Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Protect your IRS online account by using a password that is unique to your IRS/ID.me sign-in, enabling an available multifactor authentication (MFA) method, securing the email address and phone used for recovery, and ignoring any request for your password or one-time security code. Start every session by typing IRS.gov yourself or using a trusted bookmark.
If you receive a CP303 notice for activity you did not perform, call the number printed on that notice immediately. If you supplied information to a scammer, stop communicating with them, secure your accounts, contact your financial institution when money or financial details were involved, and follow the IRS identity-theft recovery process.
As an Amazon Associate I earn from qualifying purchases.
How do I protect my IRS online account?
The IRS uses ID.me for identity verification and access to IRS.gov online services. The practical protections are straightforward, but each addresses a different risk:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- A unique password limits damage from a password reused on another site.
- MFA adds a second proof of identity after the password.
- Safe sign-in habits reduce the chance of handing credentials to an impersonator.
- Secure recovery channels help prevent takeover if you lose a device or forget a password.
- An Identity Protection PIN (IP PIN) helps stop fraudulent federal tax-return filing, but it does not protect the online-account login.
The current IRS account-creation guidance lists an authenticator app, face or touch unlock, and text messages to a cell phone as examples of MFA methods. The choices shown to you can change with the current ID.me sign-in flow, so use the methods actually offered in your account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For the IRS account setup instructions, see Creating an account for IRS.gov.
Protect the whole sign-in chain
Your IRS login is only one part of the security chain. The email inbox used for account notices, the phone number used for text verification, the device that stores an authenticator app and the browser you use to reach IRS.gov all matter. If one of those channels is controlled by another person, a strong IRS password may not be enough. Apply the same unique-password and MFA practices to your email and mobile-provider accounts, keep your devices updated, and remove old recovery numbers or addresses you no longer control.
Do not assume that a warning, a new device prompt or an unexpected email proves an account breach. Verify the event through IRS.gov or an authentic mailed notice. At the same time, treat an unexplained sign-in as urgent and investigate it promptly.
Use a password that exists nowhere else
Make the password for your IRS/ID.me account long, hard to guess and completely different from passwords used for email, banking, social media or tax-preparation services. IRS guidance specifically calls for a strong, unique password and says not to reuse or share credentials.
A password manager can generate and store a different password for the IRS account. The IRS does not endorse a particular password-manager product; the important control is uniqueness and keeping the manager itself protected with its own strong password and MFA. Never copy an IRS password into a shared document, send it by email or save it in an unprotected notes app.
If you have reused the password anywhere else, change the IRS/ID.me password first, then change the other accounts that used it. Reusing one password means a compromise at an unrelated website can give an attacker a starting point for your tax account.
Never give your password to a caller, email sender, text-message sender or anyone claiming to be able to “unlock” your IRS account. The IRS states that it will not ask for a username, password or security code by phone, notice, email or text message.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Turn on MFA and choose a recovery path you can actually use
MFA is offered during the ID.me sign-in process. It requires an additional factor after your password, reducing the value of a stolen password alone. The reviewed IRS material does not establish a numerical security ranking among the available methods, so choose a method you can keep available and recover safely.
| Method shown by ID.me | What it depends on | Questions to answer before selecting it |
|---|---|---|
| Authenticator app | A separate app on a phone or other device | Can you restore the app if the device is lost, replaced or reset? Do you have the recovery information stored safely? |
| Face or touch unlock | Biometric capability on a compatible device | Will you still have access to the enrolled device, and what is the fallback if its biometric sensor fails? |
| Text message to a cell phone | Access to the enrolled phone number and its network | How will you sign in if the phone, SIM or mobile service is unavailable? |
| FIDO security key, if offered | A separate physical security key supported by the current ID.me configuration | Can you keep a backup key or use another recovery method? Confirm compatibility before buying any model. |
There is no requirement to buy a paid security product. An authenticator app, a built-in face or touch method, or text messaging may be among the options shown in your account. A FIDO security key is an optional physical device; its price and availability vary, and no particular model is guaranteed to work with every ID.me configuration. Confirm compatibility and recovery requirements before spending money.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When comparing methods, consider four practical questions: Is it currently offered for your ID.me account? Does it depend on a phone network or a separate device? What happens if that device is lost, replaced or reset? How easy will it be for you to use consistently? The IRS materials do not provide a quantitative security ranking, so do not treat one listed method as universally best.
Keep the phone number and email address attached to the account under your control. Protect those accounts with their own unique passwords and MFA where available. Someone who controls a recovery channel may be able to interfere with account recovery even without knowing your IRS password. This is a general account-security precaution rather than a separate IRS requirement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before replacing a phone, changing a number or closing an email account, update the ID.me recovery details through the official sign-in flow. Test the new method while the old method still works. Store any recovery information where you can retrieve it but an unauthorized person cannot.
A physical FIDO security key is optional. An IRS FAQ links to ID.me help topics that include setting up such a key, but no particular model is guaranteed to work with every user’s account. Check the MFA and recovery options displayed by ID.me before purchasing one. Software and built-in device methods may be sufficient.
