10.10.3. Centralized Authentication Policy – Centralizing Identity Proofing for Authentication Across All IRS Channels

(1) IRS employees must always verify the taxpayer’s identity per IRM 13.1.16.4.1.1, Authorized Disclosures, before discussing any information protected under IRC 6103.

(2) This policy applies to the centralization of the identity proofing and authentication processes in customer contact channels (correspondence, telephone/voice, in-person, remote in-person (video teleconferencing), and online exchanges) where sensitive information is exchanged with individuals.
Non-digital channels: correspondence, telephone, in-person/remote in-person assistance.
Digital channels: online services/applications including website and mobile applications.

(1) Relevant Federal guidelines include:

1. National Institute of Standards and Technology (NIST) Digital Identity Guidelines SP 800-63

2. U.S. Code (USC) 6103 Confidentiality and disclosure of returns and return information

3. Federal Information Security Modernization Act (FISMA)

4. Privacy Act of 1974

5. Office of Management and Budget (OMB) Memoranda M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management

(1) The Director of Identity Assurance (IA), within Privacy Governmental Liaison and Disclosure, (PGLD), is responsible for the identity verification and authentication policy.
The Director of IA reports to the Chief Privacy Officer and is responsible for IA program oversight.
Organization Executives and Management Officials who lead programs described in this policy are responsible for these guidelines and for continuous monitoring of new and ongoing authentication policies related to these channels.
IA's role is to strengthen and implement IRS authentication standards for:

• identity proofing,

• authentication,

• authorization, and

• access strategies, processes, and capabilities.

(1) Business Units are responsible for completing their own review. Management officials bear the responsibility to conduct risk assessments, of factors, procedures, and processes used to authenticate taxpayers, representatives or other third-parties interacting with the IRS. See Form 15295 , Non-Digital Authentication Risk Assessment (NDARA). The Identity Assurance function manages and reviews the Authentication in Digital and Non-Digital Channels Program at least once every two years. For more information regarding NDARAs, please refer to IRM 10.10.2, Authentication Risk Assessments in Non-Digital Channels.
Goals, measures and operating guidelines are listed in each business unit’s yearly Program Letter or other management guidance. Quality data and guidelines for measurement are referenced in IRM 21.10.1, Embedded Quality (EQ) Program for Accounts Management, Campus Compliance, Field Assistance, Tax Exempt/Government Entities, Return Integrity and Compliance Services (RICS), and Electronic Products and Services Support.

(1) The below table lists commonly used terms and definitions relevant to this program that are used throughout this IRM:

(1) The following table lists acronyms and definitions frequently used throughout this IRM section:

(1) Below are the related resources:

• Privacy Act of 1974 (as amended),

• IRC 6103, Confidentiality and Disclosure of Returns and Return Information,

• NIST SP 800-63-A guidelines,

• IRM 10.5.1, Privacy and Information Protection, Privacy Policy,

• IRM 10.5.4, Privacy and Information Protection, Incident Management Program,

• IRM 10.5.5, Privacy and Information Protection, Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance and Requirements, and

• IRM 11.3.1, Disclosure of Official Information, Introduction to Disclosure.

(2) In the event an inadvertent disclosure occurs or an unauthorized access takes place, see the following IRMs for guidance, IRM 10.5.1, Privacy and Information Protection, Privacy Policy, IRM 10.5.4, Privacy and Information Protection, Incident Management Program, IRM 10.5.5, Privacy and Information Protection, Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance and Requirements, and IRM 11.3.1, Disclosure of Official Information, Introduction to Disclosure.
The following table lists the primary sources of guidance:

(1) This subsection of the IRM provides guidance and procedures for IRS employees in Austin Submission Processing Campus ITIN Operations, Accounts Management Customer Service Representatives, and Field Assistance. The following identity proofing process will be used when securing information from the caller to verify the applicant in question and to compare it to the information on the Real Time System (RTS), W-7 Application View screen during the ITIN disclosure process.

• Name – Line 1a

• Name at Birth – Line 1b, if different from Line 1a

• Date of Birth – Line 4

• Country of Birth – Line 4

• Country of Citizenship – Line 6

• Previously Issued ITIN or IRSN – Lines 6e and 6f

• Types of supporting ID submitted

(2) You must also verify the relationship of the caller to the applicant before disclosing any information. The following signature relationships are reflected on RTS:

• Applicant

• Parent

• Court Appointed Guardian

• Power of Attorney

• None

(3) The RTS captures the relationship of the person who signed the Form W-7 as well as the name if other than the applicant. The table below provides additional guidance for signature verification.

