How to Safely Share Tax Records With a Professional

1. Verify the professional and the request

Start with the name of the person handling your work and their firm. Ask who else will see the records, how the firm stores them, and how long it keeps them. If a message introduces a new portal or asks you to resend everything, call the office using a number you found independently.

Paid federal return preparers generally need a Preparer Tax Identification Number (PTIN). The IRS directory lists preparers with certain credentials or qualifications; it does not list every PTIN holder. If you need someone to handle an IRS dispute, confirm their authority to represent you separately.

2. Match the records to the job

Ask before masking an identifier or omitting a page. A full Social Security number can be necessary for filing, and a notice page can contain a deadline or instructions. Keep the original unchanged. If the professional accepts a redacted copy, use a tool that removes the underlying data, then reopen the file and check it before sending.

3. Use a verified way to send the files

1. Client portal: Open it from the firm’s verified site or a link you confirmed directly. Use a unique password and turn on multifactor authentication if available. Check that you’re in the right client folder before uploading.
2. Encrypted transfer: If the firm has no portal, ask what encrypted transfer it supports. If you use an encrypted file with a passphrase, confirm the address and give the passphrase through a separate verified channel, such as a call to the office.
3. In person or by mail: Confirm the recipient and office address. Provide copies unless originals are required. If you mail sensitive records, consider tracking and keep an inventory of the contents.

Keep sensitive forms out of ordinary email attachments, text messages, and links open to anyone who has the URL. A public link can be forwarded even if you send it to only one person.

4. Use the right authorization for IRS access

Sending copies of records does not authorize someone to get information directly from the IRS or speak for you.

• Form 8821: Lets a designated person or organization inspect or receive IRS information for the tax matters and periods you list. It does not grant representation rights.
• Form 2848: Lets an eligible individual represent you before the IRS for the matters and periods covered. That person can also receive information within the authorization’s scope.

For eligible requests, a professional can initiate authorization through Tax Pro Account and you can approve it in your own IRS account. Check the name, tax matters, and years first. If the engagement ends, review whether to revoke the authorization. Removing portal access does not revoke it with the IRS.

If the firm asks for consent to use or disclose your tax information, read it separately from the IRS authorization. Ask what information is covered, who will receive it, and why.

5. Act quickly if a file goes to the wrong place

Disable the link or remove access if you control it. Contact the firm through a verified number, record what was sent and when, and ask whether anyone accessed it. If you know the unintended recipient, request deletion. Treat that request as a step to contain the problem; it cannot undo a download.

If you entered a password on a suspicious page, change it from the real site, change it anywhere you reused it, and review account activity. If bank details were exposed, contact your bank. If Social Security numbers were exposed, see the FTC’s recovery guidance and consider a credit freeze. Review the IRS identity theft guide for tax-specific steps, including when an IP PIN or an identity theft report may apply.

Frequently asked questions

Is it safe to email a W-2?

A W-2 can contain your full Social Security number. Use the firm’s verified portal or agreed encrypted transfer method instead of attaching it to ordinary email.

Is an IRS IP PIN the same as a login code?

No. An IP PIN helps protect the filing of your federal tax return. Give the current IP PIN to your verified preparer when needed to file. Keep your sign-in and account recovery codes private.

Should I put my full SSN in the filename?

No. Use a label such as 2025-W2-Employer-A.pdf. Include identifying information inside the document only as needed for the work.