The IRS has announced in a news release that on June 28 the agency will no longer fax or mail transcripts to third parties under steps announced to attempt to protect taxpayer data from unauthorized release.[1]  The IRS had warned in 2018 that they planned to take this step.

The news release explains the issues raised by the prior system of faxing or mailing transcripts to third parties:

Tax transcripts are summaries of tax return information. Transcripts have become increasingly vulnerable as criminals impersonate taxpayers or authorized third parties. Identity thieves use tax transcripts to file fraudulent returns for refunds that are difficult to detect because they mirror a legitimate tax return.[2]

The issue with prior systems is one we’ve discussed before here in dealing with information system security—the paper system for authorizing such releases did not provide adequate authentication. Authentication involves processes to insure that the party to which data is being provided or access is granted is actually the party who should be granted access to such information. 

The faxing program ends on June 28.  The news release provides mechanisms that taxpayers who previously would ask to have a transcript faxed to him/her can now use to access transcripts:

Individual taxpayers have several options to obtain a tax transcript. They may:

• Use IRS.gov or the IRS2Go app to access Get Transcript Online; after verifying their identities, taxpayers may immediately download or print their transcript, or

• Use IRS.gov or the IRS2Go app to access Get Transcript by Mail; transcript will be delivered within 10 days to the address of record, or

• Call 800-908-9946 for an automated Get Transcript by Mail feature, or

• Submit Form 4506-T or 4506T-EZ to have a transcript mailed to the address of record.

Observers will note that the last two options seems to have limited authentication systems built in.  The IRS is relying on the fact that the transcript is being sent to the taxpayer’s last known address and, presumably, even if the transcript isn’t being requested by the taxpayer they will still be the one to receive the transcript.

Obviously that system is not fool proof—no authentication is necessary to file a change of address form with the IRS (which would change the address of record), nor will this system work to stop a party that has access to the taxpayer’s mail (such as a member of the same household) from obtaining the data.  But as is generally true, the agency has to balance security against the need to serve taxpayers who aren’t able or willing to use more secure means of accessing the data.

The news release also provides options for tax professionals to obtain transcript information once the faxing and third-party mailing program ends:

Tax professionals also have several options to obtain tax transcripts necessary for tax preparation or representation as follows:

• Request that the IRS mail a transcript to the taxpayer’s address of record, or

• Use e-Services’ Transcript Delivery System online to obtain masked individual transcripts and business transcripts, or

• Obtain a masked individual transcript or a business transcript by calling the IRS, faxing authorization to the IRS assistor and the IRS assistor will place the document in the tax practitioner’s e-Services secure mailbox.

• When needed for tax preparation purposes, tax practitioners may:

  • Obtain an unmasked wage and income transcript by calling the IRS, faxing authorization to the IRS assistor and the IRS assistor will place the document in the tax practitioner’s e-Services secure mailbox, or

  • Obtain an unmasked wage and income transcript if authorization is already on file by using e-Service’s Transcript Delivery System.

The release notes that taxpayers will no longer be able to use Forms 4506, 4506-T or 4506-EZ to request that transcripts be sent to third-parties and the form will be modified to remove that option.  The release notes that lenders often have used these documents to verify income and that tax preparers are often the parties listed to receive these documents.

Per the release, taxpayers will still be able to use these forms to request that transcripts and copies of returns be sent to their address and that the program will not affect the use of the data retrieval tool through the Free Application for Federal Student Aid (FAFSA) process.

The release goes on to describe other options available for parties that previously relied on having these documents mailed direct to them:

Third parties who use these forms for income verification have other alternatives. The IRS offers an Income Verification Express Service (IVES) which has several hundred participants, who, with proper authorization, order transcripts. Lenders or higher education institutions can either contract with existing IVES participants or become IVES participants themselves. The tax transcript is an official IRS record. Taxpayers may choose to provide transcripts to requestors instead of authorizing the third party to request these transcripts from the IRS on their behalf.

Tax professionals who are attorneys, Certified Public Accountants or Enrolled Agents (i.e., Circular 230 practitioners) and do not have an e-Services account may create one and, with proper authorization from clients, can access the e-Services’ Transcript Delivery System. Unenrolled tax practitioners must have an e-File application on file and be listed as delegated users to access TDS.

The release also notes the IRS will provide a “customer file number” space on returns since the taxpayer’s name and social security number will now be partially masked.  This number will allow a third party to assign such a customer number to a taxpayer which will allow that party to match up the documents (which will have the customer account number printed on them) to the specific individual involved.[3]

[1] IR 2019-101, June 4, 2019, https://www.irs.gov/newsroom/irs-takes-additional-steps-to-protect-taxpayer-data-plans-to-end-faxing-and-third-party-mailings-of-certain-tax-transcripts, site accessed June 10, 2019

[2] Ibid

[3] Ibid