With identity theft and refund fraud an ongoing concern, the IRS is implementing new security measures for tax professionals, including holds for Centralized Authorization File (CAF) numbers and new limits on requesting transcripts by phone.
A CAF number is a unique nine-digit identification number assigned to tax professionals and others who file third-party authorizations. The IRS assigns you a CAF the first time you file a third-party authorization with the IRS, and you use that number for your entire career—even if you switch firms.
Most commonly, CAF numbers end up on Form 2848. That’s the form that allows tax professionals (and certain other third parties) to communicate with the IRS on behalf of taxpayers—including obtaining tax transcripts and other sensitive taxpayer personally identifiable information (PII).
Fraudsters have been using schemes, including unsolicited scam emails, to convince tax professionals to turn over their CAF number and other information for purposes of using the data to commit identity theft, refund fraud, and other crimes. These emails may look like they are from the IRS or a tax software company. Tax professionals who receive these unsolicited emails should report them to [email protected].
“Tax professionals continue to present a tempting target to identity thieves and fraudsters,” said IRS Return Integrity and Compliance Services Director James Clifford. “With identity theft an ongoing concern, the IRS has taken additional steps needed to protect both tax professionals and their clients given the sensitivity and importance of the information involved. The IRS will continue working with the tax professional community on these issues to minimize burden on practitioners while also working to ensure the safety and security of this information.”
The IRS has a new process for dealing with suspected compromised CAF numbers to address this issue. If your CAF number is flagged as potentially compromised, it will be placed into a suspended status pending further review and marked with a P. Once it’s been placed into a suspended status, the IRS will send a letter to the CAF owner to confirm whether the number has been compromised—typically, that information will come from IRS Criminal Investigation (CI).
In the meantime, CAF owners won’t be able to use those numbers when dealing with the IRS. The IRS Office of Professional Responsibility likened it to a “freeze” that a credit card company imposes when their fraud-prevention measures are activated.
Just because a CAF number has been compromised doesn’t mean that the CAF owner has done anything wrong—the number could have been exposed due to a physical or digital data breach by a client or third party. In addition, the IRS says, there could be aspects of a practitioner’s tax practice that, while legitimate, might trigger IRS red flags. There may be “false positives” that result in a suspended status pending further review.
If the investigation confirms that the CAF number is compromised, the CAF status will be recoded to “Confirmed Fraud,” and the number can’t be used to access taxpayer data. The IRS will work with the CAF holder to assign them a new CAF number and move their clients to the tax professional’s new CAF number.
The IRS is also taking related security steps to change how tax professionals can order transcripts by phone through the Transcript Delivery System (TDS). TDS is an online service through the IRS website that allows authorized persons to obtain individual or business clients’ tax transcripts and access the IRS Income Verification Express Service (IVES
Wedbush ETFMG Global Cloud Technology ETF
Tax professionals will need to call the Practitioner Priority Service (PPS) line to request that transcripts be deposited into their Secure Object Repository (SOR) mailbox. IRS employees on other phone lines—those outside of PPS—may not be authorized to provide transcripts through the SOR delivery method.
Tax professionals will need to pass enhanced authentication—that generally involves answering additional questions about your identity—as well as provide the Short Identification (ID) number associated with their SOR mailbox—before the transcript is provided. If the IRS cannot verify your identity, the tax transcripts will not be delivered to your SOR mailbox and will be mailed to the taxpayer’s address of record.
The IRS says it is continuing to review and update processes to secure taxpayer and tax professional data.
Read the full article here
