You set up multi-factor authentication (MFA) on your IRS Tax Pro Account by verifying your identity through ID.me, the identity verification provider the IRS uses for its online tools, and then choosing an MFA method, such as an authenticator app, security key, or text message code, during that process. Tax Pro Account is the IRS's free online portal that lets tax professionals submit Power of Attorney (Form 2848) and Tax Information Authorization (Form 8821) requests electronically instead of mailing paper forms, and the IRS built ID.me's MFA requirement into every account so a stolen password alone can't unlock your clients' tax records.
If you're setting this up for the first time in 2026, plan for 15 to 30 minutes. Identity verification with ID.me is the slow part; the MFA setup itself takes a couple of minutes.
Quick Answer
To enable MFA on your IRS Tax Pro Account, go to IRS.gov, select Tax Pro Account, and sign in or create an account through ID.me. During ID.me identity verification you'll upload a government-issued photo ID, complete a selfie or video call, and then choose an MFA method: an authenticator app such as Google Authenticator or Authy, a physical security key, or SMS text codes. Save your backup codes before you finish, since losing your MFA device without them means repeating identity verification from scratch.
What Is Tax Pro Account, and Why Does the IRS Require MFA?
Tax Pro Account is a free IRS online tool that lets tax professionals request client authorizations, Power of Attorney or Tax Information Authorization, without mailing paper forms and waiting weeks for CAF unit processing. Multi-factor authentication (MFA) is a login method that requires two or more separate proofs of identity, typically a password plus a one-time code or physical security key, so a compromised password alone can't grant access to an account.
The IRS routes identity verification and login security for Tax Pro Account, your individual IRS Online Account, and e-Services through ID.me, a third-party identity verification provider. ID.me requires MFA on every account it protects, which means you cannot access Tax Pro Account with a password alone regardless of your own firm's internal policies.
This matters beyond compliance. Tax professionals are a standing target for credential theft: the phishing attacks on tax professionals guide covers how attackers impersonate the IRS or software vendors specifically to harvest preparer logins, because one compromised Tax Pro Account or e-Services credential can expose the tax records of every client tied to that preparer.
How to Set Up MFA on Tax Pro Account
Start sign-in at IRS.gov
Navigate to the Tax Pro Account page on IRS.gov and select Sign in to Tax Pro Account. First-time users select Create Account and are routed to ID.me.
Verify your identity with ID.me
Upload a government-issued photo ID (driver's license, state ID, or passport) and complete a selfie match, or a live video call with an ID.me agent if automated matching fails.
Choose your MFA method
Select an authenticator app (Google Authenticator, Authy), a security key such as a YubiKey, or text/voice message codes. ID.me and the IRS recommend an authenticator app or security key over SMS, which is more vulnerable to SIM-swapping.
Save your backup codes
Download or record the one-time backup codes ID.me generates. These are your only recovery path if you lose your MFA device without repeating identity verification.
Confirm access to Tax Pro Account
Log back into Tax Pro Account with your new MFA method to confirm you can submit Form 2848 and Form 8821 requests.
Watch for lookalike login pages
Only enter your ID.me credentials and MFA codes at the official id.me or irs.gov domains. Researchers have repeatedly documented phishing campaigns that impersonate IRS or ID.me login pages to steal Tax Pro Account and e-Services credentials, and no legitimate IRS or ID.me prompt will ask you to read a one-time code back over the phone or by text.
What If ID.me Can't Verify Your Identity, or You Lose Access?
ID.me's automated identity verification fails for ordinary reasons: a blurry ID photo, a name mismatch between your ID and your credit file, or address history that doesn't match public records. When automated matching fails, ID.me offers a live video call with a verification agent during standard business hours, where you show your ID and answer identity questions instead of waiting on a support ticket.
If you lose your MFA device, a phone with your authenticator app, or a security key, and don't have your backup codes, you'll need to go through ID.me identity verification again to regain access. There's no phone-call reset with the IRS; the process runs entirely through ID.me by design, since a phone-based shortcut would recreate the exact social-engineering risk MFA exists to close.
Each tax professional needs their own Tax Pro Account tied to their own PTIN (Preparer Tax Identification Number) and their own ID.me identity, MFA included. You cannot share one Tax Pro Account and one MFA method across multiple preparers at a firm, even a small one; every preparer who submits authorizations sets up their own account and their own MFA.
How This Fits Your Firm's Broader Security Requirements
Setting up MFA on Tax Pro Account satisfies the IRS's own login requirement, but it covers only one system. The FTC Safeguards Rule (16 CFR Part 314) has required MFA for anyone accessing your firm's customer information systems since June 2023, covering your tax software, email, and file storage, not just IRS accounts. IRS Publication 4557 requirements 2026 lay out the broader data safeguarding standards the IRS expects preparers to follow, and the IRS's own IRS Security Six checklist lists MFA as one of six baseline controls alongside antivirus software, a VPN, backup, encryption, and a designated data security responsible party.
If your firm hasn't documented these controls yet, an IRS WISP template gives you the Written Information Security Plan (WISP) structure the FTC Safeguards Rule and Publication 4557 both call for, mapping the MFA setup you just completed to a written policy an examiner or cyber insurer can review. You can also read more on general online tax filing security risks in 2025 and 2026 for context on the threats these controls are meant to reduce.
Action Checklist
- Enable MFA on your IRS Tax Pro Account through ID.me
- Choose an authenticator app or security key over SMS where possible
- Save your ID.me backup codes somewhere other than your primary device
- Enable MFA on your tax software, email, and e-Services accounts, not just Tax Pro Account
- Document your MFA policy in your firm's WISP
- Train staff to recognize IRS or ID.me phishing attempts before entering credentials
Key Takeaway
MFA on Tax Pro Account protects your IRS login, but the FTC Safeguards Rule expects MFA across every system that touches client tax data, not just the ones the IRS controls directly.
Book a Free Tax Cybersecurity Assessment
Get plain-language help closing the gaps between your IRS account security and your firm's broader WISP obligations. No pressure.
Frequently Asked Questions
No. The IRS and ID.me do not call, text, or email asking you to read back a one-time code or reset your MFA over the phone. Treat any such contact as a phishing attempt and verify by going directly to IRS.gov.
Yes, ID.me offers SMS or voice call codes as an MFA option. An authenticator app or a physical security key is more resistant to SIM-swapping attacks, where a criminal transfers your phone number to a new device to intercept text codes.
Tax Pro Account and e-Services are separate IRS systems with different functions, but both rely on ID.me for identity verification and MFA. You may need to complete identity verification separately for each system depending on which IRS tools you use.
No. The FTC Safeguards Rule requires MFA across the systems your firm uses to access customer information, including tax software, email, and file storage. Tax Pro Account MFA only covers your login to that one IRS tool, so it doesn't by itself satisfy the broader rule. Confirm specific compliance obligations with your firm's counsel or compliance advisor.
You cannot access Tax Pro Account at all. ID.me identity verification and MFA setup are mandatory steps built into the account, not optional add-ons you can skip or defer.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
