It’s important for tax pros to know the signs they are a cyberthief’s victim

Notice: Historical Content


This is an archival or historical document and may not reflect current law, policies or procedures.

IRS Tax Tip 2019-124, September 10, 2019

Tax professionals should learn the tell-tale signs that their office may have experienced a data theft. Such thefts could have resulted in fraudulent tax returns filed in their clients' names.

Here is a list of warning signs that a tax professional or their office may have experienced a data theft:

  • Their clients' e-filed returns are rejected by the IRS or state tax agencies. This happens because someone else already filed a tax return with their client's Social Security number.
  • Clients who haven't filed tax returns begin to receive taxpayer authentication letters from the IRS. The IRS sends letters such as the 5071C, 4883C and 5747C to confirm a taxpayer's identity for a submitted tax return.
  • Clients who haven't filed tax returns receive refunds.
  • Clients receive tax transcripts that they didn't request.
  • Clients who created an IRS Online Services account receive an IRS notice that their account was accessed.
  • Clients who have an account get an IRS emails saying their account is disabled.
  • Clients unexpectedly receive an IRS notice that an IRS online account was created in their names.
  • The number of returns filed with the tax professional's Electronic Filing Identification Number is higher than the number of clients they have.
  • Tax professionals or clients responding to emails that the firm did not send.
  • Network computers running slower than normal.
  • Computer cursors moving or changing numbers when the user is not even touching the keyboard.
  • Network computers locking out employees.

More information:

Subscribe to IRS Tax Tips