IRS Warns Taxpayers to Strengthen Identity-Theft Defenses: What ITIN and EIN Users Should Know in 2026
Updated: September 5, 2026
Topic: Tax identity theft, ITIN security, EIN fraud, IP PINs, and secure IRS accounts
The IRS and its Security Summit partners are urging taxpayers and tax professionals to strengthen defenses against tax-related identity theft. In a September 4, 2026 release, the IRS highlighted multifactor authentication, Identity Protection PINs, and secure IRS online accounts as practical layers of protection. [1]
The warning matters to non-U.S. taxpayers and international founders because an ITIN, EIN application, tax return, IRS account, or professional-service file can contain sensitive identity and financial information. The IRS identity-theft guide lists an unexpected Employer Identification Number, an unfamiliar account, a suspicious password reset, or an unusual tax notice among warning signs that deserve attention. [2]
The best response is not to share more information with an unverified person who promises to fix the problem. Instead, verify the source, secure the relevant account, preserve the records, and follow the IRS instructions for the specific notice or suspected incident.
What did the IRS Security Summit announce?
The IRS Security Summit’s September 4 release is the fourth installment of its “Protect Your Clients; Protect Yourself” summer series. The guidance focuses on three principal protections:
| Protection | What it does |
|---|---|
| Multifactor authentication | Requires at least two independent factors to verify a user’s identity |
| Identity Protection PIN | Helps the IRS verify a taxpayer when a federal tax return is filed |
| Secure IRS online accounts | Helps taxpayers and professionals access information through official IRS services |
The IRS explains that MFA can help protect against phishing, social engineering, and attacks using stolen passwords. It recommends using MFA across tax software, cloud storage, email, and other systems that contain sensitive client information. [1]
The IRS also states that tax preparation firms must use multifactor authentication under the Federal Trade Commission’s Safeguards Rule, unless a qualified individual approves an equivalent secure access control in writing. This is particularly relevant to CPAs, Enrolled Agents, attorneys, payroll providers, and other professionals serving international clients.
Why ITIN users should pay attention
An ITIN is an IRS-issued federal tax-processing number for an eligible individual who needs a U.S. taxpayer identification number but is not eligible for an SSN. An ITIN is sensitive personal information, but it is not an immigration document, work authorization, or business identifier.
A person applying for or renewing an ITIN may handle identity documents, foreign-status evidence, tax-return information, and communications with the IRS or an authorized professional. Those materials should be sent only through a verified channel and retained securely.
An ITIN user should be cautious if someone unexpectedly asks for an IP PIN, online-account password, full identity documents, or a payment in response to an unsolicited message. The IRS states that it will not call, email, or text a taxpayer to request an IP PIN. [1]
Why EIN users should pay attention
An EIN identifies a business or other eligible entity for federal tax administration. It is not an ITIN and does not replace the owner’s individual tax-identification needs. It also does not prove that an LLC is properly maintained, that a bank will approve an account, or that all tax filings have been completed.
The IRS identity-theft guide specifically lists an EIN that the taxpayer did not apply for as a possible warning sign. [2] An unexpected EIN could reflect an error, unauthorized action, or attempted misuse of business information. The business should verify the notice through official IRS channels and preserve all related correspondence.
International founders should monitor business records as carefully as personal records. They should review IRS notices, bank activity, payment-platform activity, state filings, and professional-account access for unexpected changes.
What is an Identity Protection PIN?
An Identity Protection PIN, commonly called an IP PIN, is a six-digit number known to the taxpayer and the IRS. It helps the IRS verify the taxpayer’s identity when a federal tax return is filed. The IRS says that an IP PIN is valid for one calendar year and that a new number is generated each year. [1]
Tax professionals cannot obtain an IP PIN on behalf of clients. The taxpayer must obtain it personally through the IRS process. Confirmed victims of tax-related identity theft automatically receive a new IP PIN each year.
An IP PIN is not the same as an ITIN or SSN. It is an additional verification tool. A taxpayer should never disclose it to an unsolicited caller, email sender, or person who claims to need it to release a refund.
What should someone do if identity theft is suspected?
The IRS identity-theft guide advises affected individuals to stop interacting with the suspected identity thief, update the online-account password, follow instructions in an IRS letter or notice, report the identity theft, and consider obtaining an IP PIN. [2]
The correct next step depends on how the issue was discovered. A taxpayer who receives an IRS notice should verify that the notice is genuine and follow its instructions. A taxpayer who cannot access an IRS account should use the contact method in the notice or the official IRS website rather than a link supplied by a suspicious message.
The IRS says most people should not file Form 14039, Identity Theft Affidavit, unless instructed, unable to use the Identity and Tax Return Verification Service, or reporting possible tax-related identity theft that the IRS does not already have on file. Businesses use Form 14039-B in situations where that form is appropriate. [2]
Common warning signs for ITIN and EIN holders
The IRS identifies several warning signs that should prompt caution. These include a rejected tax return, a Form W-2 or Form 1099 from an unknown employer, an unreported-income notice, an EIN the taxpayer did not request, an account that the taxpayer did not create, an unexpected password-reset alert, or a person offering to “help” with an IRS online account. [2]
These signs do not always prove identity theft. They may result from an administrative error or a legitimate action by an authorized professional. However, the taxpayer should verify the facts before providing more information or changing an account.
How international founders can reduce risk
Use separate accounts and individual logins
Do not share a single username and password across a company, tax professional, bank, email account, and cloud-storage service. The IRS recommends individual accounts and warns against sharing usernames or passwords. [1]
Turn on MFA everywhere sensitive information is stored
Enable multifactor authentication for email, cloud storage, tax software, banking, password managers, and business-management systems. An attacker who obtains one password should not automatically gain access to every document and account.
Verify communications independently
Use IRS.gov to find official contact information and online tools. Do not click links or open attachments in unsolicited messages. A message that uses a taxpayer’s name, EIN, or ITIN does not prove that the sender is legitimate.
Keep a record of filings and notices
Store copies of Form W-7 materials, EIN application records, IRS notices, filed returns, authorization forms, and communications with professionals. A timeline can help identify when an unauthorized action occurred and assist the IRS or a qualified professional in reviewing the issue.
Limit document access
Share only the documents needed for the specific service. Use secure upload channels when available, and confirm the identity and role of any person requesting personal or business records.
How ITIN.com fits into secure preparation
ITIN.com can help eligible individuals with Form W-7 preparation, CAA document verification, filing support, and professional guidance. It can also help prepare EIN applications and coordinate LLC formation or U.S. banking-assistance steps where appropriate.
ITIN.com does not issue ITINs or EINs, form LLCs, or approve bank accounts. The IRS issues ITINs and EINs, state authorities form LLCs, and banking partners decide whether to approve accounts. ITIN.com prepares, verifies, files, coordinates, and guides.
Applicants should still protect their own account credentials and verify any request for additional documentation. No service provider should ask a client to disclose an IRS IP PIN to an unsolicited third party or promise that identity verification guarantees tax, immigration, or bank approval.
Bottom line
The IRS’s September 4, 2026 Security Summit warning is a timely reminder that ITIN and EIN users should treat tax identity information as sensitive. Use MFA, create and secure official online accounts, consider an IP PIN where appropriate, monitor IRS and business records, and verify suspicious communications through IRS.gov. If identity theft is suspected, follow the IRS’s specific instructions instead of sending more information to the person who may have caused the problem.
Important: This article is general information based on IRS materials available on September 5, 2026. It is not tax, legal, accounting, cybersecurity, immigration, or banking advice. Identity-theft response steps depend on the facts and the IRS notice or service involved.