(4) If a caller indicates that they are a Certifying Acceptance Agent(CAA), and is inquiring about the status of an application, refer them to their signed CAA agreement and have them call the number listed in the agreement.

(1) This subsection of the IRM provides guidance and procedures for the IRS Acceptance Agent (AA) Program. Use the following table to authenticate a customer and their authority to receive information about an Acceptance Agent application:

(1) This subsection of the IRM provides guidance and procedures for:

• ACS and ACSS employees,

• CSCO employees, and

• FA employees.

(1) This subsection of the IRM provides guidance and procedures for:

• ACS and ACSS employees,

• CSCO employees, and

• FA employees.

• Taxpayer’s Name and TIN,

• Transfer PIN,

• Caller’s Name, and

• Purpose of the call.

(1) This subsection of the IRM provides guidance and procedures for Wage and Investment (W&I) and Small Business/Self Employed (SB/SE) Business Operating Divisions (BODs) handle taxpayer contacts when

1. Providing general tax related information,

2. Providing information on the status of taxpayer returns/refunds/accounts, and

3. Adjusting taxpayer accounts, when proper.

1. Provide the taxpayer with the last four digits of their TIN (Social Security Number/Employer Identification Number).

2. Request that the taxpayer verify the first five digits of their TIN.

3. After verifying the TIN, follow IRM 21.1.3.2.3, Required Taxpayer Authentication and IRM 10.10.3.6, Identity Proofing for Required Taxpayer Authentication.

(1) This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. Use the following identity proofing process to verify the requestor’s identity for Required IMF Authentication Probes. Request and validate the correctness of:

• Taxpayer Identification Number (TIN) – Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) – If the taxpayer is inquiring about a jointly filed return, only one TIN is necessary, preferably the primary number. The secondary TIN may be required if the primary is unavailable, or for use as an additional authentication check. See IRM 3.21.263.8.1, Disclosure Guidelines for ITIN Data, for specific ITIN research and IRM 10.10.3.4.1, Identity Verification for Disclosure Guidelines for ITIN Data.

  Note: In the event the name and TIN provided by the caller at the beginning of the call do not match our records, ask the caller to verify their information. After probing, if the information provided still does not match our records, ask the caller to check their records and call back. Terminate the call.

• Name – as it appears on the tax return (for the tax year(s) in question), including spouse’s name for joint return.

  Caution: Do not confirm or deny any information until authentication is complete. The decision to authenticate is made at the conclusion of all the necessary probes along with additional authentication when needed to help make that determination. If the caller is inquiring about multiple tax periods and MFTs you must be certain that the individual is authorized to receive information on each tax period and MFT.

• Current address – If taxpayer fails to provide the correct address of record, but correctly responds to all of the other items, (IMF – name, TIN and date of birth) you may request additional taxpayer authentication pursuant to IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication.

  Note: If you are unable to verify the address on the Integrated Data Retrieval System (IDRS), request the address as it appears on the last tax return or as modified by IRS records.

• Date of birth (DOB) of primary or secondary taxpayer – If the taxpayer fails the DOB probe, but correctly responds to all other items above (IMF – name, TIN, and address), you may request additional taxpayer authentication pursuant to IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication.

  Note: If there is a discrepancy with the DOB in IRS records on IDRS (CC INOLE) for an SSN but you are confident (i.e., taxpayer has passed authentication requirements) that you are speaking with the taxpayer, advise the taxpayer to contact the Social Security Administration (SSA) at 800-772-1213 or www.ssa.gov to correct the error. For DOB discrepancies on an ITIN, refer to IRM 3.21.263.8, Accounts Management (AM).

  Caution: Filing status was removed as a required probe on December 12, 2011; however, knowledge of the filing status of any year or multiple years in question is vital to understanding if the individual inquiring is entitled to receive information on a given tax year. Take caution on any jointly filed return to ensure the individual is authorized to receive the information on the year or years in question.

  Reminder: See Exhibit 21.2.2-2, Accounts Management Mandated IAT Tools for those employees mandated to use IAT Disclosure Tool.

