TL;DR: The IRS and its Security Summit partners have relaunched their annual “Protect Your Clients; Protect Yourself” identity theft awareness campaign, warning taxpayers and tax professionals about escalating scams, phishing attacks, and data theft. If you are behind on filing your taxes, identity thieves can exploit your unfiled status to file fraudulent returns in your name, making it even more urgent to act, protect your information, and explore tax debt relief options before the next filing season.
By Fresh Start Initiative
Why the Security Summit’s Warning Matters Right Now
Every summer, the IRS teams up with state tax agencies and the broader tax industry in what is known as the Security Summit, a public-private coalition formed in 2015 to fight tax-related identity theft. This summer is no different, and the warnings are sharper than ever.
According to the IRS, the coalition launched its five-week “Protect Your Clients; Protect Yourself” summer campaign on July 7, now in its eleventh consecutive year. The campaign targets both tax professionals and everyday taxpayers, highlighting practical steps everyone can take to lock down sensitive financial information.
If you owe back taxes or have unfiled returns sitting on the shelf, this news is especially relevant to you. Scammers actively look for people who are not current with the IRS because a fraudulent return filed in your name can go undetected for months, adding penalties, interest, and confusion on top of an already stressful situation.
What Is the Security Summit and Why Should You Care?
The Security Summit is not just a government agency talking to itself. It is a coalition that includes the IRS, all 50 state tax agencies, tax software companies, and the wider tax professional community, all working together on a shared problem.
The IRS announced in June that the Security Summit restructured its public-private partnership to strengthen protections and enhance information sharing across the entire tax system. The new framework introduced five dedicated work groups covering pre-filing fraud detection, threat forecasting, fraud prevention, detecting and reporting, and coordinated response to security incidents.
Since its founding, the Security Summit has helped protect millions of taxpayers and prevented billions of dollars from being wrongly paid out to fraudsters. The coalition’s reach now extends into payroll industry coordination, making it harder for thieves to use stolen wage data to fabricate convincing fraudulent returns. For you as a taxpayer, this means more eyes are watching, and more systems are in place to catch fraud before it snowballs.
The Threats the IRS Is Warning You About Right Now
The summer 2026 campaign focuses on three broad danger zones: emerging scams aimed at tax professionals, core security safeguards every taxpayer should know, and what to do if a data breach or identity theft occurs. Understanding these threats is the first step in protecting yourself.
Scammers are not only targeting large accounting firms. Cybercriminals have significantly shifted toward targeting small and mid-sized tax practices to access the financial data of everyday clients like you. When a tax professional’s systems are compromised, every client in their database is at risk.
The IRS and its Security Summit partners have identified several specific threats circulating right now:
- Phishing and smishing attacks: Scammers send emails, texts, or direct messages that appear to come from the IRS, often using alarming language and QR codes that direct victims to fake IRS websites to “verify” accounts or “claim refunds.”
- IRS impersonation calls: Thieves use spoofed caller IDs and automated calls pretending to be from the IRS, threatening license suspension or arrest to pressure victims into handing over personal details.
- “New client” spear-phishing: Tax professionals receive convincing emails from fake prospective clients. The attached “tax documents” actually contain malware designed to steal passwords and log keystrokes.
- IRS Online Account takeover: Criminals use stolen personal information to gain unauthorized access to a taxpayer’s IRS online account, or pose as “helpers” during account setup to harvest sensitive data.
- EFIN and PTIN theft: Scammers attempt to steal the professional identifiers used by tax preparers, including Electronic Filing Identification Numbers (EFINs) and Preparer Tax Identification Numbers (PTINs), to file fraudulent returns at scale.
- AI-generated deepfakes and robocalls: Artificial intelligence is now being used to create convincing fake videos appearing to feature tax experts, and to generate robocalls that sound entirely legitimate.
Remember: the IRS always initiates contact through the mail, not by email, text, or direct message. Any unsolicited digital contact claiming to be from the IRS should be treated as suspicious.
Free Eligibility Check
See if you qualify for tax debt relief
Take 60 seconds to find out which IRS programs you may qualify for. No obligation, no cost.
Check Your Eligibility →The New Five-Stage Anti-Fraud Framework: A Closer Look
One of the most significant developments this season is the restructured Security Summit framework, which organizes the fight against tax-related fraud across five stages of the tax lifecycle. This matters because it means the IRS and its partners are now working to stop fraud before a return is even filed, not just after the damage is done.
| Framework Stage | What It Does | Who It Protects |
|---|---|---|
| Pre-Filing | Identifies potentially fraudulent payroll data and suspicious behavior before a return is submitted | All taxpayers, especially those with W-2 income |
| Forecasting | Spots emerging scam patterns and anticipates threats before they are widely exploited | Taxpayers and tax professionals |
| Preventing | Implements proactive controls to block fraudulent filings at the point of submission | Anyone filing a federal or state return |
| Detecting and Reporting | Provides real-time fraud identification and intelligence sharing among all Summit partners | Taxpayers whose data may already be compromised |
| Responding | Deploys technical controls and coordinated responses to active security incidents | Victims of confirmed identity theft |
In addition to these five work groups, the Security Summit also uses its Coalition Against Scam and Scheme Threats (CASST) for rapid assessment and response to time-sensitive threats. If you are behind on filing, the pre-filing and prevention stages of this framework are particularly important to understand, because your window of vulnerability is wider the longer your return goes unfiled.
Why Taxpayers Behind on Filing Face Elevated Identity Theft Risk
If you have one or more years of unfiled tax returns, you are in a uniquely vulnerable position. Fraudsters can file a return under your Social Security number before you do, claiming a refund and leaving you to untangle the mess. The IRS will flag the duplicate filing, but resolving it can take months and delay any legitimate refund you are owed.
