IRS employees must always verify the taxpayer’s identity per IRM 13.1.16.4.1.1, Authorized Disclosures, before discussing any information protected under IRC 6103.

This policy applies to the centralization of the identity proofing and authentication processes in customer contact channels (correspondence, telephone/voice, in-person, remote in-person (video teleconferencing), and online exchanges) where sensitive information is exchanged with individuals.
Non-digital channels: correspondence, telephone, in-person/remote in-person assistance.
Digital channels: online services/applications including website and mobile applications.

Relevant Federal guidelines include:

The Director of Identity Assurance (IA), within Privacy Governmental Liaison and Disclosure, (PGLD), is responsible for the identity verification and authentication policy.
The Director of IA reports to the Chief Privacy Officer and is responsible for IA program oversight.
Organization Executives and Management Officials who lead programs described in this policy are responsible for these guidelines and for continuous monitoring of new and ongoing authentication policies related to these channels.
IA's role is to strengthen and implement IRS authentication standards for:

Business Units are responsible for completing their own review. Management officials bear the responsibility to conduct risk assessments, of factors, procedures, and processes used to authenticate taxpayers, representatives or other third-parties interacting with the IRS. See Form 15295 , Non-Digital Authentication Risk Assessment (NDARA). The Identity Assurance function manages and reviews the Authentication in Digital and Non-Digital Channels Program at least once every two years. For more information regarding NDARAs, please refer to IRM 10.10.2, Authentication Risk Assessments in Non-Digital Channels.
Goals, measures and operating guidelines are listed in each business unit’s yearly Program Letter or other management guidance. Quality data and guidelines for measurement are referenced in IRM 21.10.1, Embedded Quality (EQ) Program for Accounts Management, Campus Compliance, Field Assistance, Tax Exempt/Government Entities, Return Integrity and Compliance Services (RICS), and Electronic Products and Services Support.

The below table lists commonly used terms and definitions relevant to this program that are used throughout this IRM:

The following table lists acronyms and definitions frequently used throughout this IRM section:

Below are the related resources:

In the event an inadvertent disclosure occurs or an unauthorized access takes place, see the following IRMs for guidance, IRM 10.5.1, Privacy and Information Protection, Privacy Policy, IRM 10.5.4, Privacy and Information Protection, Incident Management Program, IRM 10.5.5, Privacy and Information Protection, Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance and Requirements, and IRM 11.3.1, Disclosure of Official Information, Introduction to Disclosure.
The following table lists the primary sources of guidance:

This subsection of the IRM provides guidance and procedures for IRS employees in Austin Submission Processing Campus ITIN Operations, Accounts Management Customer Service Representatives, and Field Assistance. The following identity proofing process will be used when securing information from the caller to verify the applicant in question and to compare it to the information on the Real Time System (RTS), W-7 Application View screen during the ITIN disclosure process.

You must also verify the relationship of the caller to the applicant before disclosing any information. The following signature relationships are reflected on RTS:

The RTS captures the relationship of the person who signed the Form W-7 as well as the name if other than the applicant. The table below provides additional guidance for signature verification.

If a caller indicates that they are a Certifying Acceptance Agent(CAA), and is inquiring about the status of an application, refer them to their signed CAA agreement and have them call the number listed in the agreement.

This subsection of the IRM provides guidance and procedures for the IRS Acceptance Agent (AA) Program. Use the following table to authenticate a customer and their authority to receive information about an Acceptance Agent application:

This subsection of the IRM provides guidance and procedures for:

This subsection of the IRM provides guidance and procedures for:

This subsection of the IRM provides guidance and procedures for Wage and Investment (W&I) and Small Business/Self Employed (SB/SE) Business Operating Divisions (BODs) handle taxpayer contacts when

This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. Use the following identity proofing process to verify the requestor’s identity for Required IMF Authentication Probes. Request and validate the correctness of:

For first time filers, if the return is not completely processed or rejected, you can verify:

For Required BMF Authentication probes, the following information should be requested:

This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. The following identity proofing process will be followed when Accounts Management employees are conducting additional taxpayer authentication. If conditions require for additional taxpayer authentication, the use of the IAT Disclosure Tool is mandated. If the tool is down, then manual authentication is required.