(2) For first time filers, if the return is not completely processed or rejected, you can verify:

• Amount of refund and filing status on CC FFINQ

• Name Control and DOB on CC INOLES

• Complete Name and DOB on CC DDBKD

(3) For Required BMF Authentication probes, the following information should be requested:

1. Taxpayer Identification Number, Employer Identification Number or Social Security Number.

   Note: If the customer is unable to provide the TIN but correctly responds to the name probe, request additional authentication. See IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication. For example, a previously issued EIN that has not been recently used or an EIN that was recently assigned.

2. Name – as it appears on the account or as shown on CC INOLES. It may be necessary to probe the caller for the correct information using additional authentication information such as Limited Liability Company (LLC) or "Doing Business As" (DBA) for Sole Proprietor/Partnership. A member’s LLC authority is determined by the type of business entity and the member’s authority within that business structure. See IRM 11.3.2.4, Persons Who May Have Access to Returns and Return Information Pursuant to IRC Section 6103(e), for more detailed information on who can have access to types of business entities.

   Caution: Do not confirm or deny any information until authentication is complete. The decision to authenticate is made at the conclusion of all the necessary probes along with additional authentication when needed to help make that determination. If the caller is inquiring about multiple tax periods and MFTs you must be certain that the individual is authorized to receive information on each tax period and MFT.

3. Current address – If taxpayer fails to provide the correct address of record, but correctly responds to all of the other items (e.g., Name and Title) request additional taxpayer authentication pursuant to IRM 10.10.3.3.7, Identity Proofing for Additional Taxpayer Authentication.

   Note: If you are unable to verify the address on IDRS, request the address as it appears on the last tax return or as modified by IRS records.

4. For Form 709(MFT 51) calls, the disclosure probes are TIN, name and address of the return and date of birth of the taxpayer.

5. For Form 706(MFT 52) calls, the disclosure probes are SSN of the estate, name and address on the return and date of death or date of birth of the taxpayer, whichever is applicable.

   Reminder: If available, you may use AMS Privacy and Disclosure screens to access IDRS.

(1) This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. The following identity proofing process will be followed when Accounts Management employees are conducting additional taxpayer authentication. If conditions require for additional taxpayer authentication, the use of the IAT Disclosure Tool is mandated. If the tool is down, then manual authentication is required.

(2) After required authentication is completed, the IAT Disclosure Tool will allow you to choose any tax year. When possible, you should select the most recent year available to attempt additional high-risk authentication, or the most appropriate year depending on any specific account conditions or available tax documents. You may also select from a list of previous years, including a tax year where there is no processed return. If there is enough data present on the year selected, the tool will provide a series of ≡ ≡ or more random questions from at least ≡ different data sources. In addition, the IAT TPP HRA Tool is mandated for the Taxpayer Protection Line.

(3) If there is not enough data present in the year selected, the tool will provide an option to choose a different year. If there is not enough data from the ≡ ≡ ≡ ≡ most current filings, then you may use the tool’s manual authentication process. It will provide a drop-down menu of the available sources listed above and then you can choose a source to manually research, choosing questions that would not be easily guessed or discovered. Checking at least ≡ ≡ data sources is preferred but not required on manual research if the account data is limited. Some BMF entity types will have limited data and can be passed with at least two correct responses from one data source.

(4) For both IMF and BMF, the tool will provide a pass/fail response once you have asked all the questions presented and marked the appropriate response. The tool should provide the appropriate error message if any of the questions are not answered. Once verified, assist the caller following normal IRM procedures. Use AMS issue/narrative to leave a brief note recording any failed disclosure.

(5) There will be other situations when some manual research may be necessary. Calls on married filing joint accounts from the secondary SSN may require some manual research since data pulled from the primary on some command codes are unique to that SSN (e.g., city of birth).

(6) For calls where the taxpayer has an ITIN, you can attempt to use the enhanced HRA tool to generate questions and validate the caller. Some questions generated on the tool will require access to the ITIN RTS to validate the response.

(7) For some dependent questions pulled by the tool, there may be multiple responses in the answer portion such as the SSN and date of birth field. Consider the question a pass if the caller provides one correct SSN or DOB from those provided.

