TITLE: IRS Cybersecurity for Non-US Founders Running US LLCs and Corporations — 7-Step Checklist Before the 15 October 2026 Deadline
If you run a US LLC, C corporation, marketplace business or cross-border ecommerce operation from outside the United States, your US tax identity is a valuable target.
That identity may include your EIN, ITIN, IRS transcripts, Business Tax Account, state sales tax permits, importer records and sensitive forms such as Form 5472, Form 5471, Form 1120, Form 1120-F, FBAR and W-8BEN-E documentation.
On 2 October 2026, the IRS issued IR-2026-119, reminding taxpayers, businesses, tax professionals and Security Summit partners to protect tax data through simple daily security habits.
The timing matters. Some extended federal returns, including Forms 1040-NR, 1040, 3520 and 1120, have a 15 October 2026 extended filing deadline. A compromised account just before filing can delay submissions, block access to notices and create avoidable penalties.
Why IRS cybersecurity matters when you operate from abroad
You do not need to live in the United States to be targeted.
A UK, Ireland, Canada, Australia or EU-based founder may operate a US LLC, US C corporation or online store selling through Amazon, Shopify, eBay, Etsy, TikTok Shop or Walmart. You may also be one of the many US importers of record managing inventory, customs documentation and state sales tax registrations remotely.
A criminal who obtains your login details may be able to:
- Impersonate you when communicating with the IRS.
- Misuse your EIN or ITIN in fraudulent filings.
- Access transcripts, notices and payment history.
- Change payment or bank details through a compromised email account.
- Interfere with Form 5472, Form 5471 or Form 1120 filing processes.
- Disrupt an IRS payment plan or create confusion over balances due.
- Target your payroll records, W-2 information or contractor data.
- Expose W-8BEN-E, W-9, treaty and beneficial ownership documentation.
- Create problems with state sales tax filings or permits.
- Cause delays in matters involving FIRPTA withholding records.
An EIN is not normally “changed” by a hacker. The greater risk is EIN misuse: criminals use the number while pretending to be an authorised representative of your company. That can make your filings and IRS communications harder to control.
Recovery can also take longer when you are overseas. There is no IRS walk-in office in most countries. You may need to use the IRS international taxpayer services process or the international telephone line, rather than resolving the issue face to face.
Secure your US tax identity with this seven-step checklist
The IRS recommends strong passwords, multifactor authentication, updated software, scam awareness, protected records and secure networks. Use the following checklist to apply that guidance to your international business this week.
1. Lock down your IRS accounts before the filing deadline
Review access to your Business Tax Account, Individual Online Account and any Tax Pro Account used by your accountant or tax agent.
Use a strong, unique password and turn on MFA wherever it is available. Remove former employees, contractors and advisers who no longer need access. Check designated users and authorised representatives.
For eligible entities, Business Tax Account access can help you view balances, notices, transcripts, payments and EIN verification information. Protecting access now means you are less likely to lose critical records when a return or payment is due.
2. Get an Identity Protection PIN if you are eligible
An Identity Protection PIN is a six-digit number that helps prevent someone from filing a federal tax return using your SSN or ITIN.
Anyone with an SSN or ITIN who can verify their identity may be eligible. This is especially relevant for non-US founders who use an ITIN for US tax filing.
An IP PIN does not replace your EIN and does not secure a company account by itself. Treat your EIN, ITIN and IP PIN as confidential financial credentials. Never provide an IP PIN in response to an email, call or text. The IRS says it will never ask for your IP PIN through those channels.
3. Patch every device and use a password manager
Update laptops, phones, browsers, operating systems, antivirus tools and cloud accounting applications. Turn on automatic updates where possible.
Your accounting software, email account and marketplace dashboards may contain enough information to reconstruct your US tax identity. A password manager helps you create different passwords for your IRS, banking, ecommerce and payroll accounts.
This is particularly important for a remote team using shared systems across the UK, Ireland, Canada, Australia or the EU. A reused password can give a criminal access to multiple systems at once.
4. Never use public Wi-Fi for IRS or banking services
Avoid opening IRS accounts, bank accounts, payment platforms, accounting software or state sales tax portals on public Wi-Fi.
Use a trusted private network or a properly configured secure connection instead. This simple step reduces the risk of exposing login credentials, tax records or payment information while travelling or working from a hotel, airport or café.
5. Encrypt and back up your US tax records
Encrypt sensitive records at rest and during transfer. Store secure backups in a separate location so a lost laptop, ransomware incident or account lockout does not destroy your compliance history.
Your protected records should include, where relevant:
- Form 5472 and Form 5471 workpapers.
- Form 1120 and Form 1120-F filings.
- FBAR records and foreign account information.
- Federal and state sales tax returns.
- W-9 and W-8BEN-E documentation.
- Treaty documentation and beneficial ownership records.
- Importer of record and customs records.
- IRS notices, transcripts and payment confirmations.
Do not send unprotected tax files through ordinary email when a secure portal is available. Reliable backups help you continue filing even if access to an IRS or accounting account is temporarily blocked.
6. Train your team and contractors to verify changes
Businesses, payroll teams and HR departments should watch for phishing emails, fake invoices and W-2 or payroll schemes.
A criminal may compromise the mailbox of a founder, accountant, supplier or contractor and request a change to:
- Employee bank details.
- Contractor payment instructions.
- Supplier account information.
- Payroll data.
- IRS or state tax payment details.
Require a second verification through a known telephone number or an established secure channel. Do not rely on the phone number or link included in the suspicious message.
This control is essential for virtual teams and outsourced contractors. It can prevent a fraudulent payment and stop attackers from using your payroll records to target employees.
7. Create a written breach response plan
Tax and accounting professionals must create and maintain a Written Information Security Plan, or WISP, under the FTC Safeguards Rule. The IRS provides Publication 5708 as a practi
