What to Check Before Sharing Business Tax Records

The IRS urged businesses on October 2, 2026, to protect tax records and verify requests to change sensitive employee or payment information through a trusted channel. Its Cybersecurity Awareness Month reminder recommends unique passwords, multifactor authentication, software updates, encrypted files and backups. The release offers security guidance rather than announcing a new business filing deadline.

The warning extends to familiar relationships. In its September 16 reminder for tax professionals, the IRS described schemes involving fake prospective clients, malicious attachments and messages seeking preparers’ identification numbers. A recognizable business purpose does not establish that a request is genuine.

Trovo’s interpretation: treat each handoff of sensitive records as an operating decision. Before sending anything, establish who needs the information, what they need, how they will receive it and who can stop access. That applies whether the recipient is a preparer, payroll provider, lender or employee. An approaching deadline should trigger an established process, rather than an improvised exception.

Separate the file from account access

Start with an inventory of the records involved in the next task. Include business tax returns, EIN documentation, payroll exports, bank details and tax-account credentials. Record where each is stored, who can reach it and whether another copy sits in an email inbox, downloads folder or former employee’s account.

This inventory should answer a practical question: can the business provide the required document without exposing the rest of the folder or handing over an account login?

For each recipient, write down the purpose of access. Preparing a return, processing payroll and reviewing a financing application are different jobs. Ask the recipient to identify the necessary records and date ranges before granting access. Resolve questions about completeness with the recipient rather than silently removing information from a requested document.

Keep account credentials out of the document package. Where a service offers separate user accounts or authorized access, evaluate those controls instead of passing around one password. Apply the IRS’s recommended multifactor authentication wherever available. For sensitive files, confirm how the chosen sharing service handles encryption and recipient access rather than assuming that an upload button establishes adequate protection.

Access also needs an owner inside the business. Name the person who approves a release and a backup who can act when that person is unavailable. Give the backup their own authorized access. Requiring the owner to approve every routine upload may create a bottleneck; allowing everyone to distribute the entire archive removes accountability. Written limits on what staff may send offer a workable middle ground.

Trovo’s funding readiness checklist addresses preparing a consistent financing file. Add this security review to that preparation: a complete application package still needs a verified destination and controlled access.

Test a real handoff

Illustrative assumptions: A ten-person service business uses an outside preparer and a payroll provider. It is also applying for financing. In this example, the prospective lender has requested two years of business tax returns and six months of bank statements by Friday. The company keeps those documents in a shared folder that also contains employee payroll records.

Sending the lender a link to the entire folder would be convenient. It would also provide access beyond the assumed request. A more controlled approach is to assemble a separate package containing the requested returns and statements, confirm the recipient and upload destination through contact information already on file, and grant access only to that package.

Record which files were sent, who approved them and when they were shared. Agree on how missing documents or corrections will be handled. Where the service allows it, set an appropriate access end date. Ending a recipient’s access is a separate decision from deleting records the business retains.

Now assume an email arrives claiming that the lender’s portal is unavailable and asking the office manager to reply with the documents attached. The message uses the name of the expected contact and mentions Friday’s deadline.

Under the proposed process, the office manager pauses the transfer and calls the established contact using the number already on file. The message’s signature is not the source of the verification number. If the request is legitimate, the parties agree on an acceptable alternative. If it cannot be verified, the files stay put.

That pause has a cost: the application could take longer to complete. The business can reduce that friction by confirming the sharing method at the start, preparing the package early and naming someone who can resolve exceptions. It cannot responsibly assume that urgency establishes authenticity.

Apply the same discipline to an employee’s request to change payroll bank details. The October IRS reminder specifically calls for verifying sensitive employee or payment changes through a trusted channel. Confirming a document recipient and authorizing a payment change are separate decisions, even when both arrive in the same email thread.

If borrowing prompted the review, pair it with a funding readiness check. Keep the conclusions separate: controlled document sharing does not establish financing eligibility, and a well-prepared application does not establish that a document request is authentic.

Give suspected compromise a response path

Write down who staff should contact if a file goes to the wrong recipient, credentials may have been exposed or an unexpected account notice arrives. Include the internal decision-maker, the relevant provider and technical support. Keep those contact details somewhere staff can reach without relying entirely on the account that may be compromised.

A useful response note identifies who can suspend sharing access, contact the provider and preserve the suspicious message or activity record for investigation. Staff should know where to report the issue promptly, without waiting to prove that fraud occurred. Let the responsible technical or professional adviser determine the appropriate containment steps and any notification obligations.

The IRS’s September guidance directs tax professionals experiencing data theft to contact their IRS Stakeholder Liaison promptly and report through the relevant state channels. An owner can ask the preparer who handles that response and how affected clients would be contacted. Those professional reporting instructions should not be mistaken for a complete incident plan for every business.

Our guide to domain compromise and cash-flow continuity covers the related problem of losing control of business email and other domain-dependent services. Use it for continuity planning; this review concerns the permission to release a particular set of records.

Before the next handoff, trace one actual request from receipt to completed delivery. Verify the recipient, inspect the files and permissions, and have the backup approver explain what they would do if the sharing instructions changed. Fix any unanswered step before releasing the records. This is a practical release check, not a security certification.