Sign in without falling for an IRS impersonation
Start from the official site
Type IRS.gov into your browser or use a bookmark you created yourself. Do not use a sign-in link in an unexpected email or text. Check the domain and the browser address bar before entering any information. If a link opens a page that asks for credentials before you have independently reached IRS.gov, close it and start over.
The IRS warns about impersonation websites and directs people to report suspicious IRS email. Its identity protection tips also recommend basic device defenses such as a firewall, anti-spam and antivirus software, current security patches, and changed passwords for internet accounts. Install operating-system and browser updates from the device maker, not from a link in a message.
Know what a legitimate IRS message will not do
An unexpected email claiming to be from the IRS and asking for personal or financial information is a scam. Threatening calls demanding immediate payment or account credentials are also impersonation attempts. Forward suspicious IRS email to [email protected], as the IRS advises.
The rule is specific, not absolute: the IRS does not ask for your username, password or security code through a phone call, notice, email or text. That does not mean the IRS never contacts taxpayers; it means those credentials should never be disclosed through those channels.
Do not let urgency override verification
Stop if a message pressures you to stay on the phone, click a link, disclose a one-time code, buy something, send money or provide additional personal details. Open a new browser window and navigate to IRS.gov independently. If the issue concerns a mailed notice, use the contact information printed on that notice rather than a number supplied in a message.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A real-looking logo, caller ID or web address is not proof. Do not read a code aloud to “confirm” your identity for an unsolicited caller. End the conversation, preserve the message if you need to report it, and verify through an official channel.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat is a CP303 notice?
CP303 is an IRS notice saying that personal information was used to access an IRS online service. Receiving the notice does not by itself prove that your account was compromised. The key question is whether you performed the access described.
If you recognize the activity
Review your account security anyway: confirm that the password is unique, check that your MFA method and recovery details are yours, and remain alert for follow-up impersonation attempts. Do not disclose credentials to anyone who contacts you about the notice.
If you did not access the service
Call the number on the CP303 notice immediately. The IRS says it will disable the online account after verifying your identity. Use the notice itself or navigate to the official IRS site independently; do not rely on a phone number or link in a suspicious email or text.
The IRS’s Understanding your CP303 notice page contains the official instructions and the warning: “The IRS will never ask you for your username, password, or security code via phone, notice, email, or text message.”
Keep the notice available when you contact the IRS so you can follow its instructions accurately. If a separate message tells you to call a different number, ignore that message and use the number printed on the notice or the independently reached IRS website.
What should I do if someone accessed my IRS account?
If you can still sign in
- Stop communicating with anyone who prompted the suspicious sign-in. Do not send money, passwords, security codes or additional personal information.
- Change the online-account password immediately to a complex password that has never been used elsewhere.
- Review and correct the MFA and recovery information associated with the account.
- Follow every instruction in an IRS notice or from an IRS representative reached through an official channel.
- Report suspected identity theft and use the recovery steps in the IRS Identity theft guide for individuals.
After changing the password, check your email and phone accounts for unauthorized changes, such as a new forwarding address, unfamiliar recovery number or unknown device. Change any password reused with the IRS account. Keep a written timeline of the notice, messages, calls and steps you took; it can help you give consistent information when reporting the incident.
If you cannot sign in or received an unexpected CP303
Do not keep guessing passwords or use links supplied by a message. Use the number on the CP303 notice, if you have one, and follow the IRS identity-verification process. The IRS can disable the account after it verifies your identity.
If you gave a scammer financial or personal information
Contact your financial institution immediately when bank, card or payment information or money was involved. Change any reused passwords, secure your email and phone accounts, and follow the IRS instructions for protecting tax information. The IRS also directs victims to the recovery guidance at IdentityTheft.gov.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Its If you were scammed guidance covers the immediate response to scam contact, while the IRS identity-theft guide explains longer-term steps. Do not pay a person who promises to restore the account or obtain a special IRS code.
What an IP PIN protects—and what it does not
An IP PIN is a voluntary, six-digit number known to you and the IRS. According to IRS Tax Tip 2024-75, published September 5, 2024, it is valid for one year and is entered on a federal tax return when prompted, or on a paper return as directed.
The IP PIN helps the IRS verify that the person filing a federal return is you, making it harder for another person to file using your identity. It is not an IRS.gov password, login code, account lock or MFA method. Obtaining one does not remove the need for a unique password and MFA.
Think of the controls as complementary: your password and MFA protect access to the online account; the IP PIN helps protect the filing of a federal return. An IP PIN cannot stop someone from attempting to sign in, and changing your password does not by itself add an IP PIN to a tax return.
Free tools Windows power users keep installed
One-click scans. No signup required.
Read the IRS explanation in IRS Online Account and identity protection PINs protect against identity thieves and scammers.
A practical maintenance routine
When you create or regain access
- Set a new password that is unique to the IRS/ID.me account.
- Enroll in one of the MFA methods currently offered to you.
- Record recovery information in a secure place and confirm that your email and phone are under your control.
- Bookmark IRS.gov yourself for future sign-ins.
- Review the current ID.me recovery instructions so you know what to do if the primary device is unavailable.
After a device, phone number or email change
- Update account recovery details through the official ID.me flow before discarding the old device or number.
- Verify that your MFA method still works and that you understand its fallback process.
- Change the IRS password if the old device or account may have been accessible to someone else.
- Remove former household members, work accounts or old phone numbers from recovery settings where the service permits.
When a message or notice arrives
- Do not click an unexpected sign-in link or disclose a credential or one-time code.
- Navigate independently to IRS.gov or use the phone number printed on an authentic notice.
- For suspicious email, forward it to [email protected].
- For CP303 activity you did not perform, call the number on the notice immediately.
Every few months
- Confirm that your password is still unique and that your password manager or storage method is protected.
- Check that your MFA device, phone number and email address remain available.
- Install pending security patches and review antivirus, anti-spam and firewall protections.
- Revisit the official ID.me options before buying a replacement security key or changing authentication methods.
Common mistakes that leave an account exposed
- Reusing an email or banking password: A breach elsewhere can provide a working password for the IRS account.
- Relying only on an IP PIN: The PIN helps with tax-return filing and does not secure online sign-in.
- Sharing a one-time code: A code can allow an attacker to complete a login even when your password remains secret.
- Calling a number in a text or email: Use IRS.gov or the number printed on the mailed notice instead.
- Buying a security key without checking compatibility: ID.me options vary; confirm that the current account supports the key and understand recovery requirements.
- Ignoring the email account and phone: Weak recovery channels can undermine otherwise strong IRS credentials.
- Leaving an old device signed in: Remove access or update credentials when a device is sold, lost or shared.
- Assuming a CP303 is automatically fraud: Verify whether you or an authorized person performed the access, then follow the appropriate instruction.
Frequently asked questions
How can I tell if an IRS text or email is real?
Do not decide by the logo, caller ID or link appearance. An unexpected message asking for a username, password, security code, personal information or financial information is suspicious. Do not click it. Navigate to IRS.gov yourself, and forward suspicious IRS email to [email protected].
Will the IRS ask for my password to fix an account?
No. IRS guidance says it will never ask for your username, password or security code by phone, notice, email or text. Keep those credentials private even when someone claims the request is needed to resolve a CP303 notice.
Is a text-message code safe to read to an IRS representative?
Do not disclose a one-time security code to an unsolicited caller or message sender. Use the official sign-in or contact process you initiated. If a mailed notice directs you to call, use the number printed on that notice and follow the identity-verification instructions without revealing credentials to an unverified person.
Do I need to buy a FIDO security key?
No. A security key is optional, and the IRS-listed MFA examples include an authenticator app, face or touch unlock and text messaging. If you want a FIDO key, confirm that your current ID.me account supports it and plan a recovery method before buying a model.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Does an IP PIN stop someone from logging in?
No. An IP PIN is a voluntary, six-digit filing-protection number valid for one year. It helps verify identity on a federal tax return; it is not a password, login code or MFA factor.
What if I do not have my CP303 notice anymore?
Do not use a phone number from an email or text about the notice. Type IRS.gov into your browser and locate the official CP303 instructions, or use the IRS contact route shown on an authentic notice or official page.
What if I gave a scammer my bank details?
Stop contact, call your financial institution immediately and follow its instructions. Change reused passwords, secure your email and phone accounts, report suspected identity theft and follow the IRS and IdentityTheft.gov recovery guidance.
Recommended Free Tools
Official resources
- Creating an account for IRS.gov
- Identity protection tips
- Understanding your CP303 notice
- If you were scammed
- Identity theft guide for individuals
- Taxes Security Together
- Security Summit: Strengthen defenses against tax identity theft
In the September 4, 2026 Security Summit release, IRS Chief Executive Officer Frank J. Bisignano said taxpayers and tax professionals should “take advantage of the powerful tools available to help protect against identity theft.” The useful tools are the controls described here: unique credentials, available MFA, secure recovery channels, careful verification and prompt action when an unexplained notice arrives.
Frequently Asked Questions
What is the fastest way to protect my IRS online account?
Change to a unique IRS/ID.me password, enable an MFA option currently offered in your account, secure the recovery email and phone, and sign in only by typing IRS.gov or using your own bookmark.
What should I do first after an unexpected CP303 notice?
If you did not access the service, call the number printed on the CP303 notice immediately. The IRS says it will disable the online account after verifying your identity.
Can I use an IP PIN instead of MFA?
No. An IP PIN is a voluntary six-digit number used to help verify identity when filing a federal return. It does not protect the IRS.gov login or replace MFA.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAre paid security products required?
No. IRS-listed options include software and built-in device methods. A FIDO security key is optional; confirm current ID.me compatibility and recovery requirements before purchasing one.
The Bottom Line
Use a password that is unique to IRS/ID.me, turn on an MFA method you can recover, protect the email and phone tied to the account, and never share a password or one-time code. Reach IRS.gov independently, treat unexpected credential requests as scams, and call the number on an unexplained CP303 notice immediately. An IP PIN adds protection when filing a federal return, but it is not an account-login safeguard.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
