obÌåÓý

IRS employees must always verify the taxpayer¡¯s identity per IRM 11.3.1.2, Disclosure Code, Authority and Procedure (CAP), before discussing any information protected under IRC 6103.

This policy applies to the centralization of the identity proofing and authentication processes in customer contact channels (correspondence, telephone, in-person, remote in-person (video teleconferencing), and online exchanges) where sensitive information is exchanged with individuals.

Relevant federal guidelines include:

The IA Director, within PGLD, is responsible for the identity verification and authentication policy. The Director of IA reports to the Chief Privacy Officer and is responsible for IA program oversight. Organization executives and management officials who lead programs described in this policy are responsible for these guidelines and for continuous monitoring of new and ongoing authentication policies related to these channels.

IA's role is to strengthen and implement IRS authentication standards for:

Part of the IA mission is to establish and maintain a Servicewide strategy that provides a framework for the Centralized Authentication Policy to consolidate policy with regard to identity proofing and authentication. This enables emerging technology and security measures to be incorporated into a single source of reference when those tools become available. The IRS will actively help taxpayers who try to follow the law, and work to continually improve the quality of systems and services to meet the needs of customers. All taxpayers, whether delinquent or fully compliant, are entitled to prompt and professional service whenever they deal with IRS employees. The public as a whole is the customer, not just delinquent taxpayers. Customers expect the IRS to promote voluntary compliance by ensuring that all taxpayers promptly pay their fair share.

Business units are responsible for completing their own review. Management officials bear the responsibility to conduct risk assessments of factors, procedures, and processes used to authenticate taxpayers, representatives or other third-parties interacting with the IRS. Refer to Form 15295, Non-Digital Authentication Risk Assessment (NDARA). The Identity Assurance function manages and reviews authentication in Digital and Non-Digital Channels at least once every two years. For more information regarding NDARAs, please refer to IRM 10.10.2, Authentication Risk Assessments in Non-Digital Channels.

Goals, measures, and operating guidelines are listed in each business unit¡¯s yearly Program Letter or other management guidance. Quality data and guidelines for measurement are referenced in IRM 21.10.1, Embedded Quality (EQ) Program for AM, Campus Compliance, Field Assistance (FA), Tax Exempt/Government Entities (TE/GE), Return Integrity and Compliance Services (RICS), and Electronic Products and Services Support (EPSS).

The below table lists commonly used terms and definitions relevant to this program that are used throughout this IRM:

The following table lists acronyms and definitions frequently used throughout this IRM subsection:

Below are the related resources:

In the event an inadvertent disclosure occurs or an unauthorized access takes place, refer to the following guidance:

The following table lists the primary sources of guidance:

This subsection of the IRM provides guidance and procedures for IRS employees in:

You must also verify the relationship of the caller to the applicant before disclosing any information. The following signature relationships are reflected on RTS:

The RTS captures the relationship of the person who signed the Form W-7 as well as the name if other than the applicant. The table below provides additional guidance for signature verification.

If a caller indicates that they are a Certifying Acceptance Agent (CAA), and inquiring about the status of an application, refer them to their signed CAA agreement and have them call the number listed in the agreement.

This subsection of the IRM provides guidance and procedures for the IRS Acceptance Agent (AA) Program. Use the following tables to authenticate a customer and their authority to receive information about an Acceptance Agent application:

This subsection of the IRM provides guidance and procedures for employees in:

This subsection of the IRM provides guidance and procedures for:

This subsection of the IRM provides guidance for Taxpayer Services (TS) and Small Business/Self Employed (SB/SE) business operating divisions (except employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), that handle taxpayer contacts when:

Use the following identity proofing process when verifying the requestor¡¯s identity for when you initiate an outgoing phone call. The taxpayer may be reluctant to give you their TIN:

This subsection provides guidance for all IRS employees, in business operating divisions, who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE (except employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), TE/GE, TAS and TS. IRM 10.10.3 contains authentication policy only and provides the identity proofing steps involved for each service channel included. obÌåÓýever, for specific details or procedural guidelines, refer back to your original IRM.

Use the following identity proofing process to verify the requestor¡¯s identity for required IMF authentication probes. Obtain and validate the correctness of:

If applicable, refer to IRM 21.1.3.2.6, Accepting Transferred Calls When the Taxpayer Provides a 4-Digit Transfer PIN.

For first time filers, if the return is not completely processed or rejected, there could be limited entity information. Continue performing required IMF authentication probes in (2) above and verify, if available:

For required BMF authentication probes, request the following information:

After satisfactory authentication, provide the information requested. Once authentication is complete for a BMF sole proprietor inquiry, it is not necessary to re-authenticate if the caller has an IMF inquiry and the IMF entity data indicates the same name and address.