After required authentication is completed, the IAT Disclosure Tool will allow you to choose any tax year. When possible, you should select the most recent year available to attempt additional high-risk authentication, or the most appropriate year depending on any specific account conditions or available tax documents. You may also select from a list of previous years, including a tax year where there is no processed return. If there is enough data present on the year selected, the tool will provide a series of ≡ ≡ or more random questions from at least ≡ different data sources. In addition, the IAT TPP HRA Tool is mandated for the Taxpayer Protection Line.

If there is not enough data present in the year selected, the tool will provide an option to choose a different year. If there is not enough data from the ≡ ≡ ≡ ≡ most current filings, then you may use the tool’s manual authentication process. It will provide a drop-down menu of the available sources listed above and then you can choose a source to manually research, choosing questions that would not be easily guessed or discovered. Checking at least ≡ ≡ data sources is preferred but not required on manual research if the account data is limited. Some BMF entity types will have limited data and can be passed with at least two correct responses from one data source.

For both IMF and BMF, the tool will provide a pass/fail response once you have asked all the questions presented and marked the appropriate response. The tool should provide the appropriate error message if any of the questions are not answered. Once verified, assist the caller following normal IRM procedures. Use AMS issue/narrative to leave a brief note recording any failed disclosure.

There will be other situations when some manual research may be necessary. Calls on married filing joint accounts from the secondary SSN may require some manual research since data pulled from the primary on some command codes are unique to that SSN (e.g., city of birth).

For calls where the taxpayer has an ITIN, you can attempt to use the enhanced HRA tool to generate questions and validate the caller. Some questions generated on the tool will require access to the ITIN RTS to validate the response.

For some dependent questions pulled by the tool, there may be multiple responses in the answer portion such as the SSN and date of birth field. Consider the question a pass if the caller provides one correct SSN or DOB from those provided.

There will be times when systemic issues may cause problems with the tool’s ability to produce the needed data to authenticate due to temporary command code outages or an IDRS issue. Manual research is required for both IMF and BMF accounts when the tool is unable to produce the necessary information to validate the caller. Use the data available from the account or return to attempt to validate at least two additional items from multiple data sources when possible.

When considering what probes to ask on IMF or BMF, determine which probes would most likely be known only by an authorized party. Try to eliminate those that may be easily discovered or guessed.

This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. The following identity proofing process will be followed when authenticating the Oral Disclosure Consent Designee. You will need to know the form and period in question along with the following:

This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. To authenticate the caller as a Third-Party Designee, research CC TXMOD (IMF and BMF), CC IMFOL, CC BMFOL, CC RTVUE, CC BRTVU, CC TRDBV or CC ERINVC and follow the identity proofing procedure below by asking for:

Validate the identification number provided by the Third-Party Designee with the posted data using the following identity proofing procedure below:

BMF taxpayers may designate a Third-Party Designee on any BMF return. All BMF returns contain either a Third-Party Designee Section or a Paid Preparer Designee check box. To authenticate the caller as the Third-Party Designee, research IDRS for the presence of the check box field (see IRM 10.10.3.9, Identity Proofing for Third-Party Designee Authentication, follow the procedures above in paragraph 1 in this section. The following information is entered in the Third-Party Designee section:

This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. The following identity proofing process will be used when the IRS is obtaining a taxpayer’s non-written consent to disclose:

This subsection of the IRM provides guidance and procedures for AM assistors. Taxpayers must verify their identity to use the Interactive Voice Response (IVR) to obtain Transcript Delivery System (TDS) tax return and tax account transcripts. Taxpayers are prompted to enter their:

The following identity proofing process will be used when the caller needs to authenticate an entity or taxpayer in order to ensure that both parties are talking about the same entity and to avoid the unauthorized disclosure of information protected under IRC 6103. These calls are received in Tax Exempt/Government Entities (TEGE) Customer Account Services (CAS). Ask the caller for:

If the caller is unable to provide all of the identifying information such as the city and/or state when the full address is not known, attempt to secure as many details as possible. If you are able to locate information open to public disclosure under IRC 6104, advise the caller that the information being provided is based on our available records.

