Xiga xigaHagaha xiga
AI ee diyaariyayaasha cashuuraha
Codsiyada
HAGAHA Bulshada
Ilaalinta Xogta Cashuuraha iyo AI
Tax preparer data security is the set of legal duties and practical safeguards that protect client tax information.
Dhageyso hagahanAI-waa laga sheekeeyay · ~3 min
Boggaan4 daqiiqo akhri
Dulmar
In the US it includes a written information security plan (WISP) required under the FTC Safeguards Rule, and it now has to cover AI tools and AI-driven phishing. It matters because tax offices hold Social Security numbers, bank details and income records that criminals use for identity theft and fraudulent refunds, and generative AI makes the scams aimed at them more convincing.
quusid qoto dheer
The Gramm-Leach-Bliley Act treats paid tax preparers as financial institutions. Under it, the Federal Trade Commission's Safeguards Rule requires them to keep a written information security program. The FTC's amended rule, which took full effect in June 2023, spells out the elements. Firms must designate a qualified individual to oversee the program, conduct a written risk assessment, control access, encrypt customer data in transit and at rest, use multifactor authentication, train staff, oversee service providers, keep an incident response plan and have the qualified individual report on the program. A later amendment requires firms to notify the FTC of certain breaches involving unencrypted information of at least 500 consumers. The IRS supports this through Publication 4557, Safeguarding Taxpayer Data, and Publication 5708, a WISP template developed with the Security Summit partnership. Preparers are also reminded of the requirement when they obtain or renew a PTIN. AI brings two kinds of issue. The first is threats. Language models help criminals write fluent, personalized phishing emails, including the long-running new-client scam and fake IRS or software-vendor messages. Voice cloning makes impersonation calls more believable. The old tell of poor grammar is no longer reliable. The second is the firm's own use of AI. Pasting client returns into a consumer chatbot can put taxpayer data under terms the firm has not reviewed. Separately, Internal Revenue Code Section 7216 restricts the use and disclosure of tax return information without taxpayer consent. A WISP should list approved AI tools, what data each may process and how vendors are vetted. A common misconception is that small firms are too small to be targeted. Criminals seek out small practices because their defenses are often weaker and their data is just as valuable.
Dhaqangelinta Adduunka-dhabta ah
A two-person tax office uses the Security Summit's WISP template to write its plan. The plan names a qualified individual, lists every system that stores client data and adds a rule against pasting client information into unapproved AI chatbots.
During filing season a preparer receives a polished email from a supposed new client with a link to their tax documents. The link leads to a credential-harvesting page. Because the office requires multifactor authentication, the stolen password alone cannot open the tax software.
A firm evaluating an AI document-intake tool asks the vendor how it encrypts data, whether client data is used to train models, how long data is kept and where it is stored, and records the answers in its vendor file.
A staff member receives a phone call in a voice that sounds like the firm owner, asking her to change a client's direct-deposit account. Office policy requires confirming any such request through a second, known channel, so she hangs up and calls the owner back.
The Future of Tax Preparer Data Security and AI
AI-assisted fraud is likely to keep getting more convincing, so defenses that do not rely on spotting mistakes will matter most: MFA, verification over a separate channel and least-privilege access. Regulators have been tightening expectations over time, and professional bodies keep updating guidance. As more preparers adopt AI for intake and review, vendor contracts and data-handling terms will become a routine part of a WISP rather than an afterthought. The core duty does not change: know where client data goes, limit who can reach it, and be ready to respond when something goes wrong.
Ku dhaqangelinta
Maxay muhiim u tahay
- Khatarta iyo badbaadada. Masiibada iyo waxyeellada maalinlaha ah ee AI waxay labaduba ku xiran yihiin cidda fahmaysa khataraha iyo cidda wax ka qaban karta.
- Go'aamo cad. Aqoonta dadweynaha iyo aqoonta xirfadeed waxay qaabaysaa in siyaasadda badbaadada xooggani ay suurtogal tahay siyaasad ahaan.
- Ka gudub xiisaha. Sharaxaada cad waxay yareeyaan qabsashada buunbuuninta, shaybaarka PR, iyo masraxa anshaxa aan caddayn.
Iska ilaali
- Daawaynta khatarta jirta sida sci-fi halka awoodaha isku-dhisyada.
- jahawareerka badbaadada alaabta dusha sare leh oo la jaanqaadaysa madax-bannaani sare.
- Ka tagista daawadayaasha aan Ingiriisiga ahayn iyo kuwa aan khabiirka ahayn ee leh ilo tayo hooseeya oo keliya.
Tallaabooyinka xiga
- Kala soocida waxyeelada alaabta, si xun u isticmaalka, iyo luminta xakamaynta / khataraha khalkhalgelinta.
- Weydii caddaynta bedeli doonta aragtidaada waqtiyada iyo darnaanta.
- Ka door bida ilaha aasaasiga ah iyo qiimaynta la taaban karo ee sheegashooyinka suuq-geynta.
- Aqoonso hal waddo oo hawleed: xirfad, siyaasad, maalgelin, ama xirfado - kaliya maaha wacyigelin.
Sii wad Sahaminta
Warqad bilaash ah
Hel warbixinta maalinlaha ah ee AI
Saddex sheeko oo la xaqiijiyay oo AI ah maalin kasta oo shaqo ah, oo lagu qoray Ingiriis fudud. Bilaash had iyo jeer, aan xayaysiis lahayn.
Hal iimayl maalin kasta oo shaqo ah. Ka bax hal gujin. Marna ma iibinno ama ma wadaagno ciwaankaaga.
Is tijaabi
Take the Tax Preparer Data Security and AI quiz
Fikrad degdeg ah oo ku saabsan jawaab kasta, iyo shahaado la wadaajin karo oo leh aqoonsi la xaqiijin karo markaad ka gudubto koorso.
Taageer waxbarashada AI bilaashka ah. AI Understanding waa 501(c)(3) aan faa'iido doon ahayn — xayaysiis la'aan, albaab lacag ah ma jiro, had iyo jeer. Samee deeq
Su'aalaha soo noqnoqda
What is Tax Preparer Data Security and AI?
Tax preparer data security is the set of legal duties and practical safeguards that protect client tax information. In the US it includes a written information security plan (WISP) required under the FTC Safeguards Rule, and it now has to cover AI tools and AI-driven phishing. It matters because tax offices hold Social Security numbers, bank details and income records that criminals use for identity theft and fraudulent refunds, and generative AI makes the scams aimed at them more convincing.
Why does the FTC Safeguards Rule apply to paid tax preparers?
The GLBA classifies tax preparers as financial institutions, which brings them under the FTC's Safeguards Rule.
Which IRS publication is the WISP template developed with the Security Summit?
Publication 5708 is the WISP template. Publication 4557 covers safeguarding taxpayer data more broadly.
Why does the guide say poor grammar is no longer a reliable phishing warning sign?
Generative AI removes the clumsy writing that once gave phishing away.
A caller who sounds like the firm owner asks to change a client's direct-deposit account. Which control does the guide recommend?
Out-of-band verification defeats cloned voices and spoofed messages, because the attacker does not control the second channel.
Which Internal Revenue Code section limits using or disclosing tax return information without taxpayer consent?
Section 7216 restricts preparers' use and disclosure of return information, which bears on pasting client data into outside AI tools.
Sii wad waxbarashada
Tilmaamaha la xidhiidha
Tilmaamayaal badan ayaa loo doortay mawduucan