IRS Strengthens Authentication Process for Online Transcripts

With the assistance of top digital experts at U.S. Digital Service and other security authorities, the Internal Revenue Service has launched a more rigorous e-authentication process for taxpayers that will significantly increase protection against identity thieves impersonating taxpayers to access tax return information through the IRS Get Transcript online service. This enhanced authentication process will also provide a foundation for additional IRS self-help services in the future.

After being disabled last spring, Get Transcript Online is now available for all users to access a copy of their tax transcripts and similar documents that summarize important tax return information. The formal relaunch of Get Transcript Online addresses increased cybersecurity threats by using a new, more secure access framework. This framework enables the IRS to require a two-step authentication process for all online tools and applications that require a high level of assurance.

“The IRS is committed to the protection of taxpayer information and the security of our systems,” said IRS Commissioner John Koskinen. “Criminals are becoming increasingly sophisticated and continue to gather vast amounts of personal information as the result of data breaches at sources outside the IRS. In the face of that threat, we must provide the strongest possible authentication processes, while trying to enhance the ability of taxpayers to legitimately access their data and use IRS services online. We recognize that enhanced security will increase the challenge for taxpayers accessing our on-line services.”

While some taxpayers may now find it more difficult to authenticate their identities with this strengthened process, the IRS is committed to making sure everyone accessing the site will be able to do so in a safe and secure way. The IRS continues to support multiple options for those taxpayers who may be unable to access online features or who prefer to obtain information in more traditional ways. These options currently include ordering transcripts online or by phone for receipt by mail, which typically are delivered to the address of record within five to 10 days. The IRS continues to look for ways to expand options for all taxpayers.

“The incident with Get Transcript Online illustrates a wider truth about identity theft in general, which is that there are no perfect systems,” Koskinen said. “No one, either in the public or private sector, can give an absolute guarantee that a system will never be compromised. For that reason, we continue our comprehensive efforts to update the security of our systems, protect taxpayers and their data and investigate crimes related to stolen identity refund fraud.”

Tax transcripts are summaries of tax returns. Transcripts often are used for non-tax purposes, such as income validation for mortgages or student loans. Taxpayers also can use transcripts to obtain their prior-year adjusted gross income (AGI), which they need in order to e-file their tax returns.

Starting last year, the IRS began working with U.S. Digital Service to create a new e-authentication platform for Get Transcript and other IRS.gov tools. U.S. Digital Service is a branch under the Office of Management and Budget (OMB) that brings some of the private sector’s best tech experts into government to resolve complex issues facing federal agencies. The new secure access process meets the security standards set by the National Institute of Standards and Technology (NIST) and the OMB.

To access the new Get Transcript Online feature, taxpayers must have an email address, a text-enabled mobile phone and specific financial account information, such as a credit card number or certain loan numbers. Taxpayers who registered using the older process will need to re-register and strengthen their authentication in order to access the tool.

As part of the new multi-factor process, the IRS will send verification, activation or security codes via email and text. The IRS warns taxpayers that it will not initiate contact via text or email asking for log-in information or personal data. The IRS texts and emails will only contain one-time codes. See Fact Sheet 2016-20 for details on what you need to successfully access Get Transcript Online.

New features also allow taxpayers to see the date and time the Get Transcript Online page was last accessed. Returning users must always receive and enter a text code prior to being able to obtain access.

The IRS maintains a multi-pronged, strategic approach to combating identity theft and assisting taxpayers who become victims. Last year, the IRS, state tax agencies and the tax industry joined forces for a Security Summit Initiative that identified and enacted new security safeguards for taxpayers in 2016. The Security Summit partners are currently exploring additional safeguards for 2017.