Abbreviated authentication - only used after establishing the third-party authorization is valid for the account. You must validate the POA/TIA by verifying the caller¡¯s TIN (SSN or ITIN) and DOB. The POA/TIA must pass abbreviated authentication on their SSN to be validated as an authorized third-party. Refer to IRM 21.1.3.3, Third-Party (POA/TIA/F706) Authentication, for two exceptions to this policy.

The following identity proofing process will be followed when employees are conducting additional taxpayer authentication. If conditions require additional taxpayer authentication, the use of the IAT Disclosure Tool is mandated (recommended for ACS and TAS employees). If the tool is down, then manual authentication is required. Refer to IRM 21.2.2-2 , Accounts Management Mandated IAT Tools.

After required authentication is completed, the IAT Disclosure Tool will allow you to choose any tax year. When possible, select the most recent year available to attempt additional high risk authentication, or the most appropriate year depending on any specific account conditions or available tax documents. You can also select from a list of previous years, including a tax year where there is no processed return. If there is enough data present on the year selected, the tool will provide a series of ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô random questions from ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô different data sources. In addition, the IAT TPP HRA Tool is mandated for the Taxpayer Protection Line. Refer to the SERP Job Aid for High Risk IMF Disclosure.

If there is not enough data present in the year selected, the tool will provide an option to choose a different year. If there is not enough data from the ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô most current filings, use the tool¡¯s manual authentication process. It will provide a drop-down menu of the available sources listed above and then you can choose a source to manually research, choosing questions that would not be easily guessed or discovered. Checking ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô ¡Ô data sources is preferred but not required on manual research if the account data is limited. Some BMF entity types will have limited data and can be passed with at least two correct responses from one data source.

For both IMF and BMF, the tool will provide a pass/fail response once you have asked all the questions presented and marked the appropriate response. The tool will provide the appropriate error message if any of the questions are not answered. Once verified, assist the caller following normal IRM procedures. Use AMS issue/narrative to leave a brief note recording any failed disclosure.

There will be other situations when some manual research may be necessary. Calls on married filing joint accounts from the secondary SSN could require some manual research since data pulled from the primary on some command codes are unique to that SSN (for example, city of birth).

For calls where the taxpayer has an ITIN, you can attempt to use the enhanced HRA tool to generate questions and validate the caller. Some questions generated on the tool will require access to the ITIN RTS to validate the response.

For some dependent questions pulled by the tool, there could be multiple responses in the answer portion such as the SSN and DOB field. Consider the question a pass if the caller provides one correct SSN or DOB from those provided.

There will be times when systemic issues cause problems with the tool¡¯s ability to produce the needed data to authenticate due to temporary command code outages or an IDRS issue. Manual research is required for both IMF and BMF accounts when the tool is unable to produce the necessary information to validate the caller. Use the data available from the account or return to attempt to validate at least two additional items from multiple data sources when possible.

When considering what probes to ask on IMF or BMF, determine which probes would most likely be known only by an authorized party. Try to eliminate those that could be easily discovered or guessed.

This subsection of the IRM provides guidance and procedures for all IRS employees in business operating divisions who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE (with the exception of employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), TE/GE, TAS and TS.

Request and verify the following identity proofing information when authenticating the oral disclosure consent designee.

This subsection of the IRM provides guidance and procedures for all IRS employees in business operating divisions who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE (except employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), TE/GE, TAS and TS.

To authenticate the caller as a third-party designee, research CC TXMOD (IMF and BMF), CC IMFOL, CC BMFOL, CC RTVUE, CC BRTVU, CC TRDBV or CC ERINVC and follow the identity proofing procedure below by obtaining:

Validate the identification number provided by the third-party designee with the posted data using the following identity proofing procedure below:

BMF taxpayers may designate a third-party designee on any BMF return. All BMF returns contain either a third-party designee section or a paid preparer designee check box. To authenticate the caller as the third-party designee, research IDRS for the presence of the check box field (follow the procedures in (1) above). The following information is entered in the third-party designee section:

This subsection of the IRM provides guidance and procedures for all IRS employees in business operating divisions who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE (with the exception of employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), TE/GE, TAS and TS.

The following identity proofing process will be used when the IRS is obtaining a taxpayer¡¯s non-written consent to disclose:

This subsection of the IRM provides guidance and procedures for AM assistors. Taxpayers must verify their identity to use the Interactive Voice Response (IVR) to obtain Transcript Delivery System (TDS) tax returns and tax account transcripts. Taxpayers are prompted to enter or speak their:

The following identity proofing process will be used when the caller needs to authenticate an entity or taxpayer in order to ensure that both parties are talking about the same entity and to avoid the unauthorized disclosure of information protected under IRC 6103. These calls are received in TE/GE Customer Account Services (CAS).

