The Internal Revenue Service, state tax agencies and the tax industry today urged tax practitioners to maintain and monitor their Electronic Filing Identification Numbers (EFINs) and Centralized Authorization File (CAF) numbers to help safeguard taxpayer data.
Cybercriminals sometimes post stolen EFINs, PTINs and CAF numbers on the Dark Web as a crime kit for identity thieves who can then file fraudulent tax returns. EFINs are necessary for tax professionals or their firms to file client returns electronically. Preparer Tax Identification Numbers (PTINs) are issued to those who, for a fee, prepare tax returns or claims for refund. CAF numbers are issued when tax practitioners or their firms file a request for third-party access to client files.
Tax professionals should update their EFIN application within 30 days of any change, including if there are new personnel, telephone numbers, addresses or email addresses. Keeping the application up-to-date means any correspondence from the IRS will go to the correct person and the correct address. EFINs can only be obtained from the IRS. They are not transferable should a business be sold. Also, new office locations may need their own EFIN if the new location files tax returns.
Tax pros should make a weekly check of their EFIN to determine how many returns were filed under their number. Practitioners should select “EFIN status” from their EFIN application within e-Services. If the number is too large, tax pros should contact the IRS e-Help Desk to make a report.
Additionally, tax pros who are attorneys, CPAs, enrolled agents or participants in the Annual Filing Season Program and who file 50 or more returns also can check the number of tax returns with their PTIN processed by the IRS in the current year. The information is updated weekly and can be located by going to their online PTIN account and selecting “View Returns Filed Per PTIN.” Both the EFIN and PTIN status checks can help quickly identify any unusual activity.
Tax professionals can protect their EFINs from theft by avoiding phishing emails, which cybercriminals commonly use to trick practitioners into disclosing sensitive information. Practitioners can review the Don’t Take the Bait campaign to familiarize themselves and their staffs with the various tactics used by thieves.
A CAF number is a unique nine-digit identification number. It is assigned the first time a recognized representative files a power of attorney or third-party authorization with the IRS. Practitioners use their assigned CAF number on all future authorizations.
Tax professionals should make an annual review to identify outstanding third-party authorizations for people who are no longer their clients. Practitioners should review the instructions for Form 2848, Power of Attorney and Declaration of Representative, or Form 8821, Tax Information Authorization, for additional information on withdrawing representation.
To better protect tax professionals and taxpayers, the IRS toll-free telephone assistors now request additional identity-proofing information from tax practitioners. In instances where practitioners are reluctant to provide additional identity-proofing information, for example the client is present in the practitioner’s office at the time they are filing the return, the tax practitioner should either ask the client to step outside or put them on the phone to make an oral authorization to the IRS assistor.
The IRS, state tax agencies and the tax industry, acting as the Security Summit, have made inroads in their battle against tax-related identity theft. Summit partners need the help of all tax professionals to help maintain that progress and better protect taxpayers. See Protect Clients, Protect Yourself for more information as well as Publication 4557, Safeguarding Taxpayer Data, a checklist for creating a data security plan.