The IRS notified tax practitioners and taxpayers who use many IRS e-services that it is strengthening the authentication process for identifying users and that the new, more stringent procedures will require existing users to re-register (Oct. 24 is the target date for the start of re-registration) (IRS website, “Important Update About Your e-Services Account” (9/22/16)).
Any current e-account holder is affected, which the IRS said includes:
- Electronic return originators;
- Return transmitters;
- Large business taxpayers required to e-file;
- Software developers;
- Health care law insurance provider fee/branded prescription drug filers;
- Health care law information return transmitters/issuers;
- Reporting agents;
- Not-for-profit (Volunteer Income Tax Assistance (VITA), Tax Counseling for the Elderly (TCE), and Low Income Taxpayer Clinic (LITC)) users;
- States that use Transcript Delivery Service; and
- Income Verification Express Service (IVES) participants.
E-services account holders who use only the taxpayer identification number (TIN) matching program will also need to validate their identity but will have a streamlined process because they do not exchange sensitive data. (TIN matching allows payers reporting payments on Forms 1099 to check the payee’s TIN with the IRS before filing.)
Current users who return to their accounts on or after Oct. 24 will be required to update their account information through the IRS’s “Secure Access” process, which includes proving the user’s identity, verification using financial records, and mobile phone verification. Secure Access employs a two-factor authentication process, under which returning users, once they have successfully registered, must provide their credentials (username and password) and the security code sent to their mobile phone by text. These are the same procedures that already apply to the Get Transcript process and the identity protection personal identification number (IP PIN) process for identity theft victims.
This two-factor authentication process is intended to prevent cybercriminals from accessing the accounts when they obtain usernames and passwords through phishing.
Users who have already registered through Get Transcript will not have to re-register for these other services, but they will have to change their password when they return to the website. They should be aware that they will have the same username for their personal accounts, such as a Get Transcript account, as they do for e-services. To help users with the new authentication process, the IRS is hiring additional staff to assist at the e-Help Desk.
—Sally P. Schreiber (sschreiber@aicpa.org) is a JofA senior editor.