Identify the caller¡¯s issue and provide the information IF they are entitled under IRC 6103. If the caller does not provide enough information to determine the next steps, ask probing questions to determine whether the caller has a general question (one that can be answered without specific entity/plan sponsor/information) or whether the question is about a specific organization/plan. Do not treat a question relating to a specific organization/plan sponsor/plan as a need to authenticate the caller. Information open to public disclosure under IRC 6104 may be provided.

If the caller is unable to provide all of the identifying information such as the city and/or state when the full address is not known, attempt to secure as many details as possible. If you are able to locate information open to public disclosure under IRC 6104, advise the caller that the information being provided is based on our available records.

There are limitations to the research you can perform when the caller cannot provide enough information:

NEVER offer sensitive information such as the name of the organization/plan sponsor/plan, c/o person name, current address, or other account-specific information to a caller when attempting to identify the entity or to confirm authorization. Instead, ask the caller to provide the information and then compare the response to the information on record. Offering information that is present on the Master File or EDS/TEDS record could compromise your ability to verify that the party is authorized, if necessary, and could result in an unauthorized disclosure.

Once you have identified the organization/plan sponsor/plan, you must determine whether the information requested by the caller is open to inspection under IRC 6104 or is protected under IRC 6103 and open only to authorized individuals. Unless the information being requested is open to the general public under IRC 6104 or is available through IRS publications or on IRS web pages, you must verify that the customer is an authorized party. This applies to all verbal and written disclosures.

If the information requested by the caller is protected under IRC 6103, you must determine the caller¡¯s relationship to the organization/plan sponsor/plan in question. If the caller did not include that information with the opening or subsequent statements.

If the caller is an officer, employee, or other designated person within the organization/plan sponsor, and is not an outside third party, verbal confirmation that the caller is authorized to act on behalf of the organization/plan sponsor/plan is sufficient verification for an exempt organization and employee plan disclosures once the caller¡¯s position within the organization/plan sponsor is established (and the correct organization/plan has been identified).

If the caller being screened for authorization cannot provide the entity¡¯s exact name, correct address of record, or the caller's position with the organization/plan sponsor does not clearly identify the caller as an officer (but the caller correctly responds to the other disclosure prompts), additional probing is necessary to help establish that the party is authorized. Ask the caller at least two organization-specific questions about any information found on the master file record (such as specific return information or EO information), or information found on EDS/TEDS, for example:

If the caller is unauthorized, apologize and explain that disclosure laws prevent you from being able to respond to the question and provide general guidance or information open under IRC 6104 to the extent that is possible. Tell the caller that an officer legally authorized to act on behalf of the entity can call anytime for the requested information.

Before an outside third party (accountant, bookkeeper, attorney) can be considered as authorized to receive information protected under IRC 6103, disclosure rules require:

This subsection provides guidance for CSRs and customer service specialists (CSSs) in responding to telephone inquiries from TE/GE customers. The following identity proofing process will be used when the caller wants to know the status of a pending (open) EP determination/application request:

This subsection provides guidance for AM CSR and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The subsection of the IRM is intended for CAS issues involving BMF tax returns.

Once the relationship with the entity is established, ask the caller for the EIN. If the caller cannot provide the EIN, you must authenticate the caller's personal identity before researching for the EIN. The following identity proofing process will be used to authenticate the caller¡¯s identity:

When the relationship with the entity is established per (2) above, or the caller has provided the EIN, research for and/or verify the EIN using the correct command codes by obtaining the following information:

This subsection provides guidance for AM CSR and Non-Master-file tax examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The subsection of the IRM is intended for CAS issues involving BMF tax returns.

The following table includes the identity proofing process to use when authenticating a taxpayer or a POA/TIA calling the IRS regarding issues applying for their domestic or U.S. territory EIN online.

This subsection provides guidance for AM CSR and Non-Master-file TEs who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. This subsection IRM is intended for CAS issues involving BMF tax returns.

Once the relationship with the entity is established and the caller is requesting to receive the EIN verbally, use the following identity proofing process to authenticate the caller¡¯s identity. Ask the caller for their:

Using the information provided by the caller, authenticate them using CC INOLES.

If the caller fails to provide the correct address of record but correctly responds to all of the other items (Name, SSN/ITIN and DOB), request the address as it appears on the last tax return or as modified by IRS.

If the caller fails the DOB probe but correctly responds to all other items above (name, SSN/ITIN, and address), advise them to contact SSA at 800-772-1213 or www.ssa.gov to correct the error. If you are confident the caller is who they say they are, continue with the call.

