Cybersecurity Awareness Month: How to Protect Your Tax Information Before Filing Season
October is Cybersecurity Awareness Month, and on October 2, 2026 the IRS used the occasion to remind taxpayers that criminals are still working hard to steal tax information. Filing season is only a few months away. Now is a good time to lock down the accounts and documents a thief would need to file a fake return in your name or take your refund.
Here is a plain-language look at what the IRS and the Federal Trade Commission (FTC) recommend, plus the warning signs worth watching for.
Six simple security habits the IRS recommends
In its October 2 reminder, the IRS listed these everyday steps:
Use strong, unique passwords for every account. A password manager can help you keep track of them.
Turn on multifactor authentication, which asks for a second code before anyone can log in.
Install software and device updates. Automatic updates make this easier.
Learn to spot scams. Be cautious with any unexpected email, text, call or social media message asking for personal or financial information.
Protect digital tax records with encryption, and keep backups.
Avoid public Wi-Fi when you log in to financial accounts or tax services.
The IP PIN: a six-digit lock on your tax account
One of the most useful tools the IRS offers is the Identity Protection PIN, or IP PIN. It is a six-digit number that prevents someone else from filing a federal tax return using your Social Security number or ITIN. According to the IRS, anyone who has an SSN or ITIN and can verify their identity is eligible. Parents and guardians can also request one for dependents.
The fastest way to get one is through your IRS Online Account. An IP PIN is valid for one calendar year, and a new one is created each year. If you use the online option, you retrieve your new PIN online each year. The IRS online tool is available from mid-January through mid-November. Keep in mind that an incorrect or missing IP PIN will cause an e-filed return to be rejected, so store it somewhere safe.
Most important of all: the IRS says it will never ask you for your IP PIN. Any phone call, email or text asking for it is a scam.
How to tell if it is really the IRS
The IRS starts most contact through regular mail from the U.S. Postal Service. The agency also says it will not call to demand immediate payment by gift card, prepaid debit card or wire transfer. It will not threaten to have local police arrest you for not paying. If you receive a suspicious email claiming to be from the IRS, forward it to phishing@irs.gov. You can report other suspicious contacts through IRS.gov/SubmitATip.
Warning signs your tax identity may be stolen
The IRS lists several red flags, including:
Your e-filed tax return is rejected.
You receive a Form W-2 or 1099 from an employer you never worked for.
You get a Form 1099-G for unemployment benefits you never applied for.
You receive an unreported income notice, such as a CP2000, that does not match your records.
Your Social Security account shows wages you did not earn.
If you suspect identity theft, the IRS recommends that you stop interacting with the thief, update your Online Account password, report the theft, follow the recovery steps at IdentityTheft.gov, then get an IP PIN. The FTC also notes that credit monitoring will not alert you when someone uses your Social Security number to file a tax return. A free credit freeze with Experian, TransUnion and Equifax is another layer of protection.
Where we can help
Our Personal Tax Advisory team works with clients in all 50 states on tax filing, IRS notices and year-round planning. If a letter or a rejected return has you worried, Request a Private Consultation to review your situation with us one on one.
Sources
This article is for general educational purposes only and is not tax, legal, or financial advice. Tax rules change and every situation is different. Information is current as of October 7, 2026. Upscale Tax Professionals is not a law firm.
Comments