{"id":8036,"date":"2026-08-24T06:57:00","date_gmt":"2026-08-24T10:57:00","guid":{"rendered":"https:\/\/verito.com\/blog\/?p=8036"},"modified":"2026-08-18T10:23:34","modified_gmt":"2026-08-18T14:23:34","slug":"efin-protection-monitoring-tax-professionals","status":"publish","type":"post","link":"https:\/\/verito.com\/blog\/efin-protection-monitoring-tax-professionals\/","title":{"rendered":"How Do You Protect and Monitor Your EFIN (and What Happens If the IRS Deactivates It)?"},"content":{"rendered":"\n<p><strong>Protect your EFIN with the two habits the IRS lays out: check the count of returns filed under your number in e-Services, a count the IRS updates weekly, and update your e-file application within 30 days of any firm change. If the IRS deactivates the number, e-filed returns reject with Business Rule 905; reactivation runs through the IRS e-help desk.<\/strong><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Key takeaways<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check the return count under your EFIN weekly in your IRS e-Services account. A count higher than your own records means someone else is filing on your number.<\/li>\n\n\n\n<li>Update your e-file application within 30 days of any change to the firm.<\/li>\n\n\n\n<li>A deactivated EFIN shows up as Business Rule 905 rejections; reactivation runs through the IRS e-help desk.<\/li>\n\n\n\n<li>MFA, a password manager, and phishing training protect the credentials your EFIN sits behind.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2 id=\"table-of-contents\">Table of Contents<\/h2><nav><ul><li><a href=\"#what-puts-your-efin-at-risk\">What puts your EFIN at risk?<\/a><\/li><li><a href=\"#what-monitoring-cadence-does-the-irs-expect\">What monitoring cadence does the IRS expect?<\/a><\/li><li><a href=\"#what-happens-if-the-irs-deactivates-your-efin\">What happens if the IRS deactivates your EFIN?<\/a><\/li><li><a href=\"#how-do-you-harden-the-credentials-around-your-efin\">How do you harden the credentials around your EFIN?<\/a><\/li><li><a href=\"#sources\">Sources<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-puts-your-efin-at-risk\">What puts your EFIN at risk?<\/h2>\n\n\n\n<p><strong>Two things threaten an EFIN: theft and misuse. Criminals phish preparers for e-Services logins and EFIN paperwork, then file fraudulent returns under the stolen number. The IRS warned about fake EFIN verification requests in Tax Tip 2025-57, and a misused number can be deactivated while you are still mid-season.<\/strong><\/p>\n\n\n\n<p>Your EFIN is the number your entire e-file operation rides on. Every return you transmit carries it, which is exactly why criminals want it: returns filed under a legitimate preparer&#8217;s EFIN look legitimate to the system receiving them.<\/p>\n\n\n\n<p>The theft usually starts in your inbox. In <a href=\"https:\/\/www.irs.gov\/newsroom\/tax-pros-efin-scams-dont-sleep\" target=\"_blank\" rel=\"nofollow noopener\">Tax Tip 2025-57<\/a>, the IRS warns tax pros that EFIN scams don&#8217;t sleep. The usual shape is a <a href=\"https:\/\/verito.com\/blog\/defending-cpa-firms-from-phishing-attacks\/\" target=\"_blank\" rel=\"dofollow\">phishing email<\/a> dressed up as the IRS or your tax software vendor, asking you to &#8220;verify&#8221; your EFIN by sending documents or login details. Reply, and the scammer has what they need to file under your number or hijack your e-Services account.<\/p>\n\n\n\n<p>Misuse surfaces quietly. Fraudulent returns filed under your EFIN don&#8217;t announce themselves; they show up as a return count at the IRS that&#8217;s higher than the count in your software. That gap is the earliest warning you&#8217;ll get, and it&#8217;s only visible if you look.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-monitoring-cadence-does-the-irs-expect\">What monitoring cadence does the IRS expect?<\/h2>\n\n\n\n<p><strong>The IRS gives EFIN holders two standing tasks: monitor the number of returns filed under your EFIN through your e-Services account, a count the IRS updates weekly, and update your e-file application within 30 days whenever the firm&#8217;s address, phone, or responsible officials change. Both take minutes, and both are spelled out on the IRS EFIN maintenance page.<\/strong><\/p>\n\n\n\n<p>The weekly check is the habit worth building first. The IRS updates the return count weekly and tells preparers to check it routinely, especially during filing season, so a weekly check keeps pace with the data. The steps come from the IRS <a href=\"https:\/\/www.irs.gov\/tax-professionals\/how-to-maintain-monitor-and-protect-your-efin\" target=\"_blank\" rel=\"nofollow noopener\">maintain, monitor and protect your EFIN page<\/a>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Log in to your IRS e-Services account.<\/li>\n\n\n\n<li>Open your e-file application and find the EFIN status page, which shows how many returns the IRS has received under your number.<\/li>\n\n\n\n<li>Compare that count to the transmission log in your tax software.<\/li>\n\n\n\n<li>If the IRS count is higher than yours, call the IRS e-help desk the same day. Someone else is filing under your number.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-1024x576.jpg\" alt=\"Weekly EFIN return count comparison cinematic visual | Verito\" class=\"wp-image-8048\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-monitoring.