Beginning in late October, 2017, all e-Services users must re-register and re-validate their identities using a more rigorous, two-factor authentication process called Secure Access. Two-factor authentication means returning users must enter their credentials (username and password), plus a security code sent via text to a mobile phone or to the IRS2Go app on a mobile device. Two-factor authentication helps prevent e-Services accounts from being taken over by cybercriminals who may be adept at stealing passwords but are unlikely to have the user’s mobile phone. Preventing account takeovers helps protect taxpayer and tax practitioner data and helps prevent the filing of fraudulent tax returns.
I’m a TIN Matching user. Do I need to register through Secure Access?
Yes. All e-Services products will be protected by Secure Access. That means all e-Services users must validate their identities using the Secure Access registration process.
Last December, I received Letter 5903 which asked me to call the e-Help Desk to verify my identity, which I did. Do I need to revalidate?
Yes. If you validated your identity by phone after receiving Letter 5903, you still must authenticate your identity by updating your e-Services account through Secure Access. All current e-Services users, who have not registered for other IRS.gov tools protected by Secure Access, must validate their identities by using Secure Access registration.
I registered for Get Transcript Online last year using Secure Access. What do I need to do?
If you created an IRS account last year using a tool protected by Secure Access, for example Get Transcript Online or Get an IP PIN tools, your authentication information automatically will migrate to Secure Access, including your existing e-Services username. Once e-Services moves behind Secure Access, you will be asked to change your e-Services password.
Can I change my user name when I register through Secure Access?
No. Your e-Services username is permanent and cannot be changed.
Can I change my e-Services password?
Although your username is permanent and will remain the same, you will be asked to change your password to meet new password protocols.
As a taxpayer, I passed Secure Access last year when I registered through the Get an IP PIN tool. I used a different username and password because it is a personal account. How does this affect me?
If you have a personal account for either Get Transcript Online, IP PIN or any Secure Access-protected tool on IRS.gov, your identity information will be replaced by your e-Services login information and will be used for accessing all tools protected by Secure Access, including your personal accounts as a taxpayer.
How do I get started with verifying my identity through e-Services?
Before you start, read up on Secure Access at www.irs.gov/secureaccess. This page also contains tips for successfully passing Secure Access.
Here are a few items you will need:
- A readily available email address;
- Your Social Security number;
- Your filing status and address from your last-filed tax return;
- Your personal account number from a:
- credit card, or
- home mortgage loan, or
- home equity (second mortgage) loan, or
- home equity line of credit (HELOC), or
- car loan (The IRS does not retain this data)
- A readily available mobile phone. Only U.S-based, text-enabled mobile phones may be used. Your name must be associated with the mobile phone account. Landlines, Skype, Google Voice or similar virtual phones as well as phones associated with pay-as-you-go plans cannot be used;
- If you have a “credit freeze” on your credit records through Equifax, it must be temporarily lifted before you can successfully complete this process.
- The credit card cannot be American Express, a debit card or a corporate card issued in your name by your company or organization.
What is the difference between the various “codes” used by Secure Access?
There are three codes:
- A one-time confirmation code is sent to your email address as you begin the registration process and is valid for 15 minutes.
- A one-time activation code is sent during the registration process to validate your mobile phone.
- May be sent to your mobile phone and is valid for 10 minutes or;
- May be mailed to your address of record if you lack a mobile phone associated with your name and is valid for 30 days
- A six-digit security code generated each time you login to e-Services:
- May be sent to your mobile phone and is valid for 10 minutes or;
- May be generated via IRS2Go app and is valid for 60 seconds.
Can several users register the same mobile phone?
No. The system allows only one user per device.
How can I register through Secure Access if I have a business mobile phone and do not have a personal mobile phone associated with my name?
There is an option to receive an activation code by mail. This option will allow you to receive an activation code within five to 10 days, return to Secure Access and complete the process by entering any text-enabled mobile phone number. The mailed activation code is valid for 30 days.
If I get an activation code by mail, do I still need a mobile phone?
No. Starting in late October, we will have the IRS2Go app available for use on mobile devices in lieu of the mobile phone requirement. Upon completing the activation code process, you will be prompted to provide a text-enabled mobile phone number OR use the IRS2Go app in lieu of a text to receive the recurring security code. IRS2Go can be used on many types of mobile devices such as smart phones and tablets. This includes products supported by Apple, Android and Amazon.
What is the benefit of the IRS2Go app?
After you have successfully registered through Secure Access, the app will generate a security code for e-Services users. You do not need to be connected to the Internet to receive a security code through the app. But you do need an app-enabled mobile device such as a smart phone or tablet. This is to assist those users who may be in offices that do not receive cell service or are not Internet connected.
If we use the IRS2Go app, can several people use the same tablet?
No. Each individual must have his or her own mobile device, such as a smart phone or tablet.
I don’t have Internet service at work, can I still use IRS2Go app?
Your app-enabled device will need to be connected to the Internet to complete an initial, one-time set up and receive a one-time digital key. However, after this set up, the app itself will generate a security code as needed and do so offline. Your device does not need to be connected to the Internet to generate the security code.
Is there an option to have a landline instead of a digital device to receive security codes?
The IRS is working toward an option that would send a voice text to your landline phone, but it is not available at this time.
Where can I get the IRS2Go app?
The IRS2Go app is available for free at iTunes App Store, Google Play and Amazon. It will work on mobile devices powered by Apple (iPhone and iPad), Android (phones and tablets by Google, Samsung and other manufacturers) or Amazon (Amazon Fire tablets.) This app will be available in late October.
I’m unable to register through Secure Access, what is my option?
Beginning in late October, if you are an existing e-services customer and cannot authenticate your identity through Secure Access, you may call the e-Help Desk and verify your identity over the phone using our trusted customer process. If you successfully authenticate your identity via phone, the IRS assistor will issue you an activation code. You must return to the Secure Access registration to complete the process by providing a mobile phone number or establishing IRS2Go, which will enable you to receive the recurring security code.
What do I need to successfully authenticate my identity by phone?
You will need your most recent and prior year tax returns as well as documents such as information returns and associated schedules.
Can I skip the online process and call the e-Help Desk to authenticate?
It is much faster and easier to authenticate your identity online. We will add additional telephone support assistors in late October, but we do anticipate an increased call volume.
I hired several new employees who have failed the online Secure Access process. Can they use the exception process?
No. The exception process is only for existing e-Services users. If you hire employees who do not currently have an e-Services account, they cannot use the exception process