{"id":55038,"date":"2024-08-21T08:00:00","date_gmt":"2024-08-21T13:00:00","guid":{"rendered":"https:\/\/taxprocenter.proconnect.intuit.com\/?p=55038"},"modified":"2024-08-14T11:58:55","modified_gmt":"2024-08-14T16:58:55","slug":"ftc-safeguard-rule-now-requires-multi-factor-authentication","status":"publish","type":"post","link":"https:\/\/accountants.intuit.com\/taxprocenter\/tax-law-and-news\/ftc-safeguard-rule-now-requires-multi-factor-authentication\/","title":{"rendered":"FTC safeguard rule now requires multi-factor authentication"},"content":{"rendered":"\n

All tax professionals are now required under the FTC’s safeguards rule to use multi-factor authentication<\/a> (MFA) to protect your clients\u2019 sensitive information. The June 2023 change mandates MFA to strengthen account security by requiring more than just a username and password to confirm an identity when accessing any system, application or device.<\/p>\n\n\n\n

MFA required by law<\/strong><\/p>\n\n\n\n

A key part of tax pro security now revolves around MFA. The three extra layers of different authentication factors provide extra assurance that a tax pro\u2019s client, not an impostor, is gaining access. Under the new FTC MFA rules, there\u2019s a requirement to use at least two of the following factors for anyone accessing customer information:<\/p>\n\n\n\n

    \n
  1. Something only a user knows<\/strong>, such as a username and password.<\/li>\n\n\n\n
  2. Something they have<\/strong>, including a token or random number sequence sent to their cell phone.<\/li>\n\n\n\n
  3. Something unique<\/strong>, such as biometric information.<\/li>\n<\/ol>\n\n\n\n

    Implementing MFA is one of the most cost-effective ways to increase security, and reduce a tax pro\u2019s fraud and data breach risks. Once in place, MFA helps protect against phishing<\/a>, social engineering, and other types of technology attacks that exploit weak or stolen passwords<\/a>.<\/p>\n\n\n\n

    In addition, MFA should be used to secure client information on a tax pro\u2019s computer or network, but it should also be used to access client information stored within their tax preparation software. MFA is required by law for all companies \u2013 not just tax professionals. The size of the company does not matter. Opting out of using MFA in tax prep software is a violation of the FTC safeguards rules.\u00a0<\/p>\n\n\n\n

    Common MFA examples  <\/strong> <\/p>\n\n\n\n

    The general public makes wide use of MFA these days, so tax pro clients shouldn\u2019t be surprised by the extra scrutiny asked of them. <\/p>\n\n\n\n

    For example, many smartphone users are accustomed to fingerprint or facial recognition that authenticates their identity before unlocking their device. Certain smartphone applications can also rely on that biometric factor, along with a PIN or password for app-level MFA.\u00a0<\/p>\n\n\n\n

    Many online banks, financial applications, and payroll services use MFA to verify account holders\u2019 identities before granting access or allowing high-risk transactions, such as money transfers. In addition, taxpayers connecting to the IRS will be asked to set up MFA to create an IRS\u00a0Online Account<\/a>. After that to sign in, they will log in with an email address and password, receive a one-time passcode by text or call to one\u2019s chosen device, and enter the passcode into the account to complete sign-in. A bad actor cannot access one\u2019s account without also having their passcode.\u00a0<\/p>\n\n\n\n

    Best implementation practices\u00a0\u00a0<\/strong>\u00a0<\/p>\n\n\n\n

    Tax pros should implement MFA across all their services and data access points.\u00a0They should also regularly evaluate current MFA methods, standards, and new technologies to stay protected against the latest threats, and should offer a variety of authentication factors to suit the needs of different users.<\/p>\n\n\n\n

    Tax pros should always enable MFA within tax software products and cloud storage services containing sensitive client data, and should never share usernames.\u00a0<\/p>\n\n\n\n

    Additional resources  <\/strong> <\/p>\n\n\n\n

    If a tax pro or their firm are the victim of data theft, they should:<\/p>\n\n\n\n