For the Polish diaspora, this topic is of particular importance. Many immigrants file using an ITIN instead of an SSN, use tax offices run by friends or family, and do not always monitor who has access to their data—such as their Social Security number, copies of tax returns, and W-2 forms. It is precisely this information that allows a fraudster to file a false tax return under someone else’s name and intercept the tax refund before the rightful taxpayer can do so.
What an IP PIN is and why it works
An IP PIN is a six-digit number generated fresh every year, known only to the taxpayer and the IRS. The agency uses it to verify identity when filing a return—without the correct code, an electronic return will be rejected, and a paper return will be sent for additional verification. Confirmed victims of tax identity theft automatically receive a new IP PIN every year; others can join the program voluntarily using the “Get an Identity Protection PIN” tool on IRS.gov, provided they can verify their identity online.
The IRS emphasizes one security rule: an IP PIN should never be shared with anyone except the IRS itself and the trusted tax preparer preparing your return. The agency never calls, emails, or texts asking for this code—any such message is an attempted scam.
Two-factor authentication and online account as a second line of defense
Alongside the IP PIN, the IRS recommends multi-factor authentication (MFA) wherever possible—in tax software, email, cloud storage, and accounting systems. For tax practices serving clients, MFA is already mandatory: the FTC Safeguards Rule requires its use to protect client data unless the firm implements an equivalent safeguard approved in writing by a designated responsible person.
The second pillar is setting up your own IRS Online Account—a free account on IRS.gov that allows you to check your refund status, payment history, and filing information, while also preventing fraudsters from opening an account in your name. “Using multi-factor authentication, IP PINs, and other security measures adds important layers of protection for taxpayer and tax practitioner data,” said IRS Commissioner Frank J. Bisignano while announcing the appeal.
How theft happens in practice
The most common scenario is simple: a fraudster obtains an SSN or ITIN and basic personal information—from a data leak, a phishing email impersonating the IRS, or an unlicensed, dishonest “advisor”—and files an electronic tax return using that data before the genuine taxpayer does, pointing to their own bank account for the refund. The victim only finds out about the problem when their own legitimate return is rejected by the IRS system as a duplicate. Resolving the issue and recovering the owed refund can then be a process lasting many months.
What to do right now
This is a good time to obtain an IP PIN in advance of the upcoming filing season—the code is valid for only one calendar year, so it must be renewed annually. Individuals using a tax office should ask directly whether it uses multi-factor authentication to protect client documents—a question a reputable preparer will answer without hesitation. It is also wise to keep track of who is given copies of W-2s, 1099s, or past returns—the fewer hands holding these documents, the lower the risk of a leak. The IRS and Security Summit appeal is the fourth installment of this year’s “Protect Your Clients; Protect Yourself” campaign; the final meeting of this year’s IRS Nationwide Tax Forum takes place September 15–17, 2026, in San Diego.
This material is for informational purposes only and does not constitute tax advice. You should consult a licensed tax professional regarding decisions on how to secure your data and choose a tax office.
Polish accountants and tax advisors from the Polish Pages directory will help you file safely in the US and choose the right data security measures—check out the Polish Pages Finance Directory.
