IRS CAF number misuse can hide in your authorization list

Identity theft isn’t slowing down, and tax pros remain a favorite target. Thieves want your third-party authorization information so they can pull taxpayer data straight from the IRS. In July 2026, the IRS and its Security Summit partners again warned tax pros about phishing scams aimed at Centralized Authorization File (CAF) numbers, electronic filing identification numbers (EFINs) and preparer tax identification numbers (PTINs).

How CAF identity theft works

A thief steals a taxpayer’s personally identifiable information (PII), such as name, address and Social Security number (SSN). They also steal the tax pro’s CAF information, including name, address and CAF number, plus the tax pro’s own SSN and date of birth. With that, the thief files a fraudulent Form 2848, Power of Attorney and Declaration of Representative, or Form 8821, Tax Information Authorization, listing the stolen tax pro as the representative or designee.

The thief then calls the IRS posing as the tax pro. If they pass authentication, they can ask about the client’s account and have transcripts placed in an e-Services Secure Object Repository (SOR) mailbox. That data then fuels other identity theft crimes.

What the IRS has in place

Since April 2024, tax pros requesting transcripts by phone for delivery to their SOR must use the Practitioner Priority Service (PPS) rather than general IRS toll-free lines; online transcript access through e-Services also remains available. Callers must pass enhanced authentication and verify their Short ID, an eight- to 10-character identifier visible in their e-Services SOR. If the IRS can’t verify the caller, transcripts are mailed to the taxpayer’s address of record instead.

The IRS also freezes CAF numbers it believes may be compromised. In its Oct. 1, 2025, alert, the IRS Office of Professional Responsibility (OPR) explained that a suspect CAF number is coded “pending review.” Until the review ends, IRS assistors, including PPS, can’t discuss client matters with that tax pro. The tax pro generally receives a letter from IRS Criminal Investigation. To speed things up, return the requested notarized identity verification within 30 days. If the CAF number is confirmed compromised, the IRS assigns a new one and moves your clients to it.

OPR also notes a frozen CAF isn’t always the tax pro’s fault. A client’s data breach can expose a copy of a Form 2848 or 8821, and legitimate practice patterns can trigger false positives. Either way, a freeze can interrupt your ability to represent clients before the IRS and cost you business, so prevention matters.

How to monitor your CAF number

Link your CAF number to your IRS Tax Pro Account. Once linked, you can view every active authorization on file, see client information within the scope of those authorizations and withdraw from authorizations in real time. To link, request a PIN in Tax Pro Account. The IRS mails it to the address on your CAF record, usually within one to two weeks, and the PIN expires after 30 days.

As of February 2026, firms can also link a business CAF number to their employer identification number (EIN) and choose which employees may act under it. Review your authorization list regularly and look for any taxpayer you don’t recognize. If you suspect unauthorized use, contact your local IRS stakeholder liaison right away.

How to protect your CAF number

• Vet new clients and get a signed engagement letter before sending any authorization.
• Keep your CAF number off documents that don’t require it; include it on IRS authorization forms.
• Submit authorizations electronically through Tax Pro Account. The taxpayer signs in their IRS Online Account, so no paper copy is exposed.
• Never share your CAF number, EFIN or PTIN in response to an unexpected email, text or call. Forward suspicious emails to [email protected].
• Keep your written information security plan (WISP) current. Federal law requires one.
• Forward suspicious text messages to 7726 (SPAM).

Also watch for red flags, such as IRS notices about clients you don’t represent or SOR transcripts you didn’t order.

Keep learning

NATP resources:

• IRS expands Tax Pro Accounts to support business users
• Update your firm’s cybersecurity practices in 2026
• Build a working WISP for your tax firm in one afternoon

IRS resources:

• Tax Pro Account
• OPR Alert 2025-14, CAF Numbers in “Pending Review” Status
• Publication 5709, How to Create a Written Information Security Plan for Data Safety

A compromised CAF is still uncommon, but the fallout can be severe for you and your clients. A few minutes in Tax Pro Account each month is inexpensive insurance.