Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most effective protection is layered: reach the IRS through IRS.gov, use a password that is unique to your IRS/ID.me account, enable an available multifactor authentication (MFA) method, secure the email address and phone used for recovery, and never disclose a password or one-time security code to a caller, texter or email sender.
If you receive a CP303 notice for an online service you did not access, call the number printed on that notice immediately. If you supplied information to a scammer or believe someone used your account, stop communicating with the scammer, change the password if you can still sign in, follow the IRS identity-theft process and protect any affected financial accounts.
Protect your IRS online account before there is a problem
IRS.gov account access uses ID.me for identity verification and sign-in. The exact authentication choices shown can change with the current ID.me setup, so use the options presented in your own account rather than assuming that a particular method is available.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →1. Start only from the official IRS site
Type IRS.gov into your browser or use a bookmark you created yourself. Then use the site’s normal account sign-in path. Do not use an unexpected email or text link that asks you to “verify,” “unlock” or “confirm” your account. A familiar-looking logo or web address in a message is not proof that the message is genuine.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The IRS’s identity-protection guidance recommends going directly to IRS.gov instead of responding to an unsolicited request. This also prevents a fake sign-in page from capturing your ID.me credentials.
2. Create a password used nowhere else
Use a long, complex password that is unique to the IRS/ID.me account. Do not reuse a password from email, banking, shopping or another government service, and never share the password with another person. A password manager can generate and store a different password for each service; the IRS does not endorse a particular password-manager product.
If you have ever typed the IRS/ID.me password into a suspicious page or disclosed it to someone, change it immediately from the legitimate account site. A new password should not be a minor variation of the old one and should not contain information that is easy to guess, such as a name, address or tax year.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems3. Turn on multifactor authentication
During the current ID.me sign-in flow, enable at least one MFA method that is offered for your account. IRS account-creation guidance lists an authenticator app, face or touch unlock, and text messaging to a cell phone as examples. Availability can depend on the current ID.me configuration and your device.
| Method | What it depends on | Planning question |
|---|---|---|
| Authenticator app | A separate app that generates or approves sign-in codes on a phone or other device | How will you recover access if that device is lost, replaced or reset? |
| Face or touch unlock | A supported device and its biometric-unlock capability | Do you have another recovery method if the device or biometric sensor is unavailable? |
| Text message to a cell phone | Access to the enrolled phone number and its mobile network | Can you still receive messages after changing numbers, travelling or losing the phone? |
| FIDO security key | A separate physical key supported by the current ID.me account options | Does your account support the key, and where will you keep a spare or recovery method? |
These options are not presented as a quantitative security ranking by the IRS sources. Choose a method you can keep available and recover safely. Before buying a FIDO security key, confirm that the current ID.me account options support it and that you understand the recovery process. An IRS FAQ links to ID.me help topics that include FIDO security-key setup, but that does not establish that every key model works with every account configuration: IRS FAQ.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Protect the recovery channels
Secure the email account and phone number associated with ID.me. Anyone who controls those channels may be able to interfere with account recovery. Use a unique email password, MFA on the email account when available, a device screen lock and a carrier account PIN or equivalent protection against unauthorized number changes.
Keep a current, safe recovery method before removing an old phone or resetting a device. Store backup codes, if ID.me provides them, where another person cannot access them. Never send a backup code or one-time sign-in code to someone who contacts you.
5. Keep your devices and software current
Install operating-system, browser and security-software updates promptly. The IRS identity-protection guidance recommends firewalls, anti-spam and antivirus protection, current security patches and changed passwords for internet accounts. Its broader security resources are collected at Taxes Security Together.
Use a screen lock on phones and computers that can reach the account. Avoid signing in on a shared or public computer, and sign out when you finish. If you must use another device, do not save the password in the browser and remove any downloaded tax or identity documents afterward.
6. Treat every credential request as suspicious
The IRS states that it will never ask for your username, password or security code by phone, notice, email or text message. A legitimate employee or notice may direct you to take an action, but you should independently open IRS.gov or use the telephone number printed on an official notice rather than handing over a secret code.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What an IP PIN protects—and what it does not
An identity protection PIN (IP PIN) is a separate IRS tool for tax-return filing. IRS Tax Tip 2024-75, published September 5, 2024, describes it as a voluntary, six-digit number known to the taxpayer and the IRS. It is valid for one year and is entered on a federal return when prompted, or on a paper return as directed.
| Protection | Purpose | Does it replace your account password or MFA? |
|---|---|---|
| IRS/ID.me password and MFA | Controls sign-in to IRS online services | No replacement is needed; these are the account-login controls. |
| IP PIN | Helps verify your identity when filing a federal tax return and helps prevent another person from filing with your identity | No. It is not a password, login code or account lock. |
Requesting an IP PIN can be sensible if you are concerned about tax-related identity theft, but it cannot stop someone who has obtained your IRS/ID.me password from attempting to access the online account. Keep the login password and MFA protections in place. The IRS explanation is available in Tax Tip 2024-75.
How can I tell if an IRS email, text or call is real?
An unexpected email claiming to be from the IRS and asking for personal or financial information is a scam warning sign. Threatening calls, demands for immediate payment, requests for a password or security code, and links to an unfamiliar sign-in page should be treated the same way. The IRS does contact taxpayers in some circumstances, so do not turn the narrower credential rule into a claim that the IRS never contacts anyone.
Red flags that require you to stop
- The message asks for your username, password, one-time code, MFA approval or full financial-account details.
- It uses urgency, threats of arrest, deportation, account closure or immediate penalties to prevent you from checking independently.
- It tells you to click a link, open an attachment or install software before you can discuss the issue.
- The sender demands gift cards, cryptocurrency, wire transfers or payment to a personal account.
