Tips to avoid tax fraud: A tax security checklist

Tax season is prime time for identity thieves. As you collect your tax documents, share sensitive personal information, and file your return, lots of your sensitive data is in motion, passing through accountants, business reps, digital records systems, and others. This creates the perfect opportunity for fraudsters to ramp up phishing scams and cyberattacks, targeting data they can use to steal your identity.

All it takes is one exposed document, compromised account, or moment of pressure during a scam for fraudsters to file a fraudulent tax return in your name or misuse your identity months later. But you’re not powerless. Follow this step-by-step process to help reduce your risk this tax season and stay in control of both your identity and your finances.

To mark your progress as you go, download our simple tax security checklist and tick the boxes once you’ve completed each step.

1. Secure your tax documents

Tax document security matters year-round, but tax season is a good reminder to make sure any documents containing your sensitive information are stored securely and out of reach of identity thieves who could use them to target you.

This includes W-2 forms, 1099 forms, completed tax returns from previous years, and any other paperwork that lists your Social Security number (SSN) or financial data.

Here’s where to store them for maximum security:

• Paper copies: A safe or lockbox in your home.
• Digital copies: An encrypted storage folder, password-protected local folder, or a secure tax portal provided by trusted tax software or your tax professional.

Avoid saving copies of sensitive tax information in email inboxes, shared cloud folders, or unprotected personal devices. And, when you need to share your tax information, use secure upload links, password-protected tax portals, or approved tax software designed to protect sensitive data in transit.

Emails and text messages, in particular, may be vulnerable to interception and could leave your info exposed if your account is hacked.

2. Lock down your online tax accounts

Tax information stored online is only as secure as the accounts tied to it. Boosting the protection of your tax preparation software, your IRS online account, and any financial accounts linked to refunds can help prevent account takeovers, where hackers crack your password and gain access to sensitive data.

Start by strengthening your account passwords. Use strong, unique passwords for each account, since reused logins make it easier for criminals to break in through credential stuffing attacks after accessing passwords following a data breach.

Next, enable multi-factor authentication on any accounts where it’s available, such as your tax preparer’s client portal or your chosen do-it-yourself tax software platform. This adds a second layer of protection by requiring a code sent to your phone or email in addition to your password, helping to stop criminals even if they already have your login credentials.

For added protection, consider setting up an IRS Identity Protection PIN (IP PIN) using your IRS account, or by completing Form 15227 if you don’t have an IRS account. An IP PIN is a unique six-digit code that you’ll need to provide when filing your return to reduce the risk of an identity thief filing in your name before you get a chance.

3. Watch out for tax season scams

Tax season is one of the biggest opportunities of the year for scammers. Filing puts your entire financial identity in motion, increasing the risk that sensitive data falls into the wrong hands. You’re also more likely to expect messages from employers, tax preparers, or the IRS, which makes it easier for scammers to pass phishing messages off as real.

Some of the most common tax season scams include:

• Fake IRS emails: Fraudsters contact you pretending to be from the IRS, suggesting you need to settle an outstanding debt or send sensitive documents.
• Imposters posing as tax preparers: Scammers pretend to be qualified tax professionals to steal your sensitive information or direct your refund to their account.
• Tax refund fraud: Criminals hacking into your account to redirect your return to their account, or commit mail fraud to steal a check refund.

These scams often use sophisticated social engineering tactics to appear legitimate and create a sense of urgency, pushing you to act quickly and hand over sensitive information. Scammers may threaten penalties, claim your refund is at risk, or insist immediate action is required. Some even launch AI-assisted scams, such as fake tax assistants or voice cloning, to make it seem like you’re speaking with a trusted professional.

And these scams aren’t rare — in fact, a study commissioned by Gen* found that 17% of respondents encountered a tax-related scam in 2025. The most commonly reported schemes included IRS impersonation, phishing texts or emails, identity theft using a stolen SSN, and fake AI chatbots posing as legitimate tax assistants.

Before responding to any tax-related message, pause and verify the sender’s legitimacy. Look for signs of a fake email, or contact the organization directly using the official contact information listed on its website. Avoid clicking links or downloading attachments unless you’re confident the message is genuine.

4. Verify your tax preparer’s data security

If you use a certified public accountant (CPA) or other professional tax preparer — like 37% of Americans — it’s critical to pay attention to how they protect your data. Since they’ll be handling your W-2, SSN, and full tax history, their security practices are just as important as yours. If your preparer’s system is weak, your sensitive data could be exposed.

