How your information is protected

A tax return contains your Social Security number, your children’s Social Security numbers, your income, your employer, your bank details and your address. That is essentially everything somebody would need to impersonate you. It deserves better handling than most professions give it.

This page explains, in plain language, what happens to your information and why some of it may feel slightly inconvenient.

Everything goes through the portal, never email

Email is not encrypted in transit. A message sits in readable form on your provider’s servers, on mine, and on every system in between, more or less permanently. Anyone who gains access to either mailbox at any point in the future can read everything ever sent.

So documents move through an encrypted client portal instead. You upload, I download, nothing sits in an inbox. Uploading takes about as long as attaching a file to an email, and after the first week nobody thinks about it again.

This is also why every form on this site asks you not to include Social Security numbers, account numbers or attachments. Web forms are not secure channels either. Describe your situation in plain words and we will move somewhere appropriate before any detail is needed.

What is actually in place

Encryption of client documents both in transit and at rest.
Multi-factor authentication on every system that touches client data, including email, tax software and the portal.
Access control. This is a solo practice. Nobody else has access to your file. There is no offshore preparation team and no rotating staff.
Encrypted backups, held separately, so a single failure cannot lose your records.
A written information security plan, as required of tax professionals by the FTC Safeguards Rule, reviewed annually.
No paper unless there is no alternative. What little exists is stored locked and shredded when no longer needed.

What I will never ask you for

Worth committing to memory, because it makes impersonation attempts easy to spot.

Your password to anything.
Login credentials for your bank, your brokerage, your payroll system or your IRS online account.
A cryptocurrency seed phrase or private key. Nobody legitimate will ever ask for one of these, in any context, for any reason.
Payment by gift card, wire transfer to an unfamiliar account, or cryptocurrency.
Your Social Security number in a reply to an email.

If you receive a message that appears to come from me asking for any of those, it is not from me. Telephone before doing anything.

How the IRS actually contacts people

By post, first. The IRS does not open contact with a phone call, a text message, an email or a message on social media. They do not demand immediate payment by gift card or cryptocurrency, and they do not threaten to have you arrested over the telephone.

Tax season is high season for that particular fraud, and people who have genuinely received a notice are targeted more often because tax debt can surface in public records. If somebody rings demanding payment, hang up and call the number printed on your actual letter.

What I do with your information

Your work, and nothing else.

Tax return information is protected by Section 7216 of the Internal Revenue Code, which makes unauthorised disclosure or use a criminal offence rather than a matter of etiquette. I will not send your information to anybody, including your attorney or your lender, without separate written consent from you in the form the regulations require.

I do not sell client information, do not share it for marketing, and do not use it to sell you anything unrelated. The privacy policy sets out the detail.

If something goes wrong

No system is perfectly secure and anybody claiming otherwise is selling something.

If there is ever a breach affecting your information, you will hear it from me promptly and directly, with what happened, what was involved, and what to do about it. Tax professionals are also required to report certain incidents to the IRS and to state authorities, and I will.

If you suspect your own identity has been used to file a fraudulent return, that is a specific problem with a specific remedy and it is worth acting on quickly. Tell me and I will walk you through it.

One person, and what happens if something happens to me

This is a solo practice, which is why the person who understands your file is the person who answers the phone. It is a fair question what happens if I am unavailable.

Another Enrolled Agent has a standing arrangement to cover clients if I cannot, and records are backed up and accessible so nothing depends on one computer or one person’s memory. Most solo practitioners never mention this. I would rather tell you I have thought about it.

Questions about any of this are welcome. Get in touch.