Multi-Factor Authentication for Tax Preparers
Security Six requirement #3: A password alone is no longer enough. MFA is mandatory on every system that accesses client tax data — including email, tax software, and cloud storage.
Why MFA is non-negotiable
Stolen passwords are the #1 way attackers access tax preparer systems. Phishing emails, credential stuffing, and data breaches from other sites all expose your passwords. MFA adds a second verification step — even if your password is compromised, attackers can’t get in without the second factor.
Both the IRS (Publication 4557) and FTC (Safeguards Rule) mandate MFA on all systems that access customer financial data. This includes your tax preparation software, email accounts, cloud storage, remote desktop access, and any practice management tools.
Types of MFA (strongest to weakest)
Where to enable MFA in your tax practice
Tax preparation software
Drake, Lacerte, ProConnect, UltraTax — all major platforms support MFA. Enable it for every user account.
Email accounts
Email is the #1 phishing vector. Every email account that sends or receives client data must have MFA enabled.
Cloud storage & portals
ShareFile, SmartVault, Dropbox, Google Drive — any cloud service storing client files needs MFA on every user.
Remote access tools
RDP, VPN, TeamViewer, AnyDesk — if you access your office network remotely, MFA is mandatory on the connection.
MFA for tax preparers — FAQ
SMS-based MFA is technically acceptable but not recommended. SMS codes are vulnerable to SIM-swapping attacks where criminals port your phone number to their device. The IRS and cybersecurity experts recommend authenticator apps or hardware security keys instead. If SMS is your only option, it’s still far better than no MFA at all.
Yes. Every user account that accesses client data must have its own MFA enrollment. Sharing accounts or MFA tokens between employees defeats the purpose and violates the access control requirements of both the IRS and FTC. Each employee should have a unique login with their own authenticator app or security key.
All major tax software platforms now support MFA. If yours doesn’t, that’s a serious red flag — consider switching to a platform that does. In the meantime, you can add a layer of protection by requiring VPN access to reach the software, which adds network-level authentication on top of the application login.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
- Know what applies
- Document the evidence
- Make the safeguard operational
A defensible path
- 01
Confirm the requirement
Separate what is required from recommendations and vendor language.
- 02
Map it to your environment
Connect the rule to people, devices, data, vendors, and current procedures.
- 03
Close and document the gaps
Prioritize changes and keep evidence that the process is being followed.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.