(8) There will be times when systemic issues may cause problems with the tool’s ability to produce the needed data to authenticate due to temporary command code outages or an IDRS issue. Manual research is required for both IMF and BMF accounts when the tool is unable to produce the necessary information to validate the caller. Use the data available from the account or return to attempt to validate at least two additional items from multiple data sources when possible.

(9) When considering what probes to ask on IMF or BMF, determine which probes would most likely be known only by an authorized party. Try to eliminate those that may be easily discovered or guessed.

(1) This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. The following identity proofing process will be followed when authenticating the Oral Disclosure Consent Designee. You will need to know the form and period in question along with the following:

• Taxpayer’s Name

• Taxpayer’s TIN

• Third-party Name

• Third-party Phone Number

(1) This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. To authenticate the caller as a Third-Party Designee, research CC TXMOD (IMF and BMF), CC IMFOL, CC BMFOL, CC RTVUE, CC BRTVU, CC TRDBV or CC ERINVC and follow the identity proofing procedure below by asking for:

• Taxpayer’s Name – as it appears on the tax return for the tax year(s) in question, including spouse’s name for a joint return

• Taxpayer’s TIN

• Tax Period

• Form(s)

• Designee’s PIN or Designee’s PTIN – PTIN option is for BMF only, on any forms that still contain the Third-Party Designee check box in the Paid Preparer Use Only field

  Note: If there is a TC 971 AC 263 on the account, do not use CC TRDBV, CC RTVUE or CC BRTVUE, as it is not updated to reflect revocation.

(2) Validate the identification number provided by the Third-Party Designee with the posted data using the following identity proofing procedure below:

• Self-selected PIN – research using CC TXMOD

• PTIN (for certain applicable BMF forms) – validate the PTIN information provided by the designee with the data on CC TXMOD, CC IMFOLR, CC BMFOLR, CC RTVUE or CC BRTVU to ensure they match.

(3) BMF taxpayers may designate a Third-Party Designee on any BMF return. All BMF returns contain either a Third-Party Designee Section or a Paid Preparer Designee check box. To authenticate the caller as the Third-Party Designee, research IDRS for the presence of the check box field (see IRM 10.10.3.9, Identity Proofing for Third-Party Designee Authentication, follow the procedures above in paragraph 1 in this section. The following information is entered in the Third-Party Designee section:

• Designee Name

• Designee Phone Number

• Any five-digit number the Designee chooses as their Personal Identification Number (PIN).

  Note: The authority granted on a BMF return using the check box option also extends to any amended return filed for the year in question, as long as it is filed within the time period for the consent.

(1) This subsection of the IRM provides guidance and procedures for All IRS employees, in Business Operating Divisions (BODs), who are in contact with taxpayers by telephone, correspondence, or in person. The primary users of this IRM are all employees within LB&I, SB/SE, TE/GE, TAS and W&I. The following identity proofing process will be used when the IRS is obtaining a taxpayer’s non-written consent to disclose:

1. Gather sufficient facts underlying the request or consent to enable the employee to determine the nature and extent of the information or assistance requested and the return or return information to be disclosed.

2. Confirm the identity of the taxpayer and the designee.

3. Confirm the date requested and the nature and extent of the assistance request.

(1) This subsection of the IRM provides guidance and procedures for AM assistors. Taxpayers must verify their identity to use the Interactive Voice Response (IVR) to obtain Transcript Delivery System (TDS) tax return and tax account transcripts. Taxpayers are prompted to enter their:

• Social Security Number (SSN) or Individual Taxpayer Identification number (ITIN).

• Numbers/digits in the street address currently on file.

(1) The following identity proofing process will be used when the caller needs to authenticate an entity or taxpayer in order to ensure that both parties are talking about the same entity and to avoid the unauthorized disclosure of information protected under IRC 6103. These calls are received in Tax Exempt/Government Entities (TEGE) Customer Account Services (CAS). Ask the caller for:

• name,

• address,

• and EIN of the organization/plan sponsor in question.

(2) If the caller is unable to provide all of the identifying information such as the city and/or state when the full address is not known, attempt to secure as many details as possible. If you are able to locate information open to public disclosure under IRC 6104, advise the caller that the information being provided is based on our available records.

