Given the sensitivity of taxpayer information, the IRS is continually reviewing and strengthening its practices to guard against identity theft and the improper disclosure of taxpayer information. In connection with those effort to authenticate an individual’s identity and authorization to receive sensitive information, the IRS has long requested personal information, in addition to their CAF number, from practitioners (or anyone accessing tax-related information by means of a Form 8821). The purpose of the authentication process, including the validation of the individual’s SSN, is to protect both taxpayers and the tax professionals who are working on their behalf.
Beyond this basic authentication step, the IRS has a process for IRS employees to refer authorizations with suspicious characteristics for further review. Under this process, the status of the affected CAF account will be coded to “P” for “pending review,” indicating that the CAF number is currently under review for potential compromise and may be subject to fraudulent use.
What might cause a CAF number to be suspended pending review? First, the suspension may have absolutely nothing to do with anything the practitioner has done. If the practitioner has included their CAF number in a document appropriately shared with a client or other third party and that document (e.g., a copy of a Form 2848 or Form 8821) is exposed because of a physical or digital data breach experienced by the client or third party, the CAF number could be compromised and misused—in particular, by a malicious actor who files a fraudulent authorization form with the IRS to gain access to taxpayer information. In addition, there could be aspects of a practitioner’s tax practice that, while legitimate, might trigger IRS red flags.
A practitioner may learn that this has happened to them in different ways. For example, they might contact the IRS to discuss a client’s tax matter and be informed that the conversation cannot occur because the practitioner’s authority to represent the client cannot be verified. Regrettably, because of privacy concerns or other restrictions, the IRS employee who is dealing with the practitioner (or the taxpayer) may not be able to share any additional information with them, only exacerbating their confusion.
Once a preliminary determination is made that a practitioner’s (or other tax professional’s) CAF number may have been compromised and is placed in review, the practitioner will receive a letter by mail from the IRS—generally from IRS Criminal Investigation (CI) —letting them know their CAF is under review.
To help expedite the review process:
- The individuals who receive these letters are asked to verify their identities by sending to the IRS a notarized document that includes pictures of their photo identification.
- The notarized document should be returned to CI using the mailbox provided in the letter within 30 days from the date of the letter.
- The return of the notarized document will then begin a dialogue of verifying their client listings and, if needed, the issuance of a new CAF number. The dialogue may be done over the phone in some cases to accelerate the process.
- For those CAF holders whose CAF number is confirmed to be compromised, the IRS will work with the CAF holder to assign them a new CAF number and move their clients to the tax professional’s new CAF number.
For the full IRS Bulletin click here