Beyond fraud, the longer you wait to file, the more interest and penalties accumulate on any balance owed. Staying invisible to the IRS is not a strategy. It is a risk multiplier. Getting current with your filing and exploring your tax debt relief options is one of the most protective steps you can take against both enforcement and identity theft.
The good news is that catching up on unfiled returns is more manageable than most people expect, especially when done with professional guidance. Tax debt relief programs exist specifically for people in this situation, and the IRS offers multiple paths to resolution that do not require paying everything at once.
Free Eligibility Check
See if you qualify for tax debt relief
Take 60 seconds to find out which IRS programs you may qualify for. No obligation, no cost.
Check Your Eligibility →Eight Steps to Protect Yourself During and After the Campaign
The Security Summit’s campaign is not just a warning. It is a playbook. Here are eight concrete actions you can take right now, drawing directly from IRS guidance, to protect your information and reduce your exposure:
- Get an Identity Protection PIN (IP PIN). An IP PIN is a six-digit number known only to you and the IRS that prevents anyone else from filing a return using your Social Security number. You can request one through your IRS online account at IRS.gov. It is free, voluntary, and one of the strongest protections available.
- Create or secure your IRS Online Account. Your IRS online account lets you view your tax history, balances, and notices. Creating it before a scammer does locks down a key entry point for identity thieves.
- Enable multi-factor authentication (MFA) everywhere. Use MFA on your email, tax software logins, and any financial account. A stolen password alone is not enough to get in when MFA is active.
- Never click links in unexpected emails or texts claiming to be from the IRS. The IRS communicates by postal mail first. Navigate directly to IRS.gov rather than following any emailed link.
- Verify your tax professional’s credentials. Use the IRS directory of credentialed tax preparers at IRS.gov to confirm that anyone filing on your behalf holds a valid PTIN and legitimate credentials.
- File all missing returns as soon as possible. Every year your return goes unfiled is another year a thief could file first. Filing gets your information on record with the IRS and closes the window for fraudulent duplicate filings.
- Report suspected scams immediately. The IRS has a consolidated tip line at IRS.gov/SubmitATip where you can confidentially report suspected tax fraud, identity theft, or scam activity from your phone, tablet, or computer.
- Ask about tax debt relief if you owe back taxes. If the fear of what you owe is keeping you from filing, speak with a tax professional about resolution programs. See how IRS payment plans and other relief programs work before assuming the worst about your situation.
What Happens If You Are Already a Victim of Tax Identity Theft
Discovering that someone has already filed a fraudulent return in your name can feel overwhelming. But there is a defined process for resolving it, and you do not have to navigate it alone.
If your e-filed return is rejected because one has already been filed under your Social Security number, that is a strong signal that identity theft has occurred. File a paper return immediately, include IRS Form 14039 (Identity Theft Affidavit), and contact the IRS Identity Protection Specialized Unit. You will also want to place a fraud alert with the major credit bureaus and report the theft at IdentityTheft.gov.
If you also owe back taxes, identity theft can complicate your resolution timeline, but it does not close the door on tax debt relief. The IRS has programs designed to address both issues, and working with a qualified tax professional can help you untangle both problems at the same time.
Frequently Asked Questions
What is the IRS Security Summit “Protect Your Clients; Protect Yourself” campaign?
It is an annual summer awareness campaign now in its eleventh year, run jointly by the IRS, state tax agencies, and the private tax industry. The campaign runs as a five-week series of news releases and education events focused on helping tax professionals and taxpayers recognize and defend against identity theft and data theft schemes. The 2026 campaign launched on July 7 and concluded in mid-September alongside the IRS Nationwide Tax Forums.
How does identity theft affect taxpayers who have unfiled returns?
Taxpayers with unfiled returns are particularly vulnerable because a fraudster can file a return in their name before they do, claiming a fraudulent refund. The IRS will flag duplicate filings, but the victim must then prove their identity and go through a lengthy resolution process. Filing all outstanding returns as quickly as possible closes this window and is also a critical step toward accessing tax debt relief programs.
What is an IP PIN and should I get one?
An Identity Protection PIN (IP PIN) is a six-digit number issued by the IRS that is known only to you and the agency. It must be included on your tax return when you file, and without it, the IRS will reject any return submitted under your Social Security number. The program is voluntary but strongly encouraged. You can enroll through your IRS online account at IRS.gov. Even fraudsters who have your Social Security number cannot successfully e-file without the correct IP PIN.
Will the IRS ever call, text, or email me about my IP PIN or identity theft?
No. The IRS will never call, email, or text you to request your IP PIN or to “verify” your identity over the phone or by clicking a link. Any contact claiming to be from the IRS through those channels is a scam. The IRS initiates contact through postal mail. If you receive a suspicious contact, report it at IRS.gov/SubmitATip.
I owe back taxes and I am afraid to file. Can I still get tax debt relief?
Yes. Fear of what you owe is one of the most common reasons people avoid filing, but unfiled returns only make the problem worse over time by adding penalties and interest and increasing your identity theft risk. The IRS offers several tax debt relief programs, including installment agreements, Currently Not Collectible status, and Offer in Compromise. A qualified tax relief professional can help you understand which options you may qualify for and guide you through the process of getting current with the IRS.
What is the new Security Summit framework announced in June?
In June, the IRS and Security Summit partners announced a major restructuring of their public-private anti-fraud partnership. The new framework established five dedicated work groups covering pre-filing fraud detection, threat forecasting, fraud prevention, real-time detection and reporting, and coordinated incident response. The goal is to stop identity theft and tax fraud at every stage of the tax lifecycle, not just after a fraudulent return is already filed.