- The phone number, domain or reply address does not match the official channel you reached by typing IRS.gov yourself.
What to do with a suspicious message
- Do not click its links, open attachments, reply, call the number in the message or provide information.
- Open a new browser window and type IRS.gov manually if you need to check your account or find official contact information.
- Forward an unexpected IRS scam email to phishing@irs.gov, as the IRS identity-protection guidance instructs.
- If you already interacted with the sender, stop the conversation and follow the recovery steps below. Do not send additional “verification” information to prove that you are the account owner.
More examples and reporting guidance appear in the IRS identity protection tips.
What is a CP303 notice?
CP303 is an IRS notice stating that personal information was used to access an IRS online service. Receiving one does not by itself prove that an unauthorized person succeeded; the key question is whether you performed the access described in the notice.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you did access the service
Compare the notice date and service with your own activity. Keep the notice for your records and continue using a unique password and MFA. Do not call a number supplied in a separate email or text about the notice.
If you did not access the service
Call the telephone number printed on the CP303 notice immediately. That is the specific IRS instruction for an unrecognized access. The IRS says it will disable the online account after verifying your identity. Use the notice itself or an official IRS page to locate instructions; never substitute a number from a suspicious message.
Read the IRS explanation of the notice at Understanding your CP303 notice. The same page states: “The IRS will never ask you for your username, password, or security code via phone, notice, email, or text message.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do if someone accessed my IRS account?
Move quickly, but do not let a suspected scammer direct your next step. The order below limits further exposure while preserving the information the IRS may need.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- End the suspected scam contact. Stop replying, hang up and do not send money or more personal information. Preserve the original emails, texts, caller details and screenshots.
- Use the official account site. Type IRS.gov yourself or use a trusted bookmark. Do not sign in through the link that raised the alarm.
- Change the password if you can still sign in. Set a complex password that is unique to IRS/ID.me. Change the same or reused password anywhere else it was used, starting with your email account.
- Review and strengthen MFA. Keep an available method enabled and remove an authentication method or phone number you no longer control. Make sure you have a safe recovery route before discarding a device.
- Follow the notice or IRS representative’s instructions. If the warning is CP303 and the access was not yours, call the number on that notice immediately so the IRS can verify your identity and disable the account.
- Report identity theft and begin recovery. Follow the IRS Identity theft guide for individuals and the recovery plan at IdentityTheft.gov. The IRS guide covers the steps that apply when someone used your personal information for tax-related fraud.
- Protect money and financial information. If you gave a scammer financial details or money, contact the affected financial institution using a statement or card—not a number supplied by the scammer. Ask what account-security, payment-reversal or fraud-reporting steps apply.
- Consider an IP PIN. If your concern includes someone filing a federal return in your name, an IP PIN can help verify your identity during filing. It does not replace the password and MFA changes above.
IRS guidance for people who were scammed is collected at If you were scammed. Use the path that matches what happened: an exposed password requires account and password changes; a CP303 notice requires the immediate notice-number call; financial exposure requires the bank or provider to be contacted as well.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Choosing an MFA method for your situation
The IRS materials list several methods but do not provide a numerical security ranking. Decide based on availability, dependence on a phone network or separate device, recovery after loss and everyday usability.
| Question | Authenticator app | Biometric unlock | Text message | FIDO security key |
|---|---|---|---|---|
| Requires a phone network? | Not necessarily after setup, depending on the app | No network is needed for the local biometric check, but the account still needs connectivity to sign in | Yes, access to the enrolled mobile service | No phone network for the key itself |
| Requires a separate device? | Usually a phone or tablet | A compatible phone or computer with a biometric sensor | An enrolled cell phone | Yes, the physical key |
| Main recovery concern | Lost, reset or replaced device | Unavailable or damaged device and missing fallback method | Lost phone, changed number or disrupted service | Lost key and no spare or alternate ID.me method |
| IRS/ID.me availability | Depends on the current sign-in options | Depends on the current sign-in options | Depends on the current sign-in options | Confirm compatibility before purchase; not every model is established as compatible |
For any method, the practical failure mode is losing the only way to prove that you are the account owner. Keep the recovery information current and understand ID.me’s present recovery choices before you remove a phone, reset a device or buy a security key.
Common mistakes that leave an IRS account exposed
- Using the same password everywhere: A breach at another service can become an IRS-account takeover attempt.
- Relying on an IP PIN as a login defense: The six-digit, one-year PIN is for return filing, not IRS.gov sign-in.
- Approving an unexpected MFA prompt: A code or approval request you did not initiate can indicate that someone has your password.
- Calling a number from a text or email: Verify through the CP303 notice itself or IRS.gov.
- Assuming a notice is proof of a completed takeover: CP303 requires action when the access was not yours, but the notice alone does not establish that you personally were compromised.
- Buying hardware without checking compatibility: Confirm the current ID.me options and recovery requirements before purchasing a FIDO key.
- Leaving the recovery email unprotected: An attacker who controls that inbox may be able to reset other accounts even after you change the IRS password.
Keep the protection routine current
At least periodically, verify that the password is still unique, the MFA method is available, the recovery phone and email are yours, and your devices receive security updates. Recheck these items after changing a phone number, replacing a computer, losing a device or responding to any suspicious message.
In a September 4, 2026 Security Summit release, IRS Chief Executive Officer Frank J. Bisignano said: “Taxpayers and tax professionals should take advantage of the powerful tools available to help protect against identity theft.” Those tools work best as a set: a unique secret, a second sign-in factor, protected recovery channels, cautious handling of messages and a fast response when an official notice reports unrecognized access.
For the IRS’s broader security recommendations, see Security Summit: Strengthen defenses against tax identity theft.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