(3) There are limitations to the research you can perform when the caller cannot provide enough information:

• If you receive the message, "XXXXX POSSIBLE MATCHES, SUPPLY ADDITIONAL INFO," when you perform your CC NAMEE/NAMEB research, apologize to the caller and explain that we are unable to perform adequate research with the limited information provided. Invite the caller to contact us again if they can provide additional identifying information about the organization.

• If your CC NAMEE/NAMEB research returns more than 15 – 20 pages of data (or if you receive the message, "XXXXX MATCHES – DISPLAY LIMIT EXCEEDED," consult your Lead.

(4) NEVER offer sensitive information such as the name of the organization/plan sponsor/plan, c/o person name, current address, or other account-specific information to a caller when attempting to identify the entity or to confirm authorization. Instead, ask the caller to provide the information and then compare the response to the information on record. Offering information that is present on the Master File or EDS/TEDS record could compromise your ability to verify that the party is authorized, if necessary, and could result in an unauthorized disclosure.

(5) Once you have identified the organization/plan sponsor/plan, you must determine whether the information requested by the caller is open to inspection under IRC 6104 or is protected under IRC 6103 and open only to authorized individuals. Unless the information being requested is open to the general public under IRC 6104 or is available through IRS publications or on IRS Web pages, you must verify that the customer is an authorized party. This applies to all verbal and written disclosures.

(6) If the information requested by the caller is protected under IRC 6103, you must determine the caller’s relationship to the organization/plan sponsor/plan in question. If the caller did not include that information with the opening or subsequent statements (for example, "I am the president of our local PTA and I want to check on the status of our application for exemption").

(7) If the caller is an officer, employee, or other designated person within the organization/plan sponsor, and is not an outside third party, verbal confirmation that the caller is authorized to act on behalf of the organization/plan sponsor/plan is sufficient verification for Exempt Organization and Employee Plan disclosure once the caller’s position within the organization/plan sponsor is established (and the correct organization/plan has been identified).

• If the caller represents a government entity, see IRM 21.3.8.4.4.2, Instrumentality/Governmental Units Disclosure, for additional information.

• If the caller is a plan participant seeking information pertaining to a plan, see IRM 21.3.8.4.1.5.1, Authorization Requirements for Participants in an Employer-Sponsored Plan.

• See IRM 21.3.8.5.1.3.2, Status of Pending (Open) Exempt Organization (EO) Determination/Application Requests, , if the caller is checking on the status of a pending (open) application and does not have the organization's EIN.

Caution: A trustee may be an outside third party who is not authorized without specific authority.

Reminder: Certain issues and categories of callers require additional research:

• See IRM 21.3.8.5.1.3.3, Status of Pending (open) Employee Plans (EP) Determination/Application Requests, if the caller is checking on the status of an EP application.

(8) If the caller being screened for authorization cannot provide the entity’s exact name, correct address of record, or the caller's position with the organization/plan sponsor does not clearly identify the caller as an officer (but the caller correctly responds to the other disclosure prompts), additional probing is necessary to help establish that the party is authorized. Ask the caller at least two organization-specific questions about any information found on the master file record (such as specific return information or EO information), or information found on EDS/TEDS, for example:

• The date the organization's application for recognition of exemption was filed

• The amount of user fee paid with the application for recognition of exemption

• Specific line items from filed returns

(9) If the caller is unauthorized, apologize and explain that disclosure laws prevent you from being able to respond to the question and provide general guidance or information open under IRC 6104 to the extent that is possible. Tell the caller that an officer legally authorized to act on behalf of the entity can call anytime for the requested information.

(10) Before an outside third party (e.g., an accountant, bookkeeper, or attorney) can be considered as authorized to receive information protected under IRC 6103, disclosure rules require:

• Formal execution of authorization (i.e., Form 8821 / Form 2848)

• Oral Consent by an authorized party (for specific account matters) or

• Specification of a Third-Party Designee on the return

(1) This subsections of the IRM provides guidance for Customer Service Representatives (CSRs) and Customer Service Specialists (CSSs) in responding to telephone inquiries from Tax Exempt/Government Entities (TEGE) customers. The following identity proofing process will be used when the caller wants to know the status of a pending (open) EP determination/application request:

1. Obtain the name and address of the plan sponsor and/or the plan, plan number and the EIN (or DLN).

2. Verify disclosure to determine authorization. See IRM 21.3.8.5.1.3.3, Status of Pending (Open) Employee Plans (EP) Determination/Application Requests for more information.

