Protecting Your Business's Tax and Payroll Records: Six Steps From the IRS

On October 2, 2026, the IRS listed six steps it wants taxpayers, businesses and tax professionals to take to protect tax data (IR-2026-119). None of them is new or expensive. For a small business, the risk sits with whoever handles the books and payroll, so that's where I'd apply them first.

The six steps, as the IRS lists them

From IR-2026-119:

1. Use strong, unique passwords. Use a different password for each important account, and consider a password manager.
2. Turn on multifactor authentication wherever it's offered.
3. Update software and devices, including phones, apps, browsers and security software. Turn on automatic updates when you can.
4. Recognize and report scams. Be wary of unexpected emails, texts, social media messages, calls or letters that ask for personal or financial information or push you to act right away.
5. Protect tax records. Store digital tax records securely, encrypt sensitive files and back up important information.
6. Use secure networks. Avoid public Wi-Fi for financial accounts, tax records and IRS online services.

What that means for the books and payroll

A small business usually has a short list of accounts where a breach does real damage. I'd go through them one by one:

• Bank and payment accounts, including the business credit card portal.
• Payroll software and the payroll provider's portal, where employee Social Security numbers, bank details and W-2s live.
• Accounting software, which often connects to the bank.
• IRS and California tax accounts, including the IRS Business Tax Account and your FTB online account.
• Email for whoever approves payments.

For each one, confirm that every user has their own login, that multifactor authentication is on, and that people who've left the business no longer have access. Shared logins make it impossible to tell who did what, and they tend to outlive the people who knew them.

The payroll scams the IRS warns about

IR-2026-119 calls out businesses, payroll professionals and HR offices by name. It tells them to stay alert for phishing, fake invoices, and W-2 and payroll schemes meant to steal employee information, credentials or money. Its instruction is plain: requests to change sensitive employee or payment information should be verified through a trusted channel.

In practice, that means two rules I'd put in writing:

• A request to change an employee's direct deposit is confirmed by phone or in person, using a number already on file, never one in the email that asked for the change.
• A request for W-2s or a list of employees with Social Security numbers is treated as suspect, even when it appears to come from the owner. Confirm it in person.

The same goes for a vendor who suddenly sends new bank instructions. Call the number you already have for them.

Records: where they live and who can reach them

The fifth IRS step, protecting tax records, is where small businesses tend to be loosest. I'd check three things:

• Where the files are. Tax returns, payroll reports and W-2 copies should be in one known place, encrypted, and not scattered across inboxes and desktops.
• Who can open them. Access should follow the job. A bookkeeper needs the books, not the owners' personal returns.
• Whether a backup exists and works. A backup you've never restored from is a guess. Test it once.

The IRS's Business Tax Account is worth setting up if you haven't. It's available to sole proprietors, partnerships, S corporations and C corporations, and it lets you see your business information and manage who has access through Designated Users (IRS, Business Tax Account). Seeing your own account directly also makes it easier to spot a filing or payment you don't recognize.

How to tell it's really the IRS

The IRS normally makes first contact by mail. It sends email or texts only when a taxpayer has opted in, and it never sends direct messages through social media. It won't call to demand immediate payment or threaten arrest (IR-2026-119). Suspicious messages can be reported through the IRS's tax scams page.

What I'd do this month

• List the accounts above and check multifactor authentication on each.
• Remove access for anyone who no longer needs it.
• Write down the direct deposit and W-2 request rules, and share them with whoever runs payroll.
• Confirm where tax and payroll records are stored, and test the backup.
• Set up the IRS Business Tax Account for the business.

If your books and payroll records are spread across too many places to secure easily, cleaning that up is part of how I set up bookkeeping for clients. Send an inquiry if you'd like help.

General information, not advice for your situation. The guidance here is from the IRS as of October 2026, as checked on the date above.