MFA Fatigue Is Real. Turning It Off Is Not an Option for Tax and Accounting Firms.

The FTC Safeguards Rule and the IRS expect multi-factor authentication on every system that holds client data. Here’s how firms can meet that expectation and stop the attacks designed to get around it.

Key takeaways

The FTC Safeguards Rule requires MFA for anyone accessing any information system that holds customer information, and the IRS has said opting out of MFA in tax software violates the rule.
Attackers now target weak MFA through push bombing, phishing proxies, and help desk impersonation.
Number matching, phishing-resistant MFA for high-risk users, and conditional access close most of those gaps.
Your firm’s written information security plan (WISP) should document where MFA is enforced and who approved any exceptions.

Every firm knows the scene. It’s February, the team is buried, and the tax software asks for another code. Someone suggests turning MFA off “just until the season ends.” It sounds harmless, and it’s one of the fastest ways to put client data, the firm’s reputation, and its regulatory standing at risk.

A hypothetical busy-season shortcut

Consider a six-person firm where a preparer asks to disable MFA in the tax software to save time. A few weeks later, a password she reused on a shopping site appears in a stolen credential list. Someone logs in on a Sunday, pulls client returns, and begins filing fraudulent ones with refunds routed elsewhere.

The firm now faces client notifications, IRS reporting, and the uncomfortable task of explaining why a required control was switched off.

MFA is a requirement, not a preference

The FTC Safeguards Rule treats tax and accounting firms as financial institutions, regardless of size. Section 314.4(c)(5) requires MFA for any individual accessing any information system, unless the firm’s Qualified Individual approves an equivalent control in writing. The IRS and its Security Summit partners have stated plainly that MFA is a federal requirement for tax professionals.

The requirement isn’t limited to remote access. It applies to staff working in the office as well. And if a security event exposes unencrypted information for 500 or more people, the rule requires notifying the FTC within 30 days.

Not all MFA is equal

Turning MFA on is the starting point. Attackers have adapted to work around weaker versions of it:

MFA fatigue (push bombing). With a stolen password, an attacker sends approval request after approval request, often late at night, until someone taps Approve to make it stop.
Phishing proxies. A fake login page relays the user’s password and six-digit code to the real site in real time.
Help desk impersonation. An attacker calls posing as an employee who “got a new phone” and asks for MFA to be reset.

The Cybersecurity and Infrastructure Security Agency (CISA) describes phishing-resistant MFA, such as passkeys and FIDO2 security keys, as the gold standard. For firms using push notifications, CISA recommends number matching as an interim step: the user enters a number displayed on the login screen into their authenticator app before access is granted, which defeats blind approvals.

Conditional access adds another layer. Rather than treating every sign-in the same, it applies rules about who can sign in, from where, on which devices, and when stronger proof is needed. Configured well, it can also reduce prompts on trusted, firm-managed devices, which addresses the very frustration that leads staff to ask for MFA to be turned off.

Practical steps for firm owners and IT

Enforce MFA everywhere client data lives. Tax software, client portals, document management, email, remote access, cloud accounting platforms, and banking.
Allow no seasonal exceptions. If an exception is truly unavoidable, the Qualified Individual approves it in writing and it is recorded in the WISP.
Require number matching. Replace simple Approve/Deny prompts and text message codes with an authenticator app that requires number matching.
Protect the most powerful accounts. Partners, administrators, and anyone with e-file or banking authority should use passkeys or FIDO2 security keys.
Use conditional access. Block older sign-in methods that skip MFA, block sign-ins from countries where the firm doesn’t operate, and require firm-managed devices to open client files. Firms on Microsoft 365 typically need a Business Premium-level license for these controls.
Onboard and offboard cleanly. Seasonal and contract staff enroll in MFA on day one and lose access on their last day.
Verify before resetting MFA. Confirm identity through a known channel before anyone’s MFA method is changed.
Alert on suspicious activity. Repeated denied prompts, newly registered MFA devices, and new mailbox forwarding rules should reach someone who acts on them.
Train for the unexpected prompt. If you didn’t start the sign-in, deny it and report it immediately. A no-blame reporting culture gets mistakes surfaced in minutes instead of days.
Update the WISP. Document where MFA is enforced, which methods are used, and any approved exceptions.

Questions clients may ask, and how firms can answer

Clients increasingly ask about data security before sharing sensitive documents. Partners and staff should be ready with clear answers.

Is my tax information safe if someone at your firm gets phished?
A stolen password alone won’t get anyone into our systems. Every account that touches client data requires a second verification step, and our highest-privilege accounts use phishing-resistant sign-in.
Why do I need a code to upload documents to your portal?
Federal rules require us to protect your financial information, and the code keeps a stolen password from being enough to reach your files.
Do you have a written security plan?
Yes. Our WISP documents how we protect client data, including where MFA is required.
What happens if your firm experiences a breach?
We have an incident response plan that covers investigation, client notification, and required reporting to the IRS and the FTC.

The bottom line

MFA prompts can be annoying, especially during busy season. But for tax and accounting firms, the alternative isn’t convenience. It’s noncompliance and a much easier path for attackers. Firms that move to number matching, give high-risk users phishing-resistant MFA, and use conditional access to reduce unnecessary prompts get stronger protection with less friction for their teams.

===

Scott Carr, owner of Farmhouse Networking in Grants Pass, Oregon, is a veteran Network & Computer Systems Architect with over 30 years of IT experience. For over a decade, he’s led his team in delivering proactive, secure, and fully managed IT services to more than 80 businesses—including accounting and finance firms that rely on data security, compliance, and efficiency. Scott’s hands-on, jargon-free approach ensures every client understands their technology and gains confidence in their systems. His firm is known for fast, responsive support—most issues are resolved within 15 minutes—and deep expertise in cybersecurity, network design, and IT compliance. Learn more about how Farmhouse Networking supports the accounting industry at https://www.farmhousenetworking.com/finance-it-support/.