CAF Numbers in "Pending Review" Status

To fulfill their professional obligations, IRS-regulated practitioners – i.e., attorneys, certified public accountants, enrolled agents, enrolled actuaries, and enrolled retirement plan agents [1] – as well as tax return preparers who participate in the Internal Revenue Service's voluntary Annual Filing Season Program, must comply with Circular 230, Regulations Governing Practice before the Internal Revenue Service (31 CFR Subtitle A, Part 10), which is administered and enforced by the IRS's Office of Professional Responsibility (OPR). Only the OPR has authority to suspend or to revoke, through disbarment, a practitioner's eligibility and authority to practice before the IRS.

A prerequisite to representing a taxpayer before the IRS is filing a Form 2848, Power of Attorney and Declaration of Representative, or power of attorney (POA) generated using IRS Tax Pro Account. Validly completed POA authorizations, which specify the tax periods, types of tax, and tax form numbers (as applicable) covered by the authorization are recorded on the IRS's Centralized Authorization File (CAF).[2]

To prevent unauthorized disclosure of taxpayer information, in certain circumstances a practitioner's CAF number may be suspended pending an IRS review into whether the CAF number has been compromised owing to identity theft or other fraud. This article discusses the IRS's procedures relating to suspended CAF numbers, including how an affected practitioner can expedite the resolution of a CAF number review.

What Is a CAF Number and Why Is It Important?

To enhance taxpayer confidentiality and to facilitate interaction between practitioners and IRS personnel, each practitioner is assigned a nine-digit CAF number.[3] CAF numbers, which are different from a tax professional’s preparer tax identification number (PTIN) or their Social Security number (SSN), are used by the IRS to determine and verify the extent of a practitioner’s authority to represent a taxpayer before the IRS and to receive and inspect the taxpayer’s confidential tax information. The IRS also uses CAF numbers to fulfill and keep track of requests for client information (like transcripts) while safeguarding both the client's and the tax professional's personal information. Thus, consistent with the taxpayer privacy provisions of IRC 6103, IRS employees will check the CAF to ensure they are dealing only with someone with actual authority to act on behalf of a taxpayer and to request disclosure of the taxpayer’s return information. The CAF number itself is personally identifiable information (PII) and should, as much as possible, be kept secure.

What Might Cause a CAF Number to Be Placed in “Pending Review” Status?

Given the sensitivity of taxpayer information, the IRS is continually reviewing and strengthening its practices to guard against identity theft and the improper disclosure of taxpayer information. In connection with those efforts to authenticate an individual’s identity and authorization to receive sensitive information, the IRS has long requested personal information, in addition to their CAF number, from practitioners (or anyone accessing tax-related information by means of a Form 8821). The purpose of the authentication process, including the validation of the individual’s SSN, is to protect both taxpayers and the tax professionals who are working on their behalf.

Beyond these basic authentication steps, the IRS has a process for IRS employees to refer authorizations with suspicious characteristics for further review. Under this process, the status of the affected CAF account will be coded to “P” for “Pending” (pending review) indicating that the CAF number is currently under review for potential compromise and may be subject to fraudulent use. To safeguard taxpayer information pending the review, the practitioner to whom the CAF number was assigned will be unable to rely on the CAF or IRS employees to authenticate the practitioner’s authority to act for taxpayers until the review process is complete. For security reasons, IRS customer service representatives assigned to the Practitioner Priority Service (PPS), or other call sites cannot, for example, interact with the practitioner about a represented taxpayer's tax matter. The process is akin to a freeze that a credit card company imposes when their fraud-prevention measures are activated, though for a compromised CAF number, the confidential information of multiple clients as well as the practitioner could be at stake.

What might cause a CAF number to be suspended pending review? First, the suspension may have absolutely nothing to do with anything the practitioner has done. If the practitioner has included their CAF number in a document appropriately shared with a client or other third party and that document (e.g., a copy of a Form 2848 or Form 8821) is exposed because of a physical or digital data breach experienced by the client or third party, the CAF number could be compromised and misused – in particular, by a malicious actor who files a fraudulent authorization form with the IRS to gain access to taxpayer information. In addition, there could be aspects of a practitioner’s tax practice that, while legitimate, might trigger IRS red flags.

The line between actual fraudulent use of a CAF number and its mere appearance can be very thin, as can the line between a compromised number and one that is uncompromised but has anomalous yet innocuous attributes. As a result, “false positives” sometimes occur, with practitioners’ legitimate, uncompromised CAF numbers being suspended pending review.

A practitioner may learn that this has happened to them in different ways. For example, they might contact the IRS to discuss a client's tax matter and be informed that the conversation cannot occur because the practitioner's authority to represent the client cannot be verified. Regrettably, because of privacy concerns, or other restrictions, the IRS employee who is dealing with the practitioner (or the taxpayer) may not be able to share any additional information with them, only exacerbating their confusion.

Once a preliminary determination is made that a practitioner’s (or other tax professional's) CAF number may have been compromised and is placed in review, the practitioner will receive a letter by mail from the IRS, generally from IRS Criminal Investigation (CI), letting them know their CAF is under review.

To help expedite the review process:

• The individuals who receive these letters are asked to verify their identities by sending to the IRS a notarized document with certain informational items included.
• The notarized document should be returned using the email box designated in the letter within 30 days from the date of the letter.
• With the return of the notarized document, verification of client listings occurs, and, if needed, the issuance of a new CAF number.

For those CAF holders whose CAF number is confirmed to be compromised, the IRS will work with the CAF holder to assign them a new CAF number and move their clients to the tax practitioner's new CAF number. Upon concluding that a CAF number is, in fact, compromised, the CAF number status will be recoded to “C” (“Cancelled” / confirmed as compromised). Attempts to access taxpayer data using a CAF number with this status will be unsuccessful.

Protecting confidential taxpayer data is of paramount concern to the IRS. At the same time, the IRS recognizes that suspending a CAF number pending review can have significant effects on a practitioner's ability to provide valuable services to their clients. For these reasons, the IRS is continually working to identify, adopt, and refine procedures to detect, address and prevent actual or possible fraud.

 

Thank you for subscribing to the IRS Newswire, an IRS e-mail service.

If you know someone who might want to subscribe to this mailing list, please forward this message to them so they can subscribe.

This message was distributed automatically from the mailing list IRS Newswire. Please Do Not Reply To This Message.