. If your firm discovers unauthorized access to client tax records, from a phishing compromise, stolen laptop, or ransomware incident, the IRS asks preparers to:

• Contact your local IRS Stakeholder Liaison right away; they coordinate the agency's response and can flag affected taxpayer accounts for extra fraud screening
• Email the Federation of Tax Administrators at StateAlert@taxadmin.org so state tax agencies where your clients reside can be alerted, since state notification laws vary
• File a report with local police and, for larger incidents, consider notifying the FBI's Internet Crime Complaint Center
• Determine which specific clients were affected and notify them so they can watch for signs of misuse

These steps come directly from the IRS's guidance for tax professionals and are separate from, and generally more urgent than, filing Form 14039-B. Reviewing the full form 4557 requirements before an incident happens makes this response much faster when it counts.

Why the Confusion Happens

Preparers often search for Form 14039-B after a breach because it's the most visible IRS identity-theft form tied to "business" in its name. But the IRS's actual data-theft reporting process for tax professionals runs through the Stakeholder Liaison and state notification channels first, Form 14039-B only becomes relevant in the narrower case where a fraudulent business return was filed under your firm's own EIN, separate from any theft of client information.

Confirming which scenario you're in before you file anything saves time and avoids submitting the wrong paperwork while your clients remain unprotected. If you're unsure, your Stakeholder Liaison can tell you directly whether Form 14039-B applies to your situation.

Preventing the Next Incident

Data theft reporting is a reaction to a problem that a documented security program is meant to prevent. The IRS and FTC require tax preparers to maintain a written information security plan covering access controls, encryption, and incident response. A wisp checklist can help you confirm your plan actually meets the documentation standard examiners expect, and reviewing current irs cybersecurity requirements alongside your ptin renewal security requirements keeps your compliance obligations aligned in one place. Many breaches preparers report each filing season trace back to the same handful of gaps covered in our overview of common tax preparer security threats.