How to report data theft to the IRS as a tax preparer

To report data theft to the IRS as a tax preparer, contact your local IRS Stakeholder Liaison first, as soon as client data is lost or stolen. The liaison alerts IRS Criminal Investigation so fraudulent returns can be blocked. Then contact the states where you prepare returns, law enforcement, your insurer and a security expert, and notify affected clients.

What counts as data theft a tax preparer must report?

Data theft, for a tax preparer, is any loss of or unauthorized access to client tax information: names, Social Security numbers, income figures or bank details. The IRS asks preparers to report it immediately. A confirmed theft has evidence, such as returns filed without the client's knowledge; a suspicion is an odd sign that still needs checking.

IRS Publication 4557 (Rev. 6-2024) says "tax practitioners should report data losses or thefts immediately to the IRS so that appropriate precautions can be made to protect clients from fraudulent returns being filed in their names." It lists common clues under "Spot Data Theft," noting that "you or your firm may be a victim and not even know it":

• Client e-filed returns reject because a return with the client's Social Security number was already filed.
• Clients who have not filed receive IRS authentication letters (5071C, 4883C, 5747C) or refunds.
• Clients receive tax transcripts they did not request, or IRS notices about online accounts they did not open or access.
• The number of returns filed under the firm's EFIN or a preparer's PTIN is higher than the number the firm actually filed.
• Clients or colleagues reply to emails the firm never sent.
• Network computers run slower than normal, turn themselves on, lock out staff, or show a cursor moving on its own.

The first group, signs at the IRS, points to theft that has already been used. A rejected e-file for a duplicate Social Security number, or EFIN totals above the firm's own count, is strong evidence. The second group, signs on the firm's machines, can have innocent causes. A slow computer alone is a reason to call a security professional, not proof of theft.

Publication 4557 tells firms to check e-File Applications and PTIN accounts weekly for total returns filed using their EFINs and PTINs, and notes that a weekly report of returns filed under those numbers is available. That weekly count is the fastest way to move from suspicion to confirmation.

Waiting for certainty is the wrong instinct. The IRS's Identity theft information for tax professionals page (reviewed June 23, 2026) says: "Speed is critical. If reported quickly, the IRS can take steps to block fraudulent returns in your clients’ names and will assist you through the process."

Calling the IRS Stakeholder Liaison after a data theft

The IRS Stakeholder Liaison is the IRS contact for tax professionals in each region, and the person to call first after client data is stolen. The liaison passes the report to IRS Criminal Investigation and other IRS offices on the preparer's behalf. Regular IRS phone assistors cannot take a preparer's report of client identity theft.

The IRS Data theft information for tax professionals page (reviewed March 26, 2026) says to report client data theft to the local stakeholder liaison, and that IRS toll-free assisters cannot accept third-party notification of tax-related identity theft. The identity theft page for tax professionals adds: "Liaisons will notify IRS Criminal Investigation and others within the agency on your behalf."

To find the liaison, use the IRS Stakeholder Liaison contacts page (reviewed Dec. 17, 2025). It groups states into regional areas, each with its own email address, and lists a shared phone number. Under "Reporting a data breach," it says a tax professional who believes they are a victim should "contact us immediately."

None of these IRS pages publishes a fixed list of what the liaison will ask for. The IRS release IR-2026-85 (Aug. 4, 2026) says only to contact the liaison "and provide details of the situation." Having the facts written down before the call makes it shorter. A practical set to gather:

• Firm name, address, EFIN, and the PTINs of preparers involved.
• When the theft was found, how, and what was seen (for example, three rejected e-files for duplicate Social Security numbers).
• What data may be exposed: which systems, which tax years, and a rough count of affected clients.
• What has been done so far: machines disconnected, passwords changed, security expert engaged.
• A contact name and phone number for follow-up.

Publication 4557's recovery steps also say to "update your IRS Stakeholder Liaison with developments." The first call opens the case; later calls pass on what the security review found.

State, FTC and law enforcement reports after a tax preparer data breach

After the IRS, a tax preparer data breach is reported to the states where the firm prepares returns, to law enforcement, and in some cases to the FTC. The IRS data theft page also lists a security expert, the firm's insurer and the credit bureaus. Each contact has a different job, so one call does not cover another.

The IRS data theft page lists these contacts:

• State tax agencies. Use the Federation of Tax Administrators "Report a Data Breach" page to find each state's contact. IRS Publication 5293 (5-2018) gives an email for the same purpose: StateAlert@taxadmin.org.
• State attorneys general. The IRS page says to determine whether you must notify the attorney general in each state where you prepare returns, and that most states require this.
• FBI. Contact the local FBI field office.
• Secret Service. Contact the local field office if directed.
• Local police. File a police report on the breach.
• FTC. File the FTC's Safeguards Rule security event form if 500 or more people are affected.
• Security expert, insurer and credit bureaus. The expert finds the cause and scope and stops the breach; the insurer is told so the firm can check coverage for mitigation costs; the credit bureaus are told so clients can use their services.

