Blog · 14 October 2026

Taxpayer Confidentiality After TIGTA’s UNAX Report: §6103, §7213A, §7431 and What US CPA Firms Should Tell Clients

By Keshav Bansal, CA

Taxpayer confidentiality under IRC §6103 is supposed to mean that IRS employees look at a return only for a tax administration reason. A new Treasury Inspector General for Tax Administration (TIGTA) audit of the IRS unauthorized access (UNAX) program shows gaps in the controls behind that promise. In Report No. 2026-300-058 (September 29, 2026), TIGTA reviewed Integrated Data Retrieval System (IDRS) audit logs for calendar years 2022 through 2025 (as of November 2025). It found 86 suspicious accesses of 30 high-profile taxpayers by 52 IRS employees. For US CPA firms, the report is a useful way to explain to clients what §6103, §7213A and §7431 protect, what an IRS victim notice means, and how preparer confidentiality differs.

What TIGTA found in the UNAX audit

Accounting Today’s Michael Cohn covered the report on October 7, 2026. TIGTA concluded that the UNAX program “is not adequately addressing the risk of unauthorized access to taxpayers’ accounts.” Its findings:

• Prevention. Preventive controls mostly stop employees from opening the accounts of family or close relations. The IRS has no way to prevent, or to detect systemically, browsing of celebrities or public officials.
• Name searches. Most IDRS research needs a Taxpayer Identification Number. The NAMES command codes look up a TIN from a last name, and TIGTA found they bypass current UNAX monitoring. Searching almost 6 million NAMES queries for a limited list of names of government officials, business leaders and entertainers, TIGTA flagged the 86 suspicious accesses and referred all of them to its Office of Investigations. The Privacy Office could not give a business purpose for why the 52 employees opened those accounts.
• Discipline. In a separate review of 53 FY 2023–2025 cases where an employee opened an account without the taxpayer’s knowledge or consent, 31 employees were terminated and 22 were not. All 22 received lesser discipline, ranging from reprimands to suspensions.
• Victim notification. Of 122 UNAX cases closed in FY 2023–2025, 276 taxpayers in 83 cases were not notified. In 175 of those, staff did not follow procedures. The other 101 were missed because the employee resigned or retired before discipline was proposed, which is the point at which the IRS sends notices.

TIGTA made eight recommendations. The IRS agreed or partially agreed with seven and disagreed with setting an overall timeliness standard for victim notices. In its response, the IRS said its Privacy Office reviewed 54 Reports of Investigation and notified 182 taxpayers. It also said it has named the Chief Privacy Officer as the senior official overseeing UNAX.

The law: §6103, the Taxpayer Browsing Protection Act and §7213A

Section 6103 keeps returns and return information confidential and limits access to people with a tax administration purpose. The Taxpayer Browsing Protection Act, signed August 5, 1997, made it unlawful for IRS employees to access, or attempt to access, taxpayer records without a legitimate tax administration purpose, even when nothing is shared. UNAX is the program that carries out the Act. As TIGTA summarizes the penalties:

• Unauthorized inspection (§7213A): fines up to $1,000 and/or up to one year in prison, plus termination for federal employees.
• Unauthorized disclosure (§7213): fines up to $5,000 and/or up to five years in prison, plus termination.
• Civil damages (§7431): the taxpayer can sue in federal court even if the Justice Department never prosecutes.

TIGTA also notes a Senate bill introduced in June 2026. It would raise the maximum penalty for unauthorized disclosure to a $250,000 fine and seven years in prison, but it does not address access without disclosure. It is not law.

What §7431 gives a client whose return was browsed

Under §7431(a), a taxpayer can sue in district court when someone knowingly or negligently inspects or discloses their return information in violation of §6103. If that person is a federal employee, the suit is against the United States. Non-employees can be sued too, such as a contractor like Charles Littlejohn, who TIGTA says accessed more than 400,000 accounts and was sentenced to five years. Damages are the greater of $1,000 per act or actual damages, with punitive damages added for willful or grossly negligent conduct, plus costs. Good-faith but mistaken readings of §6103, and access the taxpayer requested, are excluded. A suit must be filed within two years after discovery.

Under §7431(e), the IRS must notify the taxpayer as soon as practicable after a criminal charge or a proposed disciplinary action. The notice must give the date of the access and the taxpayer’s rights. TIGTA measured timeliness against a 30-day standard. In 26 of the 39 notified cases, the 40 taxpayers involved got their notice late.

Contrast: preparer confidentiality under §7216

Clients often mix up IRS confidentiality with their preparer’s duties. Section 6103 and UNAX govern the government and others who receive return information under §6103. A CPA firm’s obligations come mainly from §7216 consent rules, Circular 230 and the FTC Safeguards Rule. See our §7216 consent and Circular 230 guide and our WISP and FTC Safeguards Rule post. The Taxpayer Bill of Rights lists both a right to privacy and a right to confidentiality, and clients expect the same discipline from their firm.

What US CPA firms should tell clients

• Take an IRS UNAX notice seriously. Record the date the letter arrived. The two-year §7431(d) clock runs from discovery, so refer the client to counsel promptly if a damages claim is worth considering.
• No letter does not prove nothing happened. TIGTA found 101 taxpayers who went unnotified only because the employee left before discipline was proposed. High-profile clients are the accounts browsers target.
• Suggest identity protection. TIGTA stresses that timely notice lets victims protect themselves. An IRS Identity Protection PIN and credit monitoring are sensible steps for a worried client.
• Watch the legislation. The June 2026 Senate bill, and the IRS reforms covered in our TAS Act post, change nothing until enacted.

A short firm checklist

• Ask high-profile clients each year whether they received any IRS letter about unauthorized access to their records.
• Log the receipt date of any §7431(e) notice and calendar the two-year discovery deadline.
• Run your own version of TIGTA’s log test: who in the firm opened which client file, and why.
• Limit staff access to VIP client files to those who need it.
• Refresh §7216 consents and your WISP before bringing in any outsourced team.

Where this fits for Tax Brew readers

Confidentiality starts inside your own firm, with consent forms, access logs and a written security plan. If you need extra capacity on tax prep and bookkeeping work, see our support for US CPA firms or email info@taxbrewglobal.com.

Check current guidance: this article summarizes TIGTA Report No. 2026-300-058, “Improvements to the IRS’s Unauthorized Access Program Could Further Protect Taxpayer Privacy” (September 29, 2026), Accounting Today (Michael Cohn, October 7, 2026), and IRC §§6103, 7213, 7213A and 7431. Confirm the full report and current law before advising. This is general information, not tax or legal advice. Sources as of 14 October 2026.