Monitor and protect your IRS CAF number from identity thievesBy: Jim Buttonow, CPA, CITP
May 24, 2024

Identity theft is everywhere, and tax pros continue to be a favorite target for thieves to obtain taxpayer information. Identity thieves look to steal the tax pro’s third-party authorization information and use it to access taxpayer information directly from the IRS.

Recently, the IRS has stepped up its efforts to fight this growing area of identity theft. Tax pros should be aware of how it works – and take measures to monitor and protect their authorizations.

CAF identity theft

An identity thief steals the personal identifiable information (PII) of a taxpayer (name, address, SSN). They also steal a tax professional’s IRS Centralized Authorization File (CAF) information, including their name, address and IRS CAF number. To impersonate the tax pro, they also steal the tax pro’s personal information, including their Social Security number (SSN) and date of birth. The thieves use the taxpayer and tax professional information to file a fraudulent authorization – either IRS Form 2848, Power of Attorney, or IRS Form 8821, Tax Information Authorization.

On these forms, the thief lists the taxpayer and the compromised tax pro as the representative (2848) or the designee (8821). Either of these signed authorizations allow the identity thief to contact the IRS directly to get tax information about the taxpayer’s account.

To get the information from the IRS, the thief contacts the IRS directly by phone with the authorization. On the call with the IRS, the thief impersonates the tax professional. To impersonate the tax pro, the caller attempts to pass the IRS “authentication.” IRS tax pro authentication requires the caller to provide the IRS the tax pro’s correct CAF record (name, address, CAF number, SSN and date of birth). Once authenticated, the caller can ask questions about the client’s account and get their tax information.

If the identity thief has an IRS e-Services account, they can have the IRS representative place the taxpayer’s transcripts (account, return and wage/income transcripts) into their e-Services mailbox (IRS calls it a “Secure Object Repository” or “SOR”). If successful, the identity thief now has tax return and income information to use in a variety of identity theft crimes.

IRS takes action

Recently, the IRS has caught onto this growing scheme. IRS officials have taken action to limit the use of tax pro authorizations to access taxpayer information. Tax pros are now restricted to obtaining transcripts when using IRS phone lines.

Only the IRS Practitioner Priority Service (PPS) can be used to request transcripts by phone. The IRS stopped faxing transcripts to tax pros in June 2019 and will continue only to send transcripts to tax pros’ SORs. The tax pro on the IRS call must provide their SOR username to obtain the transcripts. The IRS hopes these measures will limit fraudulent access to taxpayer information.

The IRS has also stepped up measures to freeze tax pro access to client information by identifying compromised CAF numbers used by identity thieves. Once a CAF number is identified by the IRS as being “potentially compromised,” the IRS will freeze the CAF number and place the tax pro’s CAF in “pending review” status. Once in this status, the tax pro will no longer be able to represent or obtain information from the IRS.

Recently, the IRS provided instructions to tax pros on how they may reinstate their compromised CAF record. Many tax pros have expressed their concern about these procedures, especially the long timeline to be reinstated. The procedures call for the tax pro to work directly with IRS Criminal Investigation and Accounts Management to reinstate their authorizations.

Many times, this will include validating all Forms 2848 and 8821 that should be on the tax pro’s authorized clients. The process may also entail getting a new CAF number from the IRS. In all, the process can take 30 days or more. Tax pros who have had their CAF number compromised in the past have reported that it takes months to resolve the issue with the IRS.

The long timeframe has several negative consequences for the tax pro including:
• Loss of their client’s right to representation
• Business loss due to inability to represent their client
• Damage to their professional reputation
• Potential identity theft monetary damages
Industry associations have expressed their concern to the IRS regarding the long resolution times and potential negative effects on both taxpayers and tax pros. Tax pros should watch this issue closely, as it is likely that the IRS will change tax pro authentication procedures in the future to find a more streamlined, improved solution for resolving compromised CAF numbers.

Monitoring and protecting your CAF number

There are several actions tax pros can take to monitor and protect their CAF record with the IRS. First, tax pros can monitor the authorizations on file with the IRS in their Tax Pro Account. The IRS’s Tax Pro Account allows tax professionals to link their CAF number to their account and view all the authorized taxpayers under their CAF number. To enable this feature, tax pros must request a PIN from the IRS within their Tax Pro Account.

Once the PIN is entered, the tax pro will have access to a list of their authorized clients. The IRS sends the PIN via a letter in three to four weeks after the request to the tax pro’s address on file with the CAF unit. Tax pros should access their Tax Pro Account and periodically review their authorizations to identify any taxpayers who they have not authorized. If the tax pro suspects their CAF number has unauthorized use, they should contact their local IRS stakeholder liaison to remedy the issue.

As a second measure, tax pros should protect exposure of their CAF number. For new clients, it is a best practice to get an engagement agreement and vet the client’s identity before sending any authorization to the client. Masking the CAF number until the authorization is sent to the IRS is also another measure a tax pro can take to protect exposure of the CAF number.

The most secure method to obtain an authorization is to use the Tax Pro Account method. Tax pros can electronically initiate a Form 2848 or an 8821 from the Tax Pro Account. The taxpayer will use their IRS online account to sign their authorization electronically. This method avoids exposure to paper authorizations.

However, this method is not quite popular among tax pros and taxpayers. To date, very few taxpayers have used this method largely because only 11% of taxpayers have requested access to their IRS online account through the credentialing service.

A compromised CAF is unusual. However, identity thieves are trying every way to get valuable tax information to impersonate taxpayers and commit fraud. The impact of a frozen CAF can be catastrophic on the tax pro’s business – and it impacts their client’s right to representation. Tax pros should stay vigilant and take steps to monitor and protect their CAF number to avoid these negative impacts to them and their clients.

CAF number
Identity theft
IRS Centralized Authorization File number
IRS updates
Tax business
Tax security
Tax Pro Account
Tax return
Tax professional
Tax preparation
Tax office
Read more
penAbout Jim Buttonow, CPA, CITP

Jim Buttonow, CPA, CITP, has been a leader in helping taxpayers and tax professionals resolve tax problems with the IRS. For 19 years, he worked at the IRS in various compliance enforcement positions. Since 2006, he has been in private practice and tax and accounting software development. Buttonow served as chairperson of the IRS Electronic Tax Administration Advisory Committee in 2015 and 2016 and as the North Carolina representative on the IRS’ Taxpayer Advocacy Panel from 2020-2022. He regularly speaks on areas of tax administration and problem solving to national associations and has testified before Congress in areas of tax administration. He has also published many articles in industry publications, and currently authors CCH’s “Tax Problems and Solutions Handbook,” a publication aimed at helping tax pros work more effectively in post-filing matters and resolving their clients’ most common tax problems. Reach him at or at

Information included in this article is accurate as of the publish date. This post is not reflective of tax law changes or IRS guidance that may have occurred after the date of publishing. All taxpayer circumstances are different, and NATP recommends contacting research services if you have specific questions about your clients’ tax situations.

Additional Articles