Does the IRS require MFA for tax preparers? Yes. If you use the IRS's Tax Pro Account, e-Services, or any other online tool protected by ID.me, the agency's third-party identity verification provider, you must set up multi-factor authentication (MFA) before you can log in. MFA is a login method that requires two separate proofs of identity, typically a password plus a one-time code or a physical security key, so a stolen password alone can't open the account.
Tax Pro Account is the IRS's free portal for submitting Power of Attorney (Form 2848) and Tax Information Authorization (Form 8821) requests electronically instead of mailing paper forms. The IRS built ID.me's MFA requirement into every account it protects, which means you can't skip MFA no matter what your firm's internal login policy says. If you're setting this up for the first time in 2026, budget 15 to 30 minutes: identity verification through ID.me is the slow part, and choosing your MFA method only takes a couple of minutes.
Quick Answer
Yes, the IRS requires MFA for tax preparers who access Tax Pro Account, e-Services, or any IRS tool that uses ID.me for identity verification. You enable it by verifying your identity with ID.me, which includes uploading a government-issued photo ID and completing a selfie or video call, then choosing an authenticator app, a security key, or an SMS code as your MFA method. Save the backup codes ID.me generates before you finish. Losing your MFA device without them means repeating identity verification from scratch.
Why Tax Preparers Can't Opt Out of MFA
The IRS routes identity verification and login security for Tax Pro Account, e-Services, and individual IRS Online Accounts through ID.me, a third-party identity verification provider. ID.me requires MFA on every account it protects, so there's no setting inside Tax Pro Account to turn it off.
This matters beyond compliance. Tax preparers are a standing target for credential theft, and one compromised Tax Pro Account or e-Services login can expose the tax records of every client tied to that preparer. The IRS e-file account security requirements guide covers the broader login protections the IRS expects preparers to maintain across its systems.
How to Set Up MFA on Tax Pro Account
Start at IRS.gov
Go to the Tax Pro Account page on IRS.gov and select Sign in to Tax Pro Account. First-time users select Create Account and are routed to ID.me.
Verify your identity with ID.me
Upload a government-issued photo ID, such as a driver's license or passport, and complete a selfie match. If automated matching fails, ID.me offers a live video call with a verification agent.
Choose your MFA method
Select an authenticator app such as Google Authenticator or Authy, a security key such as a YubiKey, or text or voice message codes. ID.me and the IRS recommend an authenticator app or security key over SMS, which is more vulnerable to SIM-swapping.
Save your backup codes
Download or record the one-time backup codes ID.me generates. These are your only recovery path if you lose your MFA device without repeating identity verification.
Confirm access to Tax Pro Account
Log back into Tax Pro Account with your new MFA method to confirm you can submit Form 2848 and Form 8821 requests.
Watch for Lookalike Login Pages
Only enter your ID.me credentials and MFA codes at the official irs.gov or id.me domains. The IRS warns that phishing campaigns regularly mimic official login pages to steal practitioner credentials, as detailed in its tax scams and consumer alerts. No legitimate IRS or ID.me prompt will ask you to read a one-time code back over the phone or by text.
What If ID.me Can't Verify You, or You Lose Your MFA Device?
ID.me's automated identity verification fails for ordinary reasons: a blurry photo, a name mismatch between your ID and your credit file, or address history that doesn't match public records. When automated matching fails, ID.me offers a live video call with a verification agent during business hours, where you show your ID and answer identity questions instead of waiting on a support ticket.
If you lose your MFA device and don't have your backup codes, you'll need to go through ID.me identity verification again. There's no phone-call reset with the IRS; the process runs entirely through ID.me by design, since a phone-based shortcut would recreate the social-engineering risk MFA exists to close.
Each tax professional needs their own Tax Pro Account tied to their own Preparer Tax Identification Number (PTIN) and their own ID.me identity, MFA included. You can't share one account and one MFA method across multiple preparers at a firm, even a small one.
MFA on Tax Pro Account Is Only One Piece of Your Firm's Requirement
Setting up MFA on Tax Pro Account satisfies the IRS's login requirement for that one tool. The FTC Safeguards Rule (16 CFR Part 314) has required MFA for anyone accessing a covered firm's customer information systems since June 2023, including tax software, email, and file storage, not just IRS accounts.
IRS Publication 4557 and the IRS's Security Six checklist list MFA as one of six baseline controls, alongside antivirus software, a VPN, backups, encryption, and a designated data security coordinator. If your firm hasn't documented these controls yet, a Written Information Security Plan (WISP) template maps the MFA setup you just completed to a written policy an examiner or cyber insurer can review.
Action Checklist
- Enable MFA on your IRS Tax Pro Account through ID.me
- Choose an authenticator app or security key over SMS where possible
- Save your ID.me backup codes somewhere other than your primary device
- Enable MFA on your tax software, email, and e-Services accounts, not just Tax Pro Account
- Document your MFA policy in your firm's WISP
- Train staff to recognize IRS or ID.me phishing attempts before entering credentials
Need your WISP to cover this?
Bellator builds custom Written Information Security Plans for tax practices, starting at $749 for up to 5 users, with a custom quote for larger firms.
Talk with a cybersecurity expert
Get plain-language help closing the gaps between your IRS account security and your firm's broader WISP obligations.
Frequently Asked Questions
No. The IRS and ID.me do not call, text, or email asking you to read back a one-time code or reset your MFA over the phone. Treat any such contact as a phishing attempt and verify by going directly to IRS.gov.
Yes, ID.me offers SMS or voice call codes as an MFA option. An authenticator app or a physical security key resists SIM-swapping better, where a criminal transfers your phone number to a new device to intercept text codes.
No. Tax Pro Account and e-Services are separate IRS systems with different functions, but both rely on ID.me for identity verification and MFA. You may need to complete identity verification separately for each system depending on which IRS tools you use.
No. The FTC Safeguards Rule requires MFA across the systems your firm uses to access customer information, including tax software, email, and file storage. Tax Pro Account MFA only covers your login to that one IRS tool. Confirm specific compliance obligations with your firm's counsel or compliance advisor.
You can't access Tax Pro Account at all. ID.me identity verification and MFA setup are mandatory steps built into the account, not optional add-ons you can skip or defer.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