When the relationship with the entity has been established and the caller has been authenticated, using the IAT EIN Assignment tool research the following information to determine if an EIN has been assigned:

Request the taxpayer provide their TIN in writing or verbally. For Field Assistance, see IRM 21.3.4.3.6, Numeric Keypads.

For all individual in-person contacts, obtain a valid, unexpired, government issued photo identification (ID) to verify the identity of the taxpayer, if not already provided. Verify the photo ID matches the individual and their name, address and DOB on IRS records. If ID does not have the correct address of record, but all other items are verified, (IMF ¨C name, TIN and date of birth), ask the taxpayer to verify the address on the last tax return filed.

If you are unable to verify with a photo ID or the taxpayer does not have a valid photo ID, proceed with additional taxpayer authentication in IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication.

This subsection of the IRM provides guidance for all IRS employees and IRS authorized volunteers that meet with taxpayers and/or their representatives using a remote in-person channel (IRS approved video conferencing).

Ask the taxpayer to position in front of the camera:

If the taxpayer does not have a card with their TIN, request the number be provided verbally or have the taxpayer write down the number and position in front of the camera.

Verify the photo ID matches the individual. Make sure their name, address and DOB on the ID matches IRS records. If the ID does not have the correct address of record, but all other items are verified, (IMF ¨C name, TIN and date of birth), ask the taxpayer to verify the address on the last tax return filed. If the taxpayer fails to provide the correct address of record, request additional taxpayer authentication per IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication.

If the taxpayer does not have a photo ID, proceed with the required taxpayer authentication in IRM 10.10.3.3.6, Identity Proofing for Required Taxpayer Authentication, and IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication.

For third-party authentication, refer to IRM 21.1.3.3, Third-Party (POA, TIA, F706) Authentication.

This subsection provides guidance for IRS employees in Austin Submission Processing Campus ITIN Operations, AM CSRs, and FA.

The following identity proofing process is used to identify the specific application in question and compare the information provided to the information on RTS:

If unable to verify the required fields, verify two or more additional entries from the application (for example, middle name, country issuing documentation, date of entry, or college name/city).

You must confirm the relationship of the customer to the applicant. The signature area of the W-7 Application View screen captures the name of the person signing Form W-7 as well as their relationship to the applicant. The following signature relationships are available on the RTS:

Use the following table to determine appropriate disclosure actions:

The application may have been submitted by an acceptance agent. If the customer is the acceptance agent, verify their name and EIN by comparing the information that is on RTS to the information provided.

This subsection provides guidance for all FA employees and managers in TACs and for virtual Volunteer Income Tax Assistance/Tax Counseling for the Elderly (VITA/TCE) locations. The following identity proofing process will be used when taxpayers are providing their TIN. When requesting a TIN, ask the taxpayer to:

This subsection provides guidance for CSRs and CSSs in responding to telephone inquiries from TE/GE customers.

The following identity proofing process will be used when taxpayers are providing personal identification to a TAC employee in response to a denial of an e-file application per

This subsection provides guidance for all Stakeholder Partnerships, Education and Communication (SPEC) employees and managers. The following identity proofing process will be used as part of the virtual VITA/TCE process when a taxpayer presents photo identification at the intake site. If the taxpayer(s) must return to the site, the taxpayer(s) must again supply photo identification when they return to review, sign, and pick up a copy of their return.

This subsection provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used when a taxpayer presents identification to a volunteer to prepare the tax return.

The second form of identification needed is the original or a copy of the ITIN card or letter.

One or both forms of identification must contain the taxpayer¡¯s current mailing address. If the taxpayer cannot prove their identity, or if the volunteer is uncomfortable accepting items presented as proof of identity, the volunteer must refer the taxpayer to obtain/seek professional tax help.

This subsection provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used when the taxpayer, visiting VITA and TCE sites, presents identification to the coordinator to receive correct return preparation:

This subsection of the IRM provides guidance and procedures for all employees within LB&I, SB/SE (except employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), TE/GE and TS business operating divisions, who work with or have a need to know about systems/files/processes.

The following identity proofing process will be used to ensure that the POA is authorized to represent their client in the OPA application:

This subsection of the IRM provides guidance and procedures for all employees within LB&I, SB/SE (with the exception of employees in SB/SE Campus Examination/AUR Operations and SB/SE Field Examination and SB/SE Field Collection), TE/GE and TS business operating divisions, who work with or have a need to know about systems/files/processes.

The following identity proofing process will be used for BMF taxpayers (or their POAs) to verify their authority to establish an online agreement for the business. A BMF taxpayer or POA must provide:

This subsection of the IRM provides guidance and procedures for Appeals technical employees. The taxpayer needs to provide information to substantiate documentation within 30 days for IMF cases. The following identity proofing process outlines the information needed: