Protect your EFIN with the two habits the IRS lays out: check the count of returns filed under your number in e-Services, a count the IRS updates weekly, and update your e-file application within 30 days of any firm change. If the IRS deactivates the number, e-filed returns reject with Business Rule 905; reactivation runs through the IRS e-help desk.
Key takeaways
Check the return count under your EFIN weekly in your IRS e-Services account. A count higher than your own records means someone else is filing on your number.
Update your e-file application within 30 days of any change to the firm.
A deactivated EFIN shows up as Business Rule 905 rejections; reactivation runs through the IRS e-help desk.
MFA, a password manager, and phishing training protect the credentials your EFIN sits behind.
Table of Contents
What puts your EFIN at risk?
Two things threaten an EFIN: theft and misuse. Criminals phish preparers for e-Services logins and EFIN paperwork, then file fraudulent returns under the stolen number. The IRS warned about fake EFIN verification requests in Tax Tip 2025-57, and a misused number can be deactivated while you are still mid-season.
Your EFIN is the number your entire e-file operation rides on. Every return you transmit carries it, which is exactly why criminals want it: returns filed under a legitimate preparer’s EFIN look legitimate to the system receiving them.
The theft usually starts in your inbox. In Tax Tip 2025-57, the IRS warns tax pros that EFIN scams don’t sleep. The usual shape is a phishing email dressed up as the IRS or your tax software vendor, asking you to “verify” your EFIN by sending documents or login details. Reply, and the scammer has what they need to file under your number or hijack your e-Services account.
Misuse surfaces quietly. Fraudulent returns filed under your EFIN don’t announce themselves; they show up as a return count at the IRS that’s higher than the count in your software. That gap is the earliest warning you’ll get, and it’s only visible if you look.
What monitoring cadence does the IRS expect?
The IRS gives EFIN holders two standing tasks: monitor the number of returns filed under your EFIN through your e-Services account, a count the IRS updates weekly, and update your e-file application within 30 days whenever the firm’s address, phone, or responsible officials change. Both take minutes, and both are spelled out on the IRS EFIN maintenance page.
The weekly check is the habit worth building first. The IRS updates the return count weekly and tells preparers to check it routinely, especially during filing season, so a weekly check keeps pace with the data. The steps come from the IRS maintain, monitor and protect your EFIN page:
Log in to your IRS e-Services account.
Open your e-file application and find the EFIN status page, which shows how many returns the IRS has received under your number.
Compare that count to the transmission log in your tax software.
If the IRS count is higher than yours, call the IRS e-help desk the same day. Someone else is filing under your number.
The 30-day rule is the other half. Your e-file application isn’t a form you filed once in 2014; the IRS expects it to stay current. A new office address, a new phone number, a partner who joined or left as a responsible official: each change belongs on the application within 30 days.
Standing task
Cadence
Where it happens
Check the return count filed under your EFIN
Weekly
IRS e-Services, e-file application
Compare the IRS count to your software’s transmission log
Weekly, same sitting
Your tax software
Update the e-file application after firm changes (address, phone, responsible officials)
Within 30 days of the change
IRS e-Services
Report a count mismatch
The same day you find it
IRS e-help desk
Ten minutes on a Monday covers the whole table. During filing season, when the count moves fastest, the check matters most.
What happens if the IRS deactivates your EFIN?
E-filed returns stop going through and reject with Business Rule 905, formally reject code R0000-905-01, which means the IRS no longer shows your EFIN as active. Reactivation runs through the IRS e-help desk, and preparers report long hold times, so start the call early in the day with your e-file application summary in front of you.
The panic moment is real. An r/taxpros thread titled “EFIN randomly set to inactive” drew 23 votes and 13 comments from preparers comparing notes, with the poster four hours into an IRS hold while clients’ returns bounced. That’s a practitioner community report, not IRS guidance, but it captures what the moment feels like from the preparer’s chair.
The recovery path is administrative, not existential:
Confirm the status yourself in e-Services. One rejected return could be a transmission hiccup. A string of Business Rule 905 rejections plus an “inactive” status in your e-file application is a deactivated EFIN.
Call the IRS e-help desk and ask what triggered it. Common answers involve the application itself: information the IRS couldn’t reconcile, a responsible official who no longer checks out, suitability questions. You can’t fix what you can’t name, so get the reason on record.
Bring the application current. If the trigger was stale information, the 30-day update rule you skipped is now the reactivation checklist. Correct the application and ask the e-help desk what happens next and on what timeline.
Write the incident down. Your WISP should record what triggered the deactivation, when you caught it, and when it resolved. IRS Publication 4557 expects safeguarding to be documented, and an EFIN incident is exactly the kind of event that documentation exists for.
A firm running the weekly check usually learns about a problem from its own e-Services login. A firm that doesn’t learns about it from a client whose return just bounced in the second week of April.
How do you harden the credentials around your EFIN?
EFIN protection is credential protection. The number sits behind your e-Services login, your tax software, and your email, so MFA on each of those, a password manager, and staff who can spot a fake verification request do more for it than anything else. VeritGuard covers those controls per device, from $79 per device per month.
MFA on everything the EFIN touches: your e-Services account, your tax software, and the firm email where a phished login starts.
Unique passwords in a password manager. The e-Services login never lives in a text thread, a shared spreadsheet, or a sticky note.
Least access. The people named on the e-file application need e-Services access; nobody else does.
Train for the specific scam. Nobody legitimate asks you to email EFIN documents. When a “software vendor” requests verification, staff go to the vendor’s portal directly instead of replying, the pattern the IRS flagged in Tax Tip 2025-57.
Put the EFIN in your WISP: where the number is used, who can access it, and how you’d respond if it were misused, per IRS Publication 4557.
One honest boundary: no vendor can run the weekly count check for you. It sits behind your e-Services login, and it should. What a managed IT layer like VeritGuard can do is keep the credentials around the number from being the weak spot, mapped out below.
The weak spot
Doing it yourself
Covered in VeritGuard
A phishing email posing as your software vendor
Run staff training yourself, keep it current
Security training plus email anti-phishing on Pro and Elite (from $149/device/mo)
Reused or shared passwords
Pick a password manager, then police it
1Password Enterprise on Pro and Elite
Malware on the machine that logs in to e-Services
Consumer antivirus and hope
Antivirus with EDR on every tier, from $79/device/mo
Stolen firm credentials circulating after a third-party breach
No practical solo option
Dark web monitoring and 24/7 SOC coverage on Elite ($199/device/mo)
VeritGuard is priced per device, at $79, $149, or $199 per device per month, with a 30-minute security assessment before you sign anything and a 1-2 week white-glove onboarding after. Pro and Elite also include the full VeritShield WISP, the same $999-per-year document sold standalone, revised without limit as your firm changes. And when a login looks wrong at 9 p.m. in February, a real person picks up in under 60 seconds. That mix is why 1,000+ tax and accounting firms run on Verito, rated 4.9/5 across 170+ G2 reviews.
“Verito was thorough in the analysis of the problem. The team took a deep dive into my system before recommending a plan. They understood my process before preparing a security plan. The cloud hosting was secure and allowed me to host the server to our users and improve security.”
Jeffrey J., Owner · G2, Aug 2025
Check the count on Monday, keep the application current, and lock down the logins around the number. If the IRS ever does deactivate your EFIN, you’ll find out from your own weekly check, not from a client’s rejected return.
Camren Majors is co-founder and Chief Revenue Officer of Verito Technologies, a cloud hosting and managed IT company built exclusively for tax and accounting firms. He is the co-author of Beyond Best Practices: Modernizing the Successful Accounting Firm (2026). His work has been featured in NATP TAXPRO Magazine and he has presented for NATP, NAEA, and NSA.