There are limitations to the research you can perform when the caller cannot provide enough information:

NEVER offer sensitive information such as the name of the organization/plan sponsor/plan, c/o person name, current address, or other account-specific information to a caller when attempting to identify the entity or to confirm authorization. Instead, ask the caller to provide the information and then compare the response to the information on record. Offering information that is present on the Master File or EDS/TEDS record could compromise your ability to verify that the party is authorized, if necessary, and could result in an unauthorized disclosure.

Once you have identified the organization/plan sponsor/plan, you must determine whether the information requested by the caller is open to inspection under IRC 6104 or is protected under IRC 6103 and open only to authorized individuals. Unless the information being requested is open to the general public under IRC 6104 or is available through IRS publications or on IRS Web pages, you must verify that the customer is an authorized party. This applies to all verbal and written disclosures.

If the information requested by the caller is protected under IRC 6103, you must determine the caller’s relationship to the organization/plan sponsor/plan in question. If the caller did not include that information with the opening or subsequent statements (for example, "I am the president of our local PTA and I want to check on the status of our application for exemption").

If the caller is an officer, employee, or other designated person within the organization/plan sponsor, and is not an outside third party, verbal confirmation that the caller is authorized to act on behalf of the organization/plan sponsor/plan is sufficient verification for Exempt Organization and Employee Plan disclosure once the caller’s position within the organization/plan sponsor is established (and the correct organization/plan has been identified).

If the caller being screened for authorization cannot provide the entity’s exact name, correct address of record, or the caller's position with the organization/plan sponsor does not clearly identify the caller as an officer (but the caller correctly responds to the other disclosure prompts), additional probing is necessary to help establish that the party is authorized. Ask the caller at least two organization-specific questions about any information found on the master file record (such as specific return information or EO information), or information found on EDS/TEDS, for example:

If the caller is unauthorized, apologize and explain that disclosure laws prevent you from being able to respond to the question and provide general guidance or information open under IRC 6104 to the extent that is possible. Tell the caller that an officer legally authorized to act on behalf of the entity can call anytime for the requested information.

Before an outside third party (e.g., an accountant, bookkeeper, or attorney) can be considered as authorized to receive information protected under IRC 6103, disclosure rules require:

This subsections of the IRM provides guidance for Customer Service Representatives (CSRs) and Customer Service Specialists (CSSs) in responding to telephone inquiries from Tax Exempt/Government Entities (TEGE) customers. The following identity proofing process will be used when the caller wants to know the status of a pending (open) EP determination/application request:

This subsections of the IRM provides guidance for Accounts Management Customer Service Representatives (CSR) and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The subsections of the IRM is intended for Customer Account Services issues involving BMF tax returns. Once the relationship with the entity is established, ask the caller for the EIN. If the caller cannot provide the EIN, you must authenticate the caller's personal identity before researching for the EIN. The following identity proofing process will be used to authenticate the caller’s identity:

When the relationship with the entity is established per paragraph 1, or the caller has provided the EIN, research for and/or verify the EIN using the correct command codes by obtaining the following information:

This subsections of the IRM provides guidance for Accounts Management Customer Service Representatives (CSR) and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The IRM is intended for Customer Account Services issues involving BMF tax returns. The following table includes the identity proofing process to use when authenticating a taxpayer or a POA/TIA calling the IRS regarding issues applying for their domestic or U.S. territory EIN online.

This subsections of the IRM provides guidance for Accounts Management Customer Service Representatives (CSR) and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The IRM is intended for Customer Account Services issues involving BMF tax returns. Once the relationship with the entity is established and the caller is requesting to receive the EIN verbally, use the following identity proofing process to authenticate the caller’s identity. Ask the caller for their:

Using the information provided by the caller, authenticate them using CC INOLES.

If the caller fails to provide the correct address of record but correctly responds to all of the other items (Name, SSN/ITIN and date of birth), request the address as it appears on the last tax return or as modified by IRS.

