Every October, the IRS joins the Cybersecurity and Infrastructure Security Agency and its Security Summit partners to remind taxpayers that protecting financial and tax data is not a one-time task. It is a year-round habit.

This year's message is straightforward: a few simple steps taken now can significantly reduce your risk of identity theft, tax fraud, and data loss. That applies whether you are an individual taxpayer, a small business owner, or a tax professional managing client records.

Why Tax Data Is a Target

Tax records contain some of the most valuable information identity thieves look for. Social Security numbers, employer identification numbers, income figures, bank account details, and prior-year return data all appear in a typical tax file. That makes tax professionals and small business payroll systems especially attractive targets for phishing attacks and data breaches.

The IRS specifically warns that scammers may pose as prospective clients, sending emails with malicious links or attachments disguised as tax documents. Payroll and HR teams are also frequent targets of fake invoices and W-2 schemes aimed at accessing employee data or redirecting funds.

Four Habits the IRS Is Emphasizing This Month

The IRS's October reminder focuses on four core practices.

Use strong passwords and multi-factor authentication. Weak or reused passwords remain one of the most common ways accounts are compromised. The IRS recommends using a password manager to generate and store strong, unique passwords, and enabling multi-factor authentication on any account that offers it. MFA adds a second layer of verification, so a stolen password alone is not enough to gain access.

Recognize and report phishing. The IRS does not initiate contact with taxpayers through unsolicited email, text, or social media to discuss personal tax issues. If you receive a suspicious message claiming to be from the IRS, do not click any links or open attachments. Forward the email as-is to phishing@irs.gov and then delete it.

Protect and secure tax records. Store digital tax records securely, encrypt sensitive files, and back up important information regularly. Avoid accessing financial accounts, tax records, or IRS online services over public Wi-Fi networks, which are significantly easier to intercept.

Get an Identity Protection PIN. The IRS offers an Identity Protection PIN, a six-digit number that prevents someone else from filing a federal tax return using your Social Security number. Once enrolled, you must include the IP PIN on your return each year. It is one of the most direct tools available to block fraudulent filings in your name.

For Business Owners and Tax Professionals

If you own a business or manage client financial data, the IRS has additional requirements worth knowing.

Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan, known as a WISP, to protect client data. The IRS provides a template in IRS Publication 5708 for firms that need a starting point.

The IRS also offers a Business Tax Account, an online portal where businesses can securely access tax information, view balances and notices, and manage certain tax responsibilities. Keeping login credentials to that account protected is particularly important given how much sensitive data it contains.

If you experience a data breach, the IRS encourages tax professionals to report it promptly to their local IRS Stakeholder Liaison and to the applicable state tax agency. Acting quickly limits the damage and helps protect affected clients.

A Good Month to Review, Not Just Read

Cybersecurity Awareness Month is a useful prompt to do more than read an article. It is a good time to actually check your habits. When did you last update your passwords? Do you have multi-factor authentication enabled on your email and financial accounts? Are your tax records backed up and stored somewhere secure? Does your business have a written security plan?

These are not complicated questions, but they are easy to put off. October is a reasonable time to work through them.

If you have questions about how to protect your financial records or what to do if you suspect your information has been compromised, contact our office. We can point you in the right direction and make sure your tax accounts are in order.