(1) This subsections of the IRM provides guidance for Accounts Management Customer Service Representatives (CSR) and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The subsections of the IRM is intended for Customer Account Services issues involving BMF tax returns. Once the relationship with the entity is established, ask the caller for the EIN. If the caller cannot provide the EIN, you must authenticate the caller's personal identity before researching for the EIN. The following identity proofing process will be used to authenticate the caller’s identity:

1. Complete name

2. Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN)

3. Address

4. Date of Birth (DOB)

(2) When the relationship with the entity is established per paragraph 1, or the caller has provided the EIN, research for and/or verify the EIN using the correct command codes by obtaining the following information:

• EIN - (If known)

• Name of business - If the caller does not include the full name (e.g., LLC, INC, Corp, etc.) probe for more information.

• Address of business - If an address shows a possible typographical error, or is missing the suffix (e.g., STE, AVE, BLVD, etc.) probe for more information.

(1) This subsections of the IRM provides guidance for Accounts Management Customer Service Representatives (CSR) and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The IRM is intended for Customer Account Services issues involving BMF tax returns. The following table includes the identity proofing process to use when authenticating a taxpayer or a POA/TIA calling the IRS regarding issues applying for their domestic or U.S. territory EIN online.

(1) This subsections of the IRM provides guidance for Accounts Management Customer Service Representatives (CSR) and Non-Master-file Tax Examiners (TE) who answer BMF taxpayer inquiries (telephone, correspondence, or in person) and internal account requests. The IRM is intended for Customer Account Services issues involving BMF tax returns. Once the relationship with the entity is established and the caller is requesting to receive the EIN verbally, use the following identity proofing process to authenticate the caller’s identity. Ask the caller for their:

1. Complete name

2. Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN)

3. Address

4. Date of Birth (DOB)

(2) Using the information provided by the caller, authenticate them using CC INOLES.

(3) If the caller fails to provide the correct address of record but correctly responds to all of the other items (Name, SSN/ITIN and date of birth), request the address as it appears on the last tax return or as modified by IRS.

(4) If the caller fails the DOB probe but correctly responds to all other items above, (Name, SSN/ITIN, and address), advise them to contact the Social Security Administration (SSA) at 800-772-1213 or www.ssa.gov to correct the error. If you are confident the caller is who they say they are, continue with the call.

(5) When the relationship with the entity has been established and the caller has been authenticated, using the IAT EIN Assignment tool research the following information to determine if an EIN has been assigned:

1. Name of business

2. Address of business

Exception: Manually input the appropriate research CC’s when the tool is unavailable.

(1) This subsections of the IRM provides guidance for IRS employees in Austin Submission Processing Campus ITIN Operations, Accounts Management Customer Service Representatives, and Field Assistance. The following identity proofing process will be used when securing information from the customer to identify the specific application in question and compare the information provided to the information on RTS:

1. Name – Line 1a

2. Name at Birth – Line 1b, if different from Line 1a

3. Date of Birth – Line 4

4. Country of Birth – Line 4

5. Country of Citizenship – Line 6a

6. Previously issued ITIN or IRSN – Line 6e and Line 6f

7. Type of supporting documentation submitted

(2) If unable to verify the required fields, verify two or more additional entries from the application (for example, middle name, country issuing documentation, date of entry, or college name/city).

(3) You must also confirm the relationship of the customer to the applicant. The signature area of the W-7 Application View screen captures the name of the person signing Form W-7 as well as their relationship to the applicant. The following signature relationships are available on the RTS:

1. Applicant

2. Parent

3. Court Appointed Guardian

4. Power of Attorney

5. None

(4) Use the following table to determine appropriate disclosure actions:

(5) The application may have been submitted by an Acceptance Agent. If the customer is the Acceptance Agent, verify their name and Employer Identification Number (EIN) by comparing the information that is on the RTS to the information provided.

(1) This subsections of the IRM provides guidance for all Field Assistance employees, managers and analysts in TACs located in the United States and Puerto Rico. The following identity proofing process will be used when taxpayers are providing their TIN to TAC employees for VSD:
When requesting a Taxpayer Identification Number (TIN), ask the taxpayer to: hold their social security card or notice to the camera OR place it on the desk and point the camera down instead of speaking the number aloud.