If the caller fails the DOB probe but correctly responds to all other items above, (Name, SSN/ITIN, and address), advise them to contact the Social Security Administration (SSA) at 800-772-1213 or www.ssa.gov to correct the error. If you are confident the caller is who they say they are, continue with the call.

When the relationship with the entity has been established and the caller has been authenticated, using the IAT EIN Assignment tool research the following information to determine if an EIN has been assigned:

This subsections of the IRM provides guidance for IRS employees in Austin Submission Processing Campus ITIN Operations, Accounts Management Customer Service Representatives, and Field Assistance. The following identity proofing process will be used when securing information from the customer to identify the specific application in question and compare the information provided to the information on RTS:

If unable to verify the required fields, verify two or more additional entries from the application (for example, middle name, country issuing documentation, date of entry, or college name/city).

You must also confirm the relationship of the customer to the applicant. The signature area of the W-7 Application View screen captures the name of the person signing Form W-7 as well as their relationship to the applicant. The following signature relationships are available on the RTS:

Use the following table to determine appropriate disclosure actions:

The application may have been submitted by an Acceptance Agent. If the customer is the Acceptance Agent, verify their name and Employer Identification Number (EIN) by comparing the information that is on the RTS to the information provided.

This subsections of the IRM provides guidance for all Field Assistance employees, managers and analysts in TACs located in the United States and Puerto Rico. The following identity proofing process will be used when taxpayers are providing their TIN to TAC employees for VSD:
When requesting a Taxpayer Identification Number (TIN), ask the taxpayer to: hold their social security card or notice to the camera OR place it on the desk and point the camera down instead of speaking the number aloud.

This subsections of the IRM provides guidance for Customer Service Representatives (CSRs) and Customer Service Specialists (CSSs) in responding to telephone inquiries from Tax Exempt/Government Entities (TEGE) customers. The following identity proofing process will be used when taxpayers are providing personal identification to a TAC employee in response to a denial of an e-file application per Letter 5881C E-file Application Program Denial, Letter 5877C E-file Application IDT Sanction - Criminal Expulsion, or outdated Letter 2916:
To verify identity the customer must present two forms of ID:
An unexpired government issued photo ID, such as:

This subsections of the IRM provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used as part of the Virtual VITA/TCE process when a taxpayer presents photo identification at the intake site.
If the taxpayer(s) must return to the site, the taxpayer(s) must again supply photo identification when they return to review, sign, and pick up a copy of their return.

This subsections of the IRM provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used when a taxpayer presents identification to a volunteer to prepare the tax return.

The second form of identification needed is the original or a copy of the ITIN card or letter.

One or both forms of identification must contain the taxpayer’s current mailing address. If the taxpayer cannot prove their identity, or if the volunteer is uncomfortable accepting items presented as proof of identity, the volunteer must refer the taxpayer to obtain/seek professional tax help.

This subsections of the IRM provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used when the taxpayer, visiting VITA and TCE sites, presents identification to the coordinator to receive correct return preparation:

This subsection of the IRM provides guidance and procedures for all employees within LMSB, SBSE, TEGE and W&I Business Operating Divisions, who work with or have a need to know about systems/files/processes. The following identity proofing process will be used to ensure that the POA is authorized to represent their client in the OPA application:

This subsection of the IRM provides guidance and procedures for all employees within LMSB, SBSE, TEGE and W&I Business Operating Divisions, who work with or have a need to know about systems/files/processes. The following identity proofing process will be used for BMF taxpayers (or their POAs) to verify their authority to establish an online agreement for the business. A BMF taxpayer or POA must provide:

This subsection of the IRM provides guidance and procedures for all employees within LMSB, SBSE, TEGE and W&I Business Operating Divisions, who work with or have a need to know about systems/files/processes. The following identity proofing will be used for existing Secure Access eAuthentication, users will enter their username and password PLUS a six-digit security code that will be sent to the phone number entered as part of the registration process or IRS2Go.

This subsection of the IRM provides guidance and procedures for Appeals technical employees. The taxpayer needs to provide information to substantiate documentation within 30 days for Individual Master File (IMF) cases. The following identity proofing process outlines the information needed: