If a tax pro or their firm is the victim of data or information theft, they must deal with it thoroughly and efficiently. Here are some actions they should take immediately to help minimize damage and protect against future data and theft or losses.
Contact
the IRS and law enforcement:
- Internal
Revenue Service – The tax preparer should report client data theft to
their local Stakeholder Liaison. Stakeholder Liaison will notify
IRS Criminal Investigation and others within the agency on the tax
professional’s behalf. Speed is critical. If reported quickly, the IRS can
take steps to block fraudulent returns in clients’ names.
- Federal Bureau of Investigation or the United States Secret Service – the preparer should
contact a local office of either the FBI or the USSS.
- Local
police – The taxpayer should contact police to file a report on the data
breach.
Contact
states in which the tax professional prepares state returns:
- Any
breach of personal information could have an adverse effect on the
victim’s tax accounts with the states as well as the IRS. To help tax
professionals find where to report data security incidents at the state
level, the Federation of Tax Administrators has created a special page with state-by-state listings.
- The
preparer should contact the State Attorneys General for each state in which the
tax professional prepares returns.
Contact
experts:
- Security
expert – Tax preparers should consult an expert who can help determine the
cause and scope of the breach, to stop the breach, and to prevent further
breaches from occurring.
- Insurance
company – The preparer should report the breach to their insurance company
and to check if the insurance policy covers data breach mitigation
expenses.
- Federal Trade Commission – Preparers and other
businesses can go to the FTC for guidance. For more individualized
guidance, preparers can contact the FTC at idt-brt@ftc.gov.
- Credit
and identity theft protection agency – Certain states require that
preparers offer credit monitoring and ID theft protection to victims of ID
theft.
- Credit
bureaus – Preparers should notify them if there is a compromise and
clients may seek their services.
Contact
clients:
Preparers
should send an individual letter to all victims to inform them of the breach,
but they should work with law enforcement on when to send the letter.
Share this tip
on social media -- #IRSTaxTip: Here’s what tax professionals should do after a
data theft or loss. https://go.usa.gov/xMESn
