Blog
Two-Factor Authentication Requirements: Why the IRS Requires It Now
September 15, 2026
A lot of firm owners still treat two-factor authentication as a nice-to-have — something IT recommends, not something that's actually required. That's no longer accurate. MFA is now a specific, named requirement under the FTC Safeguards Rule, and the IRS Security Summit lists it as one of the "Security Six" protections every tax professional is expected to have in place. Here's what changed, and where firms most often fall short of it in practice.
Where the requirement actually comes from
Two separate but overlapping sources put MFA on your firm's required list, not its optional one. First, the FTC Safeguards Rule — the regulation covering any firm handling client tax, payroll, or financial data — requires multi-factor authentication for any individual accessing a system that stores customer information, unless a qualified individual has approved an equivalent alternative control in writing. Second, the IRS Security Summit's "Security Six" (alongside anti-virus software, a firewall, backup systems, drive encryption, and a VPN for remote access) names MFA directly as a baseline protection for tax professionals. Because PTIN renewal is now tied to Safeguards Rule compliance, this isn't background security advice — it's a condition of being able to keep filing returns.
Every login path, not just your main software
The gap we see most often isn't "no MFA anywhere" — it's MFA on the one system a firm thinks of first, and nowhere else. A complete rollout covers every point of access to client data, which for most firms means:
- Tax preparation and e-file software
- Cloud accounting platforms (QuickBooks Online, Xero, or similar)
- Client portals and document intake tools
- Email accounts, if client documents or data ever pass through them
- Remote access tools and VPN connections used by staff working outside the office
A firm that enabled MFA on its tax software two years ago but never revisited the client portal it added last year, or the spreadsheet-and-email workaround one staff member still uses, has a documented control that doesn't actually match how the firm operates day to day.
Not all MFA is equally strong
The rule doesn't specify an exact method, which means firms often default to whatever's fastest to turn on — usually a text message code. It technically satisfies the requirement, but SMS codes are the weakest form of MFA available; SIM-swap attacks specifically target this method, and auditors increasingly flag it as a soft spot even when it's technically present. An authenticator app or a hardware security key closes that gap for a small amount of extra setup time, and it's worth prioritizing for anything touching tax returns or payroll data specifically.
Why a one-time MFA checkbox doesn't hold up
This is where generic compliance advice tends to stop short: "turn on MFA" sounds like a single task you complete once. In practice, whether your firm is actually covered depends entirely on your specific mix of tools — which software you use, how many of them your staff touch, whether a client portal or automation tool got added after your last security review, and whether any of your team has found a workaround that skips the second factor entirely. A checklist built for a generic firm has no way of knowing about the specific tools your firm actually runs, which is exactly why we build MFA verification into every automation and security workflow we set up for a client, rather than treating it as a one-time box to check during onboarding.
For the broader compliance picture, see our guides to the FTC Safeguards Rule and building a WISP checklist. This is also part of our complete guide to AI for accountants.
Frequently Asked Questions
Does the IRS actually require two-factor authentication for tax preparers?
Yes. Multi-factor authentication is one of the IRS Security Summit's "Security Six" protections, and it's also an explicit requirement under the FTC Safeguards Rule for any individual accessing a system that stores client information. Since PTIN renewal is now tied to Safeguards Rule compliance, a firm without MFA in place is exposed on both fronts — not just facing a hypothetical security risk.
What counts as acceptable MFA under the FTC Safeguards Rule?
The rule doesn't mandate one specific method — it requires MFA on any system storing customer information unless a qualified individual has approved an equivalent control in writing. In practice, that means every login path into client data needs a second factor: something the user knows (a password) plus something they have (an authenticator app, a hardware key, or at minimum a text code).
Is SMS-based two-factor authentication enough for compliance?
Technically it satisfies the letter of the rule, but it's the weakest option — SMS codes can be intercepted through SIM-swap attacks, which regulators and security auditors increasingly flag as a gap. An authenticator app or hardware security key is a meaningfully stronger choice for anything touching tax returns or payroll data, and it's worth the small amount of extra setup.
What happens if my firm doesn't use MFA and gets audited or breached?
The FTC can pursue civil penalties, and because the IRS now ties Safeguards Rule compliance to PTIN renewal, a documented gap like missing MFA can put a preparer's ability to legally file returns at risk — not just their firm's reputation. In a breach investigation, absent MFA is one of the first things examiners look for.
Do clients need MFA too, or is this just for staff logins?
The requirement is aimed at anyone accessing systems that store client information — which usually means your staff's logins to tax software, cloud accounting platforms, and client portals. Requiring MFA on a client-facing portal is good practice for protecting their data too, but the regulatory obligation centers on who inside your firm can reach that data, not on the client's own device.
We map and configure MFA across your firm's actual toolset — never a generic checkbox.
Book a Free Consultation