A secure tax preparer should use encrypted storage, secure client portals, and strict access controls to manage who can see your information. They should also have strong cybersecurity, know about common phishing scams, and have a solid data theft recovery plan, as suggested in the IRS Taxes-Security-Together checklist.

To verify your tax preparer’s data-security standards, ask them the following questions:

• How is my tax data stored and protected?
• Who can access my personal information?
• Do you use multi-factor authentication on client accounts?
• How do you verify my identity before sharing or releasing information?

If a preparer can’t answer these basic security questions, or provides answers that don’t satisfy you, think about looking for an alternative. In some cases, they may simply fail to meet your security standards. But being picky also reduces the risk that you accidentally enlist the services of a fake tax preparer, who could steal your refund and your identity.

5. File early to reduce the risk of refund fraud

The IRS flagged $16.5 billion in refunds for possible identity fraud in 2024, according to the National Taxpayers Advocate mid-year report to Congress. Part of this total figure represents stolen tax refunds, where fraudsters use stolen personal information to file fake tax returns in someone else’s name.

Timing plays a major role in reducing the risk of tax fraud. Fraudsters often file fake returns as early as possible, hoping to beat you to it. If you wait until close to the deadline, you may discover that a return has already been submitted in your name, leaving you with a lengthy, frustrating process to resolve the issue.

Whenever possible, file as soon as you have all the required documents, such as your W-2 or 1099. That said, don’t rush at the expense of accuracy. If you’re still waiting on paperwork, it’s better to delay than to submit an incomplete or incorrect return. In the meantime, consider setting up an IRS Identity Protection PIN (IP PIN) to help reduce the risk of tax-related identity theft.

6. Opt for a direct deposit refund

How you choose to receive your refund can affect how vulnerable it is to fraud or mail theft. Direct deposit is generally safer than a paper check, which may be lost, intercepted, or stolen before it reaches you. Paper checks are especially risky if your mail is frequently misdelivered or could be accessed by someone else.

Choosing direct deposit also reduces the time it takes for your refund to arrive, typically resulting in any money you’re owed appearing in your bank account within 21 days. This reduces the window in which a criminal might attempt to interfere with your return.

When setting up your direct deposit, avoid using a shared or public device and make sure to enter your bank information accurately. Then, use the IRS Where’s My Refund? tool to check the status of your tax refund.

7. Monitor for signs of identity theft

Successfully filing your tax return doesn’t mean the risk of identity theft is over. Tax-related identity theft isn’t always immediately apparent, and signs of fraud could surface weeks or months later as criminals begin using stolen information to access credit or services in your name.

Short-term signs that your identity might have been stolen include unexpected notices from the IRS that you didn’t file, suspicious alerts about changes to your tax account, or your refund not turning up, even after the IRS Where’s My Refund? tool says it’s been issued.

Over the longer term, look out for common warning signs of identity theft, like unexplained bank activity, errors on your credit report, and issues accessing online accounts. You can freeze your credit proactively to help reduce the risk of fraud, and consider investing in an identity theft protection service like LifeLock to monitor your credit and personal information for signs of misuse.

Protect your identity this tax season

Following this checklist — taking simple steps to secure your tax documents and accounts, staying alert to scams, and being cautious during the filing process — can help reduce the risk of tax fraud. For added protection, join LifeLock to benefit from identity theft alerts, credit monitoring, and expert restoration support from a U.S.-based specialist if your identity is compromised.

FAQs

Why is tax season a high-risk time for identity theft?

Tax season increases the amount of sensitive personal and financial information being shared, stored, and transmitted, including SSNs and W-2s. Criminals exploit this activity by targeting tax filers and preparers with scams, filing fraudulent returns, or launching attacks against organizations that handle tax information.

Is it safe to email tax documents to my CPA?

In general, no, email isn’t a secure way to send sensitive documents like W-2s or completed tax returns. Secure client portals or encrypted upload tools offer far better protection against unauthorized access, and should be used whenever possible.

Does the IRS ever contact taxpayers by email or text?

The IRS rarely initiates contact by email or text. While you may receive electronic messages if you’re already in active communication with the agency, unsolicited messages claiming to be from the IRS should be treated as potential scams. If you’re unsure, contact the IRS directly using official contact information.

What is an IRS Identity Protection PIN (IP PIN)?

An IP PIN is a six-digit code issued by the IRS that adds an extra layer of security to your tax return. You must enter it when filing, which helps prevent someone else from submitting a return in your name, even if they have access to your SSN.