Multi-factor authentication for tax professionals means every login to email, tax software, cloud storage, payroll and banking asks for a second proof beyond the password. Turn it on account by account in that order, choose an authenticator app or hardware key over text codes, give each person a backup method, and record the date each account was switched on.
Which firm accounts need multi-factor authentication first?
Multi-factor authentication (MFA) is a login that needs two or more different proofs: something you know, like a password, plus something you have or are. A tax firm should turn it on first for email, then tax software, then cloud storage, then payroll and banking, because each account in that list can unlock the ones after it.
Email comes first because it is the reset channel for nearly everything else. Whoever controls a preparer's inbox can request a password reset for the tax software, the storage account and the bank, and read the reset links as they arrive. An inbox protected only by a password is a master key with one lock.
Tax software is second. IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data, says tax software products for both taxpayers and tax professionals now offer multi-factor authentication, and tells practitioners to "use the most secure option available" there and in "other products such as email accounts and storage provider accounts." The same publication lists checking e-File Applications and PTIN accounts weekly for returns filed under the firm's EFINs and PTINs, so the firm's IRS e-Services login belongs on the list alongside the software itself.
Cloud storage is third. Shared drives and file-sync folders hold scanned W-2s, prior-year returns and bank statements in one place. Publication 4557's FTC checklist adds an IRS suggestion for cloud storage: use a strong password and multi-factor authentication options, and beware of thieves posing as providers.
Payroll and banking close the first pass. These accounts move money, so a takeover costs the firm directly rather than through its clients.
After those five, sweep for the rest: the domain registrar for the firm's website, the password manager, remote access tools, the accounting ledger, and any tool that receives client uploads. If the firm uses a document-processing tool such as Schema CPA, which sorts what clients send into one file per client (the workflow section of the homepage shows the steps), its sign-in goes on the same list as every other place client documents live.
The requirement is not optional advice. Publication 4557 says the FTC Safeguards Rule requires multi-factor authentication "for anyone accessing customer information on your system," using at least two of a knowledge, possession or inherence factor, and that "this is required for all companies regardless of size." MFA is one of six protections the IRS groups as the Security Six; the other five are covered in the post on what the IRS Security Six are.
Authenticator app, hardware key or text code for tax professionals
The three common second factors differ in how easily a thief can get past them. A hardware security key is the strongest, an authenticator app is the practical default for a small firm, and a text-message code is the weakest option that still counts as MFA. Every one of them is better than a password alone.
The ranking comes from the CISA fact sheet Implementing Phishing-Resistant MFA (October 2022), which lists MFA forms from strongest to weakest:
| Factor type | How it works | Weakness named by CISA | Typical cost |
|---|---|---|---|
| Hardware key (FIDO/WebAuthn) | A physical key plugged in or tapped to approve the login | Resistant to phishing; push bombing, SS7 and SIM swap do not apply | A key per person, plus a spare |
| Authenticator app code or push with number matching | An app on the phone shows a six-digit code, or asks the user to type a number shown on screen | Codes can still be typed into a fake login page | Free apps on phones staff already carry |
| Push without number matching | The app asks "approve?" with one tap | Vulnerable to push bombing and user error | Free |
| Text message or voice code | A code is sent to the phone number on file | Vulnerable to phishing, SS7 and SIM swap attacks | Free |
CISA calls phishing-resistant MFA "the gold standard" and says SMS or voice MFA "should only be used as a last resort." For businesses that cannot move to hardware keys right away, the same fact sheet names app-based or token-based one-time codes, and push with number matching, as "the best options for small- and medium-size business."
Text codes rank last for a specific reason. A SIM swap is when a thief convinces a mobile carrier to move the victim's phone number to a SIM card the thief holds, after which every text code goes to the thief. The firm cannot see this happen until the preparer's phone loses service.
Publication 4557 still gives a text code as its worked example of MFA, and its glossary notes that IRS Secure Access for e-Services uses a security code sent by text. That is a floor, not a recommendation to stop there. The publication's own advice is to "always use the highest multifactor authentication available."
A sensible split for a small firm: hardware keys for the owner and anyone with admin rights to email and storage, authenticator apps for everyone else, and text codes only where a vendor offers nothing better.
Rolling out MFA to every staff member in one week
An MFA rollout to every staff member fits in one working week if it is done one account type per day, with the owner going first and a short help window booked for each person. The work is mostly scheduling: each enrollment takes minutes, but each person needs a phone or key in hand and a working login.
A day-by-day plan for a firm of five to ten people:
- Monday: inventory and owner first. List every account type and who uses it. The owner enrolls in email and the password manager and saves recovery codes, so the first problems land on the person who can fix them.
- Tuesday: email for everyone. Book a 15-minute slot per person. Each person installs the authenticator app, scans the setup code, and confirms a login from a second device.
