In its October 22, 2026 announcement (IR-2026-127), the Internal Revenue Service reminded taxpayers to secure their online tax accounts and consider an Identity Protection PIN (IP PIN). The warning is timely for U.S. business owners, cross-border finance teams and individuals who exchange sensitive tax documents.
This is a security reminder, not a new blanket business filing mandate. A compromised credential may expose returns, payment records, refund information and communications with the IRS.
What the IRS actually recommends
Do not share your individual IRS Online Account credentials. Use secure authentication methods and verify unusual requests independently. An IP PIN may offer a further layer of protection against fraudulent federal income tax returns.
The six-digit IP PIN helps prevent a return from being filed using someone else’s Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN). It is for the individual taxpayer: an IP PIN is not a company-wide tax PIN, an Employer Identification Number or a substitute for corporate cybersecurity controls. Share it only with a trusted tax professional when a return is ready to be prepared and filed.
A timing consideration before the 2027 filing season
The IRS advisory noted that taxpayers who intend to file early in 2027 should consider obtaining an IP PIN before the online application system closes for annual maintenance in mid-November 2026. Availability normally resumes around mid-January; check the IRS website for current operational dates.
Five controls for U.S. businesses and finance teams
- Restrict access: assign tax-document permissions by role, not convenience.
- Strengthen sign-in: use additional account protections where available.
- Verify changes: confirm unexpected banking or tax-data requests through an independent channel.
- Secure document exchange: agree on approved methods with accountants and tax advisers.
- Keep an audit trail: record authorized changes, exceptions and incident responses.
These are operational recommendations, not requirements newly introduced by the IRS release. For companies with U.S. and Mexican operations, responsibility for records and filings should be clearly divided between teams and advisers.
Cross-border operations: prevent gaps between teams
U.S. subsidiaries reporting to a Latin American parent should document who owns tax correspondence, account access and supporting records. Financial teams coordinating both countries may benefit from ASCG’s U.S.–Mexico cross-border advisory and the USA Desk guidance on intercompany service fees, where relevant. Neither service should be interpreted as the IRS issuing or managing an IP PIN for a business.
The key takeaway
Tax identity protection is a joint effort involving individual taxpayer safeguards and sound business processes. The IRS states it will never call, email, text or use social media to request an IP PIN. If asked for that code unexpectedly, stop and verify directly with the IRS.
Official sources: IRS, IR-2026-127 (October 22, 2026) and Get an Identity Protection PIN.
General information based on IRS IR-2026-127 of October 22, 2026. IP PIN is an individual SSN/ITIN safeguard, not a corporate code. Confirm current IRS system availability and seek advice for your facts.
Related professional service
U.S.–Mexico Cross-Border Advisory | ASCG USA Desk
For questions about how this topic applies to your business, contact ASCG directly.
Explore U.S.–Mexico advisory