The IRS issued a reminder on October 2, 2026 (IR-2026-119) asking taxpayers, tax professionals, and businesses to take basic steps to protect their tax data during Cybersecurity Awareness Month. The message is straightforward: identity thieves are always looking for new ways in, and simple habits make a real difference.
Why this matters for your business
This isn’t just a reminder for individual taxpayers. The IRS explicitly called out businesses, payroll departments, and HR offices as targets for phishing, fake invoice schemes, and W-2 fraud designed to steal employee information, credentials, or money. If your staff handles payroll, manages contractor payments, or processes employee benefits, they’re handling data that criminals want.
For gaming operators and compliance-focused businesses, the exposure is broader than most. Tax records, licensing documentation, and employee files are all high-value targets. A breach doesn’t just cost money; it can complicate regulatory filings and create liability well beyond the data itself.
Tax professionals, including enrolled agents, CPAs, and payroll preparers, face their own version of this risk. Scammers may pose as a prospective client or use a compromised email account to get a preparer to open a malicious link or attachment.
Six steps the IRS recommends
The IRS outlined six concrete steps for taxpayers, businesses, and tax professionals to take:
- Use strong, unique passwords. Different passwords for different accounts. A password manager helps.
- Turn on multifactor authentication (MFA). Where it’s available, use it. It adds a real layer of protection even if a password is compromised.
- Keep software and devices updated. Computers, phones, tablets, apps, browsers, and security software. Turn on automatic updates when possible.
- Recognize and report scams. Unexpected messages asking for personal or financial information, or pressuring you to act immediately, are a red flag regardless of the channel.
- Protect your tax records. Store digital records securely, encrypt sensitive files, and back up important information.
- Use secure networks. Avoid public Wi-Fi when accessing financial accounts, tax records, or IRS online services.
How to verify a real IRS contact
The IRS normally contacts taxpayers by mail first. It only sends emails or text messages when a taxpayer has opted in, and it never communicates through social media direct messages. The IRS or a private collection agency may call about account matters, but the IRS will never call to demand immediate payment, threaten arrest, or tell you that you’re owed a refund.
If you get a suspicious message claiming to be from the IRS, don’t click links, open attachments, or respond. Report it at IRS.gov/SubmitATip.
For business owners who receive a request to change employee payment information or direct deposit details, verify that request through a trusted channel before acting. W-2 phishing schemes targeting HR and payroll staff are a recurring and costly attack pattern.
IRS tools worth knowing about
The IRS offers several tools that can help protect your tax accounts:
- Identity Protection PIN (IP PIN): A six-digit number that prevents someone else from filing a federal return using your Social Security number or ITIN. Any taxpayer can request one.
- Online Account for Individuals: Secure access to your personal tax information, notices, and payment history.
- Business Tax Account: For businesses to manage certain tax responsibilities online.
- Written Information Security Plan (WISP): Federal law requires tax and accounting professionals to create and maintain a WISP to protect client data. If your tax preparer hasn’t mentioned this to you, it’s worth asking about.
What BCA clients should keep in mind
Cybersecurity practices connect directly to your compliance posture. How you store tax records, who has access to payroll data, and how you verify vendor payment requests are all areas where a weak process creates real exposure. If your business hasn’t reviewed those procedures recently, it’s worth a conversation with your tax advisor or with BCA.
This article is for educational and informational purposes only and does not constitute tax, legal, or financial advice. Tax rules change frequently. Consult a qualified tax advisor or legal professional before making decisions based on this information. BCA provides compliance advisory services; this article does not create a client relationship.
Educational information only, not licensed legal, tax, or financial advice. We refer to and partner with licensed professionals when personalized advice is needed. Laws change; no warranty of accuracy or timeliness.
Sources
IRS IR-2026-119 (October 2, 2026): https://www.irs.gov/newsroom/irs-reminder-cybersecurity-awareness-month-offers-simple-steps-to-protect-tax-data