In its October 2018 report, the IRS Information Reporting Advisory Committee (IRPAC) made these recommendations to the IRS:
- The IRS should immediately withdraw the requirement of the practitioner to verbally provide his/her personal tax identification number (TIN) and date of birth (DOB) when calling on behalf of a client. Given security concerns, effective January 2018, the IRS required tax practitioners to verbally provide personal TINs and DOBs instead of using centralized authorization file (CAF) numbers or employer identification numbers (EINs). While IRPAC understands that the change in procedure is due to valid security concerns, the requirement to verbally provide a practitioner's TIN or DOB exposes the practitioner to information security risk and identity fraud if overheard or recorded by third parties despite the best efforts of the practitioner to prevent any compromises.
- In the interim, the IRS should return to the prior procedure of requiring CAF numbers and EINs until they can implement a method that does not compromise the practitioner’s personal information.
- The following alternative requirements should be considered to address the IRS' security concerns with using CAF numbers and EINs:
- Create a PIN associated with the CAF number to enhance security;
- Request verbal statement of only the last four digits of the practitioner's TIN or first four digits of the practitioner's DOB;
- Create the ability for the practitioner to enter the last four digits of the TIN or first four digits of the DOB by using the telephone keypad; or
- Create an online account for use by the tax practitioner.