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The 30-day rule is the other half. Your e-file application isn&#8217;t a form you filed once in 2014; the IRS expects it to stay current. A new office address, a new phone number, a partner who joined or left as a responsible official: each change belongs on the application within 30 days.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>Standing task<\/strong><\/th><th><strong>Cadence<\/strong><\/th><th><strong>Where it happens<\/strong><\/th><\/tr><\/thead><tbody><tr><td>Check the return count filed under your EFIN<\/td><td>Weekly<\/td><td>IRS e-Services, e-file application<\/td><\/tr><tr><td>Compare the IRS count to your software&#8217;s transmission log<\/td><td>Weekly, same sitting<\/td><td>Your tax software<\/td><\/tr><tr><td>Update the e-file application after firm changes (address, phone, responsible officials)<\/td><td>Within 30 days of the change<\/td><td>IRS e-Services<\/td><\/tr><tr><td>Report a count mismatch<\/td><td>The same day you find it<\/td><td>IRS e-help desk<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Ten minutes on a Monday covers the whole table. During filing season, when the count moves fastest, the check matters most.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-happens-if-the-irs-deactivates-your-efin\">What happens if the IRS deactivates your EFIN?<\/h2>\n\n\n\n<p><strong>E-filed returns stop going through and reject with Business Rule 905, formally reject code R0000-905-01, which means the IRS no longer shows your EFIN as active. Reactivation runs through the IRS e-help desk, and preparers report long hold times, so start the call early in the day with your e-file application summary in front of you.<\/strong><\/p>\n\n\n\n<p>The panic moment is real. An r\/taxpros thread titled <a href=\"https:\/\/www.reddit.com\/r\/taxpros\/comments\/1trihea\/efin_randomly_set_to_inactive\/\" target=\"_blank\" rel=\"nofollow noopener\">&#8220;EFIN randomly set to inactive&#8221;<\/a> drew 23 votes and 13 comments from preparers comparing notes, with the poster four hours into an IRS hold while clients&#8217; returns bounced. That&#8217;s a practitioner community report, not IRS guidance, but it captures what the moment feels like from the preparer&#8217;s chair.<\/p>\n\n\n\n<p>The recovery path is administrative, not existential:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Confirm the status yourself in e-Services.<\/strong> One rejected return could be a transmission hiccup. A string of Business Rule 905 rejections plus an &#8220;inactive&#8221; status in your e-file application is a deactivated EFIN.<\/li>\n\n\n\n<li><strong>Call the IRS e-help desk and ask what triggered it.<\/strong> Common answers involve the application itself: information the IRS couldn&#8217;t reconcile, a responsible official who no longer checks out, suitability questions. You can&#8217;t fix what you can&#8217;t name, so get the reason on record.<\/li>\n\n\n\n<li><strong>Bring the application current.<\/strong> If the trigger was stale information, the 30-day update rule you skipped is now the reactivation checklist. Correct the application and ask the e-help desk what happens next and on what timeline.<\/li>\n\n\n\n<li><strong>Write the incident down.<\/strong> Your <a class=\"wpil_keyword_link\" href=\"http:\/\/verito.com\/written-information-security-plan\" target=\"_blank\" rel=\"dofollow noopener\" title=\"WISP\" data-wpil-keyword-link=\"linked\" data-wpil-monitor-id=\"1375\">WISP<\/a> should record what triggered the deactivation, when you caught it, and when it resolved. <a href=\"https:\/\/verito.com\/blog\/irs-publication-4557-explained\/\" target=\"_blank\" rel=\"dofollow\">IRS Publication 4557<\/a> expects safeguarding to be documented, and an EFIN incident is exactly the kind of event that documentation exists for.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-1024x576.jpg\" alt=\"Paused e filing after EFIN deactivation cinematic visual | Verito\" class=\"wp-image-8049\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/08\/efin-protection-monitoring-tax-professionals-reactivation.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>A firm running the weekly check usually learns about a problem from its own e-Services login. A firm that doesn&#8217;t learns about it from a client whose return just bounced in the second week of April.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-you-harden-the-credentials-around-your-efin\">How do you harden the credentials around your EFIN?<\/h2>\n\n\n\n<p><strong>EFIN protection is credential protection. The number sits behind your e-Services login, your tax software, and your email, so MFA on each of those, a password manager, and staff who can spot a fake verification request do more for it than anything else. VeritGuard covers those controls per device, from $79 per device per month.<\/strong><\/p>\n\n\n\n<p>The <a href=\"https:\/\/verito.com\/blog\/cybersecurity-for-accounting-firms-guide\/\" target=\"_blank\" rel=\"dofollow\">habits that keep the number yours<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>MFA on everything the EFIN touches:<\/strong> your e-Services account, your tax software, and the firm email where a phished login starts.<\/li>\n\n\n\n<li><strong>Unique passwords in a password manager.<\/strong> The e-Services login never lives in a text thread, a shared spreadsheet, or a sticky note.<\/li>\n\n\n\n<li><strong>Least access.<\/strong> The people named on the e-file application need e-Services access; nobody else does.<\/li>\n\n\n\n<li><strong>Train for the specific scam.<\/strong> Nobody legitimate asks you to email EFIN documents. When a &#8220;software vendor&#8221; requests verification, staff go to the vendor&#8217;s portal directly instead of replying, the pattern the IRS flagged in Tax Tip 2025-57.<\/li>\n\n\n\n<li><strong>Put the EFIN in your <\/strong><a href=\"https:\/\/verito.com\/blog\/what-is-a-wisp\/\" target=\"_blank\" rel=\"dofollow\"><strong>WISP<\/strong><\/a><strong>:<\/strong> where the number is used, who can access it, and how you&#8217;d respond if it were misused, per IRS Publication 4557.<\/li>\n<\/ul>\n\n\n\n<p>One honest boundary: no vendor can run the weekly count check for you. It sits behind your e-Services login, and it should. What a managed IT layer like <a href=\"https:\/\/verito.com\/blog\/managed-it-for-accounting-firms-what-veritguard-covers\/\" target=\"_blank\" rel=\"dofollow\">VeritGuard<\/a> can do is keep the credentials around the number from being the weak spot, mapped out below.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>The weak spot<\/strong><\/th><th><strong>Doing it yourself<\/strong><\/th><th><strong>Covered in VeritGuard<\/strong><\/th><\/tr><\/thead><tbody><tr><td>A phishing email posing as your software vendor<\/td><td>Run staff training yourself, keep it current<\/td><td>Security training plus email anti-phishing on Pro and Elite (from $149\/device\/mo)<\/td><\/tr><tr><td>Reused or shared passwords<\/td><td>Pick a password manager, then police it<\/td><td>1Password Enterprise on Pro and Elite<\/td><\/tr><tr><td>Malware on the machine that logs in to e-Services<\/td><td>Consumer antivirus and hope<\/td><td>Antivirus with EDR on every tier, from $79\/device\/mo<\/td><\/tr><tr><td>Stolen firm credentials circulating after a third-party breach<\/td><td>No practical solo option<\/td><td>Dark web monitoring and 24\/7 SOC coverage on Elite ($199\/device\/mo)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><a href=\"https:\/\/verito.com\/managed-it\/pricing\" target=\"_blank\" rel=\"dofollow\">VeritGuard is priced per device<\/a>, at $79, $149, or $199 per device per month, with a 30-minute security assessment before you sign anything and a 1-2 week white-glove onboarding after. Pro and Elite also include the full VeritShield WISP, the same $999-per-year document sold standalone, revised without limit as your firm changes. And when a login looks wrong at 9 p.m. in February, a real person picks up in under 60 seconds. That mix is why 1,000+ tax and accounting firms run on Verito, rated 4.9\/5 across 170+ G2 reviews.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<figure class=\"wp-block-pullquote\"><blockquote><p><em>&#8220;Verito was thorough in the analysis of the problem. The team took a deep dive into my system before recommending a plan. They understood my process before preparing a security plan. The cloud hosting was secure and allowed me to host the server to our users and improve security.&#8221;<\/em><\/p><cite>Jeffrey J., Owner \u00b7 G2, Aug 2025<\/cite><\/blockquote><\/figure>\n<\/blockquote>\n\n\n\n<p>Check the count on Monday, keep the application current, and lock down the logins around the number. If the IRS ever does deactivate your EFIN, you&#8217;ll find out from your own weekly check, not from a client&#8217;s rejected return.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.irs.gov\/tax-professionals\/how-to-maintain-monitor-and-protect-your-efin\" target=\"_blank\" rel=\"nofollow noopener\">IRS: How to maintain, monitor and protect your EFIN<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.irs.gov\/newsroom\/tax-pros-efin-scams-dont-sleep\" target=\"_blank\" rel=\"nofollow noopener\">IRS Tax Tip 2025-57: Tax pros, EFIN scams don&#8217;t sleep<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.reddit.com\/r\/taxpros\/comments\/1trihea\/efin_randomly_set_to_inactive\/\" target=\"_blank\" rel=\"nofollow noopener\">r\/taxpros: &#8220;EFIN randomly set to inactive&#8221; (practitioner community report)<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"Protect your EFIN with the two habits the IRS lays out: check the count of returns filed under&hellip;\n","protected":false},"author":12,"featured_media":8047,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-8036","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-knowledge-base"},"acf":[],"_links":{"self":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/comments?post=8036"}],"version-history":[{"count":4,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8036\/revisions"}],"predecessor-version":[{"id":8106,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8036\/revisions\/8106"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media\/8047"}],"wp:attachment":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media?parent=8036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/categories?post=8036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/tags?post=8036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}