- Wednesday: tax software and IRS e-Services. Enroll in the tax software's MFA setting. Confirm each preparer can still reach e-Services through IRS Secure Access.
- Thursday: cloud storage, payroll and banking. Fewer people use these, so this day doubles as catch-up for anyone who missed Tuesday.
- Friday: backups and the checklist. Every person registers a second factor or prints recovery codes. Fill in the rollout checklist below and store it with the firm's security plan.
The help each person needs varies. Some staff will need help installing an app; a few will not want a work app on a personal phone, which is the case for buying them a hardware key instead. Seasonal staff hired in January need the same steps on their first day, before they touch client files.
Example rollout checklist
The checklist below is an example for a fictional firm, Lakeshore Tax Group. Account names and dates are made up; the dates fall before the 2027 filing season.
| Account type | Factor chosen | Backup method | Date enabled |
|---|---|---|---|
| Email (all 7 staff) | Authenticator app; hardware key for owner | Printed recovery codes in office safe | Nov 3, 2026 |
| Tax software | Authenticator app | Second registered phone for owner | Nov 4, 2026 |
| IRS e-Services | IRS Secure Access text code | Updated phone number on file | Nov 4, 2026 |
| Cloud storage | Hardware key for admins; app for staff | Recovery codes; second key in safe | Nov 5, 2026 |
| Payroll provider | Authenticator app | Recovery codes | Nov 5, 2026 |
| Business bank (account ending 4821) | Bank's app approval | Branch-verified phone reset | Nov 5, 2026 |
| Password manager | Hardware key | Second key in safe | Nov 3, 2026 |
What happens when a preparer loses an MFA phone during filing season?
A lost MFA phone locks a preparer out of every account that depends on it until a backup factor or an admin reset restores access. Plan the fix in advance: printed recovery codes, a second factor for each person, and one named admin who resets staff accounts only after confirming the request in person or by a known number.
Recovery codes are one-time codes most services offer when MFA is turned on. Each code works once in place of the phone. Print them, put them in a sealed envelope with the person's name, and keep them in a locked drawer or safe. A file called "recovery codes" on the same laptop that was stolen with the phone does not help.
A second factor is the cleaner answer. A hardware key kept in the office, or a second phone registered to the owner's account, means the preparer can log in the same morning without anyone resetting anything.
The admin reset is the last resort and the riskiest step. Whoever can reset MFA for other people can also be talked into resetting it for a thief who calls pretending to be a stranded preparer. Write down the rule: resets happen only after the admin confirms the request face to face or by calling back a number already on file, never a number given in the request.
Once access is back, clean up. Remove the lost phone from every account it was registered on, issue new recovery codes, and check the account's recent sign-ins for anything the preparer does not recognise. If something unfamiliar shows up, treat it as a possible breach; the post on how to report data theft to the IRS as a tax preparer covers who to call and in what order.
MFA fatigue attacks and other ways tax professionals get past their own MFA
MFA fatigue, also called push bombing, is an attack where someone who already has a password sends login prompts to the victim's phone until the victim taps approve. It is one of several ways a firm's own habits defeat MFA. The others are sharing one code across staff, approving prompts nobody started, and typing codes into fake login pages.
The CISA fact sheet Implementing Number Matching in MFA Applications (October 2022) describes the attack: a thief can generate "hundreds of prompts" in a short time, and the user may press accept "accidentally or from MFA fatigue," or assume one of the requests is real. Its recommended fix, short of hardware keys, is number matching, a setting that makes the user type a number shown on the login screen into the app. A thief cannot see that screen, so repeated prompts stop working.
CISA adds two habits worth training. Staff should report any login prompt they did not start. And a denied prompt should be investigated, because MFA only asks after the password has been accepted, so a surprise prompt means the password is probably known to someone else.
Shared codes are the quiet version of the same problem. A front desk where three people use one login and one person's phone receives the code has turned MFA into a group password. Publication 4557 says each individual with access to client accounts should have a unique password and passwords should not be shared among employees. Give each person their own account and their own factor.
Phished codes are the last gap. A fake login page can ask for the password and then the six-digit app code, and pass both to the real site within seconds. Only phishing-resistant factors such as hardware keys stop that. The post on phishing scams targeting tax preparers shows what those fake pages and the emails that lead to them look like, and the post on who can reach which client folders covers limiting what a stolen login can open.
The IRS ties MFA to the season's threats directly. Its release IR-2026-85 (Aug. 4, 2026) lists multi-factor authentication among the Security Six and describes it as "a requirement under" the FTC Safeguards Rule. An older version of the list, IRS Tax Tip 2019-117 (Aug. 27, 2019), called the same item "two-factor authentication." For more on preparing the office before January, see the tax season workflow category.