The FTC's Safeguards Rule reporting form page says the rule "requires covered financial institutions to report to the FTC security events affecting 500 or more people." The details of that threshold and its timing are covered in the post on the Safeguards Rule breach notice to the FTC.

For ransomware, Publication 4557 adds that victims should contact the FBI and CISA in addition to the IRS.

State requirements differ, and a firm that prepares returns in several states may owe notices to several attorneys general. The IRS page does not list each state's rules; it points preparers to the states themselves. A firm's written security plan should already name these contacts. The post on the incident response page of a WISP shows how to set that page up before anything goes wrong.

Example response timeline

The timeline below is an example for a fictional firm, Birchwood Tax Services, that finds unexplained returns under its EFIN. Dates are invented and fall in the 2027 filing season. It shows an order of contacts drawn from the IRS pages above, not legal deadlines; state rules set their own.

What do clients need to hear after their tax data is stolen?

Clients whose tax data is stolen need an individual letter that says what happened, what information was involved, what the firm has done, and what the client can do now. The IRS also asks preparers to encourage affected clients to get an Identity Protection PIN, a six-digit number that stops anyone else filing a return under their Social Security number.

The IRS data theft page says to "send an individual letter to all victims," coordinating the timing with law enforcement, and points to the FTC's data breach response guide for business. It also notes that some states require firms to offer credit monitoring or identity theft protection to victims.

IRS Tax Tip 2023-106 (Aug. 30, 2023) says "it is vitally important that tax professionals inform all their clients of a breach" and that preparers should encourage clients to apply for an IP PIN, quoting an IRS advisory committee calling it "the number one security tool currently available to taxpayers from the IRS."

The IRS Get an Identity Protection PIN page (reviewed Aug. 4, 2026) describes the IP PIN as "a six-digit number that prevents someone else from filing a tax return." Anyone with an SSN or ITIN who can verify their identity can enroll, the fastest route is the client's IRS online account, and "a new IP PIN is generated each year."

A client letter usually covers:

• The date the theft was discovered and, if known, when it happened.
• The kinds of information involved, such as names, SSNs, prior-year returns or bank account numbers (for example, a checking account ending XXXX-4821).
• What the firm has done: contacted the IRS, the states and law enforcement, and engaged a security expert.
• What the client can do: request an IP PIN, watch for IRS letters, and consider credit monitoring.
• When to file Form 14039. The IRS data theft page says clients should complete the Identity Theft Affidavit only if they receive an IRS notice or letter, or if their e-filed return is rejected for a duplicate Social Security number.
• A named person at the firm to call.

Deadlines for these letters come from state law and vary by state. Check with each state attorney general's office before choosing a date.

Knowing exactly which documents each client sent shortens the work of deciding who gets a letter and what it says. A per-client document list, such as the one Schema CPA builds from every page a client uploads, shows that one client sent only a W-2 while another sent bank statements with account numbers, and the letters can say so. The client tracker demo on the homepage shows what that per-client view looks like.

Data theft reporting mistakes that slow the IRS response

The data theft reporting mistakes that slow the IRS response most are waiting to be sure before calling, wiping or rebuilding machines before evidence is kept, and calling clients before the IRS and law enforcement. Each one feels responsible in the moment and costs time the IRS needs to stop fraudulent returns.

Waiting to be sure. A firm that spends a week confirming a theft gives thieves a week of filing. The IRS says "speed is critical." Call on strong signs, such as duplicate-SSN rejections or EFIN counts above the firm's own, and let the liaison help confirm.

Wiping machines first. Reinstalling a computer feels like cleaning up, but it destroys the record of how the theft happened. Publication 4557 says to "preserve and review files or programs that may reveal how the breach occurred" and to bring in security professionals as soon as possible. Disconnect machines; do not erase them.

Calling clients first. Telling clients before the IRS, the states and law enforcement leaves clients with questions the firm cannot answer yet, and the letter may need rewriting once the security review finishes. The IRS asks preparers to coordinate the timing of client letters with law enforcement.

Calling the wrong IRS number. The general IRS phone lines cannot take a preparer's notice of client identity theft. Go to the Stakeholder Liaison.

Resuming e-filing too soon. Publication 4557 says to find how the intrusion happened and make any required fixes "before resuming tax preparation activities and being issued a new" EFIN.

Skipping the review of how documents come in. Many thefts start with a phished email password or an attachment. After a breach, firms often rethink how clients send files. The posts on what a client portal for accountants does and what to look for in a client portal cover that decision, and the tax season workflow category covers getting the season back on track.