Is MFA and 2FA the New Standard for Accountants?
| |
For years, accountants have told their clients to protect sensitive financial information with strong passwords. Today, a password alone is increasingly considered inadequate.
Multifactor authentication (MFA) and two-factor authentication (2FA) are quickly becoming the standard for protecting accounting firms, tax practices and their clients' confidential information.
And this is more than simply a cybersecurity recommendation. For tax preparation firms, MFA is now a federal requirement under the Federal Trade Commission's Safeguards Rule, unless a Qualified Individual approves an equivalent secure access control in writing. The IRS reiterated this requirement in September 2026 and emphasized that it applies to tax preparation firms regardless of size.
What Is MFA and 2FA?
The terms MFA and 2FA are often used interchangeably, although there is a slight distinction.
Two-factor authentication (2FA) requires two different types of credentials to verify someone's identity. For example, an employee might enter a password and then enter a security code sent to their phone.
Multifactor authentication (MFA) is the broader term. It requires at least two independent authentication factors, which can include:
- Something you know — such as a password
- Something you have — such as a smartphone or security token
- Something you are — such as a fingerprint or facial recognition
In practical terms, both approaches provide an important second layer of protection if a password is stolen.
Why Is MFA So Important for Accounting Firms?
Accounting and tax firms are particularly attractive targets for cybercriminals because they maintain enormous amounts of sensitive financial information.
A compromised accountant's email account, tax software account or cloud-storage account could potentially expose Social Security numbers, tax returns, bank information, payroll records and other confidential client information.
The IRS specifically recommends that tax professionals use MFA across all services and data-access points, including tax software, cloud storage, email and other systems containing sensitive client information.
That represents an important change in mindset.
MFA shouldn't be viewed as something that applies only to the firm's tax software. It should be part of the firm's overall security strategy.
Is MFA Really New?
Not really.
The IRS has been recommending MFA to tax professionals for years. However, the regulatory environment has evolved.
The FTC's Safeguards Rule was strengthened to provide more specific cybersecurity requirements for covered businesses. Among those requirements is MFA for anyone accessing customer information, unless an equivalent secure access control is approved in writing by the firm's Qualified Individual.
The IRS has also become increasingly direct in communicating that MFA is not simply a cybersecurity "best practice" for tax professionals. In its September 2026 guidance, the IRS stated that tax preparation firms must use MFA to protect access to customer information.
So while the technology isn't new, the expectation that accounting firms use MFA throughout their technology environment is becoming much more firmly established.
Where Should an Accounting Firm Use MFA?
A firm should look beyond its tax software.
MFA should be considered for virtually every system that could provide access to confidential client information, including:
- Email — Microsoft 365 or Google Workspace
- Tax preparation software
- Accounting and bookkeeping software
- Cloud storage
- Client portals
- Payroll systems
- Banking and financial accounts
- Practice management software
- Payment-processing systems
- Remote-access systems
- Website and hosting administration
The IRS specifically advises tax professionals to implement MFA across services and data-access points rather than limiting it to one application.
What Does This Mean for Smaller CPA Firms?
One of the biggest misconceptions is that cybersecurity requirements are primarily a concern for large accounting firms.
They aren't.
The IRS specifically states that the MFA requirement applies to tax preparation firms regardless of size.
A small two-person tax practice can be just as attractive to a cybercriminal as a much larger firm because the smaller firm may have valuable client information but fewer resources devoted to cybersecurity.
For smaller firms, MFA is one of the relatively simple security improvements that can provide a significant additional layer of protection.
MFA Is Becoming Part of the Client Experience, Too
There is another reason MFA is becoming increasingly common: clients are becoming accustomed to it.
Consumers routinely encounter MFA when logging into banks, investment accounts, healthcare portals and other financial services.
As a result, asking a client to enter a security code before accessing a tax document or financial statement is becoming much less unusual.
For an accounting firm, this can actually become a positive signal: "We take the security of your information seriously."
The Bottom Line
MFA and 2FA aren't new technologies, but they are becoming the new baseline for accounting-firm security.
For tax professionals, the issue has moved beyond simply asking whether MFA is a good idea. Firms need to understand their regulatory obligations, identify where sensitive client information resides and make sure appropriate authentication controls are being used throughout their technology environment.
A strong password is no longer enough.
For accounting firms, MFA should increasingly be viewed as a fundamental part of doing business — not an optional cybersecurity upgrade.
