Client data stolen? How to report it to the IRS Stakeholder Liaison

Who do you call first when client tax data is stolen?

Your local IRS Stakeholder Liaison. The IRS's data theft guidance for tax professionals tells preparers to report client data theft to the Stakeholder Liaison for their area, and says that "Liaisons will notify IRS Criminal Investigation and others within the agency on your behalf."

Speed is the point. The same page explains that prompt reporting lets the IRS block fraudulent returns filed with your clients' information. A thief who has a client's name, Social Security number and prior-year return data can file a convincing return quickly. Every day between discovery and the call to the IRS is a day that return can go through.

Stakeholder Liaisons are assigned by geography. The IRS Stakeholder Liaison contacts page groups states into areas, each with a phone number and an area email address. California practices fall in Area 5. Find yours now and put the contact in your incident response plan, so nobody is searching IRS.gov on the worst day of the year.

What is an IRS Stakeholder Liaison?

An IRS Stakeholder Liaison is an IRS contact in the agency's Communications and Liaison division who manages relationships with tax practitioner and industry organizations. For data theft, the liaison is the tax professional's way in: the liaison gathers the details the IRS needs and passes the report to IRS Criminal Investigation and other units inside the agency.

Can you report data theft through the IRS toll-free line?

No. The IRS states that "IRS toll-free assisters cannot accept third-party notification of tax-related identity theft." A preparer calling the general practitioner or taxpayer lines will lose time and still need to reach the Stakeholder Liaison.

What does the IRS do after you report?

It moves to protect the affected returns. In its video guidance on what to do after a tax professional data compromise, the IRS says the liaison will "provide guidance and obtain the information that the IRS needs to protect you and your clients," and that a specially trained unit then takes immediate steps to mitigate the harm, including screening returns linked to the compromised data.

The IRS notes that some fraudulent returns differ from the real one only in the bank routing number. When a return looks suspicious, the IRS contacts the taxpayer to confirm it, and says it is critical that the taxpayer respond immediately. That is one more reason to tell clients early, so they recognize an IRS verification letter and answer it.

How do you know client data has been stolen?

Often the IRS or a client tells you before your systems do. IRS Publication 5293, the Data Security Resource Guide for Tax Professionals, lists warning signs, including:

• Client e-filed returns rejected because a Social Security number was already used.
• Clients who do not normally file receiving IRS authentication letters (5071C, 4883C or 5747C) or refunds.
• Clients receiving tax transcripts they did not request.
• More returns filed under your EFIN than you have clients.
• Computers slowing down, locking users out, or showing cursor movement no one is making.

Publication 5293 recommends checking EFIN usage weekly in your e-Services account and contacting the e-Help Desk if the numbers do not match your own count. Any one of these signs is a reason to start your incident response plan and call the liaison while you investigate.

Who else has to be notified?

Several parties, on different clocks. The IRS data theft page lists these contacts:

• State tax agencies: use the Federation of Tax Administrators' Report a Data Breach resource to reach each state where you prepare returns. The IRS video guidance gives the email address StateAlert@taxadmin.org.
• State attorneys general: the IRS lists the attorney general in each state where you prepare returns, so check each of those states' breach notice rules.
• Law enforcement: your local FBI field office, the Secret Service if directed, and a police report with your local department.
• The FTC: under the Safeguards Rule, 16 CFR 314.4(j), a notification event involving the information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery, using the FTC's online form. Our guide covers how to report a breach to the FTC under the Safeguards Rule.
• Your insurer, to report the breach and confirm coverage for response costs.
• A security expert, to find the cause and scope, stop the intrusion and prevent a repeat.
• Affected clients, by individual letter, with timing coordinated with law enforcement.

California preparers have a state deadline as well. Civil Code section 1798.82 requires notice to affected California residents within 30 calendar days of discovering a breach of unencrypted personal information, subject to limited exceptions such as a law enforcement request. A business notifying more than 500 California residents from one breach must also submit a sample notice to the Attorney General.

The IRS also suggests notifying the three credit bureaus so clients can use their services, and checking whether your state requires you to offer credit monitoring to victims.

Should clients file Form 14039?

Only in specific situations. The IRS says clients should complete Form 14039, the Identity Theft Affidavit, only if they receive an IRS notice or letter, or if their e-filed return is rejected because of a duplicate Social Security number. Client notice letters should say exactly that, so clients know what to watch for and when to act.

What should a tax practice do this quarter?

Put the reporting steps in writing before anything happens. The FTC Safeguards Rule requires a written incident response plan from any preparer holding information on 5,000 or more consumers, and IRS Publication 5708 shows how to fold the post-breach steps into a WISP at any size. If you are already updating your plan, our guide to IRS WISP requirements for the 2027 filing season covers the rest. A practical checklist:

• Look up your Stakeholder Liaison and add the contact to the WISP's incident response section.
• List every state where you prepare returns, with its tax agency breach contact and attorney general notice rules.
• Record your local FBI field office, police non-emergency line, insurer claim number and IT provider emergency line on the same page.
• Assign one person to make the IRS call and one to coordinate client notices.
• Keep a current client list with addresses that can be exported quickly, since every notice depends on it.
• Set a weekly reminder during filing season to compare EFIN usage against your own return count.
• Run a 30-minute tabletop exercise with staff: a client calls saying their return was rejected as a duplicate. Who does what in the first hour?

How does s90 help?

s90 supports tax and accounting practices across Los Angeles and Orange County with the monitoring, logging and response that make an incident easier to scope and report. Our agreements commit s90 to notify clients within 72 hours of a breach and to produce evidence within 24 hours of a request, which gives a practice what it needs for the Stakeholder Liaison, its insurer and the FTC. If your WISP's incident section has not been tested, we can walk through it with you.