Identity theft is everywhere, and tax pros continue to be a favorite target for thieves to obtain taxpayer information. Identity thieves look to steal the tax pro’s third-party authorization information and use it to access taxpayer information directly from the IRS.

Recently, the IRS has stepped up its efforts to fight this growing area of identity theft. Tax pros should be aware of how it works – and take measures to monitor and protect their authorizations.

CAF identity theft

An identity thief steals the personal identifiable information (PII) of a taxpayer (name, address, SSN). They also steal a tax professional’s IRS Centralized Authorization File (CAF) information, including their name, address and IRS CAF number. To impersonate the tax pro, they also steal the tax pro’s personal information, including their Social Security number (SSN) and date of birth. The thieves use the taxpayer and tax professional information to file a fraudulent authorization – either IRS Form 2848, Power of Attorney, or IRS Form 8821, Tax Information Authorization.

On these forms, the thief lists the taxpayer and the compromised tax pro as the representative (2848) or the designee (8821). Either of these signed authorizations allow the identity thief to contact the IRS directly to get tax information about the taxpayer’s account.

To get the information from the IRS, the thief contacts the IRS directly by phone with the authorization. On the call with the IRS, the thief impersonates the tax professional. To impersonate the tax pro, the caller attempts to pass the IRS “authentication.” IRS tax pro authentication requires the caller to provide the IRS the tax pro’s correct CAF record (name, address, CAF number, SSN and date of birth). Once authenticated, the caller can ask questions about the client’s account and get their tax information.

If the identity thief has an IRS e-Services account, they can have the IRS representative place the taxpayer’s transcripts (account, return and wage/income transcripts) into their e-Services mailbox (IRS calls it a “Secure Object Repository” or “SOR”). If successful, the identity thief now has tax return and income information to use in a variety of identity theft crimes.

IRS takes action

Recently, the IRS has caught onto this growing scheme. IRS officials have taken action to limit the use of tax pro authorizations to access taxpayer information. Tax pros are now restricted to obtaining transcripts when using IRS phone lines.

Only the IRS Practitioner Priority Service (PPS) can be used to request transcripts by phone. The IRS stopped faxing transcripts to tax pros in June 2019 and will continue only to send transcripts to tax pros’ SORs. The tax pro on the IRS call must provide their SOR username to obtain the transcripts. The IRS hopes these measures will limit fraudulent access to taxpayer information.

The IRS has also stepped up measures to freeze tax pro access to client information by identifying compromised CAF numbers used by identity thieves. Once a CAF number is identified by the IRS as being “potentially compromised,” the IRS will freeze the CAF number and place the tax pro’s CAF in “pending review” status. Once in this status, the tax pro will no longer be able to represent or obtain information from the IRS.

Recently, the IRS provided instructions to tax pros on how they may reinstate their compromised CAF record. Many tax pros have expressed their concern about these procedures, especially the long timeline to be reinstated. The procedures call for the tax pro to work directly with IRS Criminal Investigation and Accounts Management to reinstate their authorizations.

Many times, this will include validating all Forms 2848 and 8821 that should be on the tax pro’s authorized clients. The process may also entail getting a new CAF number from the IRS. In all, the process can take 30 days or more. Tax pros who have had their CAF number compromised in the past have reported that it takes months to resolve the issue with the IRS.

The long timeframe has several negative consequences for the tax pro including:
• Loss of their client’s right to representation
• Business loss due to inability to represent their client
• Damage to their professional reputation
• Potential identity theft monetary damages
Industry associations have expressed their concern to the IRS regarding the long resolution times and potential negative effects on both taxpayers and tax pros. Tax pros should watch this issue closely, as it is likely that the IRS will change tax pro authentication procedures in the future to find a more streamlined, improved solution for resolving compromised CAF numbers.

Monitoring and protecting your CAF number

There are several actions tax pros can take to monitor and protect their CAF record with the IRS. First, tax pros can monitor the authorizations on file with the IRS in their Tax Pro Account. The IRS’s Tax Pro Account allows tax professionals to link their CAF number to their account and view all the authorized taxpayers under their CAF number. To enable this feature, tax pros must request a PIN from the IRS within their Tax Pro Account.

Once the PIN is entered, the tax pro will have access to a list of their authorized clients. The IRS sends the PIN via a letter in three to four weeks after the request to the tax pro’s address on file with the CAF unit. Tax pros should access their Tax Pro Account and periodically review their authorizations to identify any taxpayers who they have not authorized. If the tax pro suspects their CAF number has unauthorized use, they should contact their local IRS stakeholder liaison to remedy the issue.

As a second measure, tax pros should protect exposure of their CAF number. For new clients, it is a best practice to get an engagement agreement and vet the client’s identity before sending any authorization to the client. Masking the CAF number until the authorization is sent to the IRS is also another measure a tax pro can take to protect exposure of the CAF number.

The most secure method to obtain an authorization is to use the Tax Pro Account method. Tax pros can electronically initiate a Form 2848 or an 8821 from the Tax Pro Account. The taxpayer will use their IRS online account to sign their authorization electronically. This method avoids exposure to paper authorizations.

However, this method is not quite popular among tax pros and taxpayers. To date, very few taxpayers have used this method largely because only 11% of taxpayers have requested access to their IRS online account through the ID.me credentialing service.

A compromised CAF is unusual. However, identity thieves are trying every way to get valuable tax information to impersonate taxpayers and commit fraud. The impact of a frozen CAF can be catastrophic on the tax pro’s business – and it impacts their client’s right to representation. Tax pros should stay vigilant and take steps to monitor and protect their CAF number to avoid these negative impacts to them and their clients.