IRS Cybersecurity Awareness Month (IR-2026-119): Tax-Data Checklist for Small Businesses, Payroll Teams and Families | YCL | YCL CPA

Author: YCL CPA ｜ YCL Tax, Accounting & Advisory

Bottom line in one breath

On October 2, 2026, the IRS issued IR-2026-119 for Cybersecurity Awareness Month (October 2026), urging taxpayers, businesses and tax professionals to make six habits routine: strong unique passwords, multifactor authentication (MFA), software updates, recognizing and reporting scams, encrypting and backing up tax records, and avoiding public Wi-Fi for financial and IRS accounts. For Cary/RTP small businesses, the sharpest warning is about payroll and W-2 schemes and fake invoices: any request to change employee or payment information should be verified through a trusted channel before anyone clicks "save." For families, the practical moves are an Identity Protection PIN (IP PIN), an IRS Online Account with MFA, and knowing how the IRS really contacts you. This is compliance planning for the busy year-end and the 2027 filing season—not a promise that any fraud can be prevented.

Background

IR-2026-119 is the IRS's October reminder issued with the Cybersecurity and Infrastructure Security Agency (CISA) and Security Summit partners. IRS Chief Executive Officer Frank J. Bisignano said criminals "continue to look for new ways to steal taxpayer information and exploit trusted partnerships," and asked taxpayers and tax professionals to make cybersecurity part of their routine year-round. The release notes that scammers use U.S. mail, email, text, social media and phone calls to impersonate the IRS—promising a bigger refund, claiming an account is locked, demanding immediate payment, or sending people to fake websites. It specifically tells businesses, payroll professionals and HR offices to watch for phishing, fake invoices, and W-2 / payroll-related schemes, and it lists IRS tools: IP PIN, Online Account for Individuals, Business Tax Account, Tax Pro Account, and the Written Information Security Plan (WISP) that federal law requires tax and accounting professionals to maintain. This piece is different from our September article on IR-2026-111 (the tax-professional Security Summit summer series): here the focus is the small-business payroll desk and the household.

Old habits vs. IR-2026-119 guidance

1. Passwords: Old habit—one password reused across email, bank, payroll and IRS accounts. Guidance: unique passwords for important accounts; consider a password manager.

2. Login protection: Old habit—password only. Guidance: turn on MFA wherever it is available (email, payroll platform, bank, IRS Online Account / Business Tax Account).

3. Direct-deposit or vendor changes: Old habit—HR or the owner updates bank details because an email "from the employee" or "from the supplier" asked. Guidance: verify any request to change sensitive employee or payment information through a trusted channel (a phone number already on file, in person), not by replying to the message.

4. W-2 and payroll data: Old habit—send a PDF of all W-2s when "the boss" emails for it. Guidance: treat W-2 / payroll data requests as a known scheme; confirm out-of-band and limit who can export employee data.

5. Tax records: Old habit—unencrypted scans of returns, IDs and 1099s sitting in email or a shared folder. Guidance: store securely, encrypt sensitive files, and back up; avoid public Wi-Fi when opening them.

6. "Is this really the IRS?": Old habit—trust caller ID, a logo, or a text link. Guidance: the IRS normally makes first contact by mail, sends email/text only if you opted in, never sends social-media direct messages, and never calls to demand immediate payment, threaten arrest, or tell you a refund is due.

Self-check: does this affect you?

1. If you run a restaurant, nail salon, spa, studio or shop with W-2 staff, your payroll desk can receive "change my direct deposit" emails or texts—do you have a written callback rule?

2. If you pay vendors by ACH or wire, would a "new bank account" invoice from a familiar supplier get paid without a phone check?

3. If you are the S Corp owner who logs into payroll, the bank and the IRS Business Tax Account, is MFA on for each, and does more than one person know the recovery steps?

4. If you are a household in Cary/RTP that has had a data breach notice, an e-file reject, or simply wants an extra lock, have you considered an IP PIN and an IRS Online Account with MFA?

5. If you receive a message about a "locked IRS account" or "refund waiting" with a link, do you know to go to IRS.gov directly and report it at IRS.gov/SubmitATip instead of clicking?

Simplified example (illustration only—not a prediction or promised outcome)

A Cary nail salon (illustrative) runs biweekly payroll for 12 W-2 employees. On Wednesday, October 14, 2026, the manager receives an email that appears to come from technician "Linda" asking to change her direct deposit before the Friday, October 16, 2026 payday. Linda's net pay is about $1,850 per period.

1. Without verification: the bank details are changed by reply email. If the request was fraudulent, two paychecks (about $3,700) could go to a criminal's account before anyone notices—and recovery may be slow or impossible.

2. With an IR-2026-119-style control: the manager calls Linda at the phone number already on file (not the number in the email), learns she sent nothing, keeps the old account, flags the email as phishing, and reports it. A second person approves any bank-detail change in the payroll system, and MFA protects the payroll login.

