With tax season fast approaching, the Internal Revenue Service (IRS) and its Security Summit partners have issued urgent new warnings for the 2025/2026 filing season. Cybercriminals are becoming increasingly sophisticated, moving beyond simple email scams to complex social engineering and text message fraud (“smishing”).
Identity theft can delay your refund for months and damage your financial credit. To help you stay safe, we have compiled the essential guide to the IRS’s latest recommendations for protecting your data and your dollars.
1. The “Gold Standard” of Protection: Get an IP PIN
The single most effective tool the IRS offers to prevent tax-related identity theft is the Identity Protection PIN (IP PIN).
- What it is: A six-digit number known only to you and the IRS.
- How it works: If an electronic return is filed with your Social Security number (SSN) but missing this PIN, the system automatically rejects it. It essentially “locks” your tax account.
- Who can get one: Everyone. The IRS has expanded this program (the “IP PIN Opt-In Program”) to all taxpayers who can verify their identity.
- Action Item: Visit the Get an IP PIN tool on IRS.gov. You must retrieve a new IP PIN every January.
2. Secure Your “IRS Online Account”
Many taxpayers don’t realize they can (and should) have an online account with the IRS, similar to a bank account.
- Why it helps: You can view your payment history, balance, and key tax records. More importantly, by claiming your account, you prevent a thief from creating one in your name to steal your data.
- The 2026 Update: The IRS has strengthened authentication protocols. Ensure you have Multi-Factor Authentication (MFA) enabled, meaning you need a code sent to your phone in addition to your password to log in.
3. Watch for the “Dirty Dozen” & New Smishing Tactics
The IRS releases an annual “Dirty Dozen” list of scams, and 2025 has seen a massive rise in text message scams (Smishing).
- The Trap: You receive a text saying, “Your account has been put on hold,” or “Unusual activity detected on your tax profile,” with a link to a fake website.
- The Red Flags:
- Urgency: “Act now or you will be arrested/fined.”
- Wrong Links: URLs that look like irs.gov.website.com or irs-tax-help.org (The real IRS only uses IRS.gov).
- Unsolicited Contact: The IRS never initiates contact via text message, email, or social media to demand payment or request personal info.
4. Be Wary of “Ghost” Preparers
Not all tax “professionals” have your best interests at heart. The IRS warns against Ghost Preparers—unscrupulous preparers who charge fees but refuse to sign the tax return they prepare for you.
- The Risk: If they don’t sign it, it looks like you self-filed. If they promise a “bigger refund” by inflating deductions, you are solely liable for the fraud, not them.
- The Fix: Always check the preparer’s PTIN (Preparer Tax Identification Number) and ensure they sign the return digitally or physically.
5. Protect Your W-2 and Personal Data
Identity theft often happens long before you file taxes.
- Employer Awareness: Criminals often target HR departments with “Business Email Compromise” (BEC) scams to steal W-2 forms for all employees. Encourage your employer to verify requests for employee data verbally.
- Wi-Fi Hygiene: Never download sensitive documents or check your IRS account while connected to public Wi-Fi (like a coffee shop) unless you use a Virtual Private Network (VPN).
We take your data seriously
Tortolano & Company uses industry-leading encryption, continuous staff education, and actively prevents new and emerging threats from harming our clients. We proudly sign every return, and your personal data is never sent overseas to be prepared “behind the scenes.” Protect yourself and your family this tax season! Get started now at (603) 501-7100 or info@tortolanoandco.com.