(1) This subsections of the IRM provides guidance for Customer Service Representatives (CSRs) and Customer Service Specialists (CSSs) in responding to telephone inquiries from Tax Exempt/Government Entities (TEGE) customers. The following identity proofing process will be used when taxpayers are providing personal identification to a TAC employee in response to a denial of an e-file application per Letter 5881C E-file Application Program Denial, Letter 5877C E-file Application IDT Sanction - Criminal Expulsion, or outdated Letter 2916:
To verify identity the customer must present two forms of ID:
An unexpired government issued photo ID, such as:

• Driver’s license

• Passport

• State identification card OR

• Certified Birth Certificate

Note: These documents should not go through the document authentication process currently used to authenticate ITIN documents.

(1) This subsections of the IRM provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used as part of the Virtual VITA/TCE process when a taxpayer presents photo identification at the intake site.
If the taxpayer(s) must return to the site, the taxpayer(s) must again supply photo identification when they return to review, sign, and pick up a copy of their return.

(1) This subsections of the IRM provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used when a taxpayer presents identification to a volunteer to prepare the tax return.

• Passport

• National identity card

• Driver’s license

• State identification card (U.S.)

• Military identification card

• School photo ID

• VISA

(2) The second form of identification needed is the original or a copy of the ITIN card or letter.

(3) One or both forms of identification must contain the taxpayer’s current mailing address. If the taxpayer cannot prove their identity, or if the volunteer is uncomfortable accepting items presented as proof of identity, the volunteer must refer the taxpayer to obtain/seek professional tax help.

(1) This subsections of the IRM provides guidance for all SPEC employees, managers, and analysts. The following identity proofing process will be used when the taxpayer, visiting VITA and TCE sites, presents identification to the coordinator to receive correct return preparation:

• Photo identification for primary and secondary taxpayers

• Social Security Numbers (SSN) or Individual Taxpayer Identification Numbers (ITIN) for everyone listed on the return.

(1) This subsection of the IRM provides guidance and procedures for all employees within LMSB, SBSE, TEGE and W&I Business Operating Divisions, who work with or have a need to know about systems/files/processes. The following identity proofing process will be used to ensure that the POA is authorized to represent their client in the OPA application:

• Taxpayer's SSN or ITIN

• Their Centralized Authorization File (CAF) number, and

• Either the six-digit Caller ID number from the taxpayer's notice or POA’s signature date on Form 2848, Power of Attorney and Declaration of Representative.

(1) This subsection of the IRM provides guidance and procedures for all employees within LMSB, SBSE, TEGE and W&I Business Operating Divisions, who work with or have a need to know about systems/files/processes. The following identity proofing process will be used for BMF taxpayers (or their POAs) to verify their authority to establish an online agreement for the business. A BMF taxpayer or POA must provide:

1. The business EIN

2. The date the EIN was established (MM/YYYY)

3. The business address

4. The Caller ID number provided in their notice

(1) This subsection of the IRM provides guidance and procedures for all employees within LMSB, SBSE, TEGE and W&I Business Operating Divisions, who work with or have a need to know about systems/files/processes. The following identity proofing will be used for existing Secure Access eAuthentication, users will enter their username and password PLUS a six-digit security code that will be sent to the phone number entered as part of the registration process or IRS2Go.

(1) This subsection of the IRM provides guidance and procedures for Appeals technical employees. The taxpayer needs to provide information to substantiate documentation within 30 days for Individual Master File (IMF) cases. The following identity proofing process outlines the information needed:

1. Authentication of Identity: A copy of a valid U.S. federal or state government issued form of identification (examples include a driver’s license, state identification card, social security card, or passport).

   Note: IRS no longer accepts Puerto Rican birth certificates issued before July 1, 2010. Taxpayers with birth certificates issued before this date must get new documentation from the Puerto Rico Vital Statistics Record Office.

2. Support for ID theft: Form 14039 Identity Theft Affidavit (IMF) / Form 14039-B Business Identity Theft Affidavit (BMF) in certain situations (refer to IRM 25.23.9.7, Form 14039-B, Business Identity Theft Affidavit), or a copy of the police report indicating ID theft as the issue.

   Note: The IRS affidavit for IMF taxpayers is also available in Spanish as Form 14039(Spanish Version) Identity Theft Affidavit (Spanish Version).