3. W-2 twist: a week later, an email "from the owner" asks for all 12 W-2s as PDFs. The rule "no W-2 or SSN exports by email request" stops it. Under long-standing IRS W-2 scam guidance, an employer whose W-2 data is actually stolen should alert the IRS (e.g., dataloss@irs.gov) promptly and affected employees may need Form 14039 and an IP PIN.

Real outcomes depend on your systems, bank, payroll provider and facts; this example does not quantify any loss you will or will not have.

Action timeline

1. Now through Saturday, October 31, 2026 (Cybersecurity Awareness Month): turn on MFA for email, payroll, bank and IRS accounts; move to unique passwords / a password manager; turn on automatic updates on phones and laptops.

2. Before Thursday, October 15, 2026 (extension filers): exchange documents with your preparer through a secure portal, not open email; do not file or pay from public Wi-Fi.

3. November 2026: write a one-page payroll & vendor change-control rule (callback to number on file + second approver); review who has access to payroll exports and the Business Tax Account.

4. December 2026–January 2027 (W-2 season): freeze W-2 / SSN requests by email; confirm employee addresses and bank details through the payroll portal. 2026 Forms W-2 are due Monday, February 1, 2027 (January 31, 2027 is a Sunday).

5. January 2027, before you file: households that use an IP PIN should have the current-year IP PIN ready (it changes each year); anyone can request one through the IRS Get an IP PIN tool / Online Account.

6. Anytime: report suspicious IRS-themed mail, email, texts or social messages at IRS.gov/SubmitATip; if an e-file is rejected because your SSN was already used, contact your CPA about Form 14039 and the IRS Identity Theft Central steps.

What YCL can do

1. Payroll change-control review: a short written procedure for direct-deposit, address and vendor-bank changes (callback, second approver, MFA), tailored to restaurants, salons, spas, studios and retail.

2. Year-end W-2 / 1099 process: secure collection of W-9s and employee data, W-2/W-3 and 1099 filing calendars, and a "no data by email" rule for the February 1, 2027 W-2 deadline.

3. IRS account setup guidance: help owners and families set up the IRS Online Account, Business Tax Account, and IP PIN, and understand what they will see there.

4. Identity-theft and notice response: Form 14039, Letter 5071C-type identity verification, and IRS correspondence under Form 2848 / 8821 representation.

5. Secure document exchange: the YCL client portal instead of unencrypted email for returns, IDs and payroll files.

6. Bilingual (EN/ZH) service with CPA Chenchen Liu and Gloria; offices in Cary (RTP) and Shanghai; Free Consultation.

FAQ

Q: What is IR-2026-119?

A: IR-2026-119 is an IRS news release dated October 2, 2026 for Cybersecurity Awareness Month. It encourages taxpayers, businesses and tax professionals to use strong unique passwords, multifactor authentication, software updates, scam awareness, encrypted and backed-up tax records, and secure networks, and it lists IRS tools such as the IP PIN, Online Account, Business Tax Account and Tax Pro Account.

Q: How can a small business tell if a direct-deposit or vendor bank change request is a scam?

A: IR-2026-119 warns businesses, payroll professionals and HR offices about phishing, fake invoices and W-2 or payroll-related schemes, and says requests to change sensitive employee or payment information should be verified through a trusted channel. In practice, call the person at a phone number already on file, never the number or link in the message, and require a second approver before saving bank changes.

Q: Does the IRS ever text or message me on social media?

A: According to IR-2026-119, the IRS normally contacts taxpayers first by mail, sends emails or text messages only when taxpayers opt in, and never sends direct messages through social media. The IRS or private collection agencies may call about account matters, but the IRS will never call to demand immediate payment, threaten arrest or say you are due a refund.

Q: Should my family get an IRS Identity Protection PIN?

A: An IP PIN is a six-digit number that helps prevent someone else from filing a federal return using your SSN or ITIN. Anyone who can verify their identity may request one through the IRS Get an IP PIN tool; a new IP PIN is issued each year, so keep the current one ready before filing in 2027.

Book a consult

YCL Tax, Accounting & Advisory

Web: yclcpa.com ｜ Email: info@yclcpa.com

Phone: 919-802-8376 / 980-202-0666 ｜ WeChat: YCLUSA

U.S. office: 1140 Kildaire Farm Rd. STE 208, Cary, NC 27511

Shanghai office: 2-516, Zhongye Xiangteng Plaza, Lane 31, Jiatong Road, Shanghai

Free Consultation available by appointment.

Disclaimer

This article is general tax and information-security awareness only and is not tax, legal, IT-security or investment advice for any person or business. It is not a promise that any scam, data breach, identity theft, loss, penalty or IRS outcome will be prevented or resolved. Application depends on your facts, systems and current IRS guidance; consult licensed tax and IT-security professionals for advice specific to you.