Protecting Your myIR Account: 7 Essential Security Tips to Keep Tax Information Safe in 2026
Protecting your myIR account has become increasingly important as cyber criminals continue targeting online tax accounts and personal information.
Inland Revenue has warned taxpayers, businesses, accountants, and tax agents about the growing risks of phishing attacks, password breaches, and unauthorised account access.
Whether you use myIR to manage tax returns, pay tax, access GST information, or handle client accounts, taking proactive security measures can help safeguard sensitive information and reduce the risk of fraud.
How Can You Protect Your myIR Account?
Protecting your myIR account involves enabling two-step verification (2SV), using strong and unique passwords, monitoring account activity, keeping contact details updated, securing devices, and staying alert to phishing scams. These measures help prevent unauthorised access and protect sensitive taxpayer information.
What Is myIR?
myIR is Inland Revenue’s secure online portal that allows New Zealand taxpayers to manage their tax affairs digitally.
Through myIR, users can:
- File tax returns.
- View tax assessments.
- Pay tax online.
- Manage GST obligations.
- Check student loan balances.
- Update personal information.
- Access Inland Revenue correspondence.
- Manage business tax accounts.
Official myIR access: myIR Online Services
Why Protecting Your myIR Account Matters
Your myIR account contains sensitive personal and financial information that may be attractive to cyber criminals.
If an account becomes compromised, unauthorised users may potentially access:
- Tax records.
- Income information.
- GST details.
- Student loan information.
- Bank account details.
- Working for Families information.
- Business tax records.
For tax professionals, a compromised account may also expose confidential client information.
7 Essential Tips for Protecting Your myIR Account
1. Enable Two-Step Verification (2SV)
Two-step verification provides an additional layer of security beyond your password.
When enabled, users must enter:
- Their password.
- A temporary verification code.
Even if a password becomes compromised, 2SV helps prevent unauthorised access.
2. Use Strong and Unique Passwords
Using the same password across multiple websites significantly increases security risks.
To improve password security:
- Create long passphrases.
- Use unique passwords.
- Avoid predictable words and dates.
- Consider using a password manager.
Never reuse passwords between myIR and other online accounts.
3. Watch for Phishing Scams
Cyber criminals frequently impersonate Inland Revenue through:
- Email scams.
- Text message scams.
- Phone calls.
- Fake websites.
- Social media messages.
Common scam messages may claim:
- You are due a tax refund.
- Your account has been suspended.
- You must update your details urgently.
- Your tax return contains errors.
Always verify communications through official Inland Revenue channels.
4. Monitor Your myIR Account Regularly
Regular account reviews can help detect suspicious activity early.
Review:
- Recent logins.
- Account changes.
- Tax assessments.
- Payment activity.
- New messages.
Promptly investigate any activity you do not recognise.
5. Keep Contact Information Updated
Your email address and mobile number are important security tools.
Updated details allow Inland Revenue to:
- Send verification codes.
- Deliver account alerts.
- Notify you about security issues.
- Confirm account changes.
6. Secure Devices Used to Access myIR
Your device security is just as important as your password security.
Best practices include:
- Installing software updates.
- Using antivirus protection.
- Avoiding unsecured public Wi-Fi.
- Protecting devices with passwords or biometrics.
Secure devices help reduce the risk of account compromise.
7. Review Account Access Permissions
Businesses and tax professionals should regularly review account access permissions.
This includes:
- Removing former staff access.
- Reviewing authorised users.
- Checking third-party permissions.
- Monitoring client account access.
Limiting unnecessary access reduces security risks.
Protecting Client Information for Tax Professionals
Tax agents, accountants, and advisers often have access to large volumes of confidential client information.
Additional security measures may include:
- Mandatory two-step verification.
- Staff cybersecurity training.
- Access control procedures.
- Secure document management.
- Regular security reviews.
Protecting client information is a critical professional responsibility.
Common myIR Security Mistakes to Avoid
Reusing Passwords
Password reuse remains one of the leading causes of account compromise.
Clicking Unknown Links
Always access myIR directly through the official Inland Revenue website.
Sharing Login Credentials
Never share passwords or verification codes with anyone.
Ignoring Security Alerts
Review security notifications and account alerts immediately.
What Should You Do If You Suspect Unauthorised Access?
If you believe your myIR account has been compromised:
- Change your password immediately.
- Enable or review 2SV settings.
- Check recent account activity.
- Review account permissions.
- Contact Inland Revenue if necessary.
- Monitor all tax accounts closely.
Taking prompt action can help minimise potential damage.
Frequently Asked Questions
What is two-step verification (2SV)?
Two-step verification adds an extra layer of security by requiring both a password and a verification code before access to your myIR account is granted.
Is myIR secure?
Yes. Inland Revenue uses authentication controls, encryption, and security measures to help protect taxpayer information. However, users should also follow good cybersecurity practices.
Can accountants access client information through myIR?
Yes. Authorised tax agents and accountants can access client information when appropriate permissions have been granted.
How often should I review my myIR account?
It is recommended to review your account regularly, especially after receiving Inland Revenue notifications or security alerts.
What should I do if I receive a suspicious IRD email?
Do not click any links or provide personal information. Verify the communication through the official Inland Revenue website or your myIR account.
Related IRD Guru Guides
- Inland Revenue Digital Tax System: 9 Key Changes New Zealand Taxpayers Should Know
- How to Pay IRD Tax Online
- IRD More Information Request Letter Explained
- IRD Baycorp Tax Debt Guide
- Contact IRD Guru
External Resources
- Official myIR Login and Services
- Inland Revenue New Zealand
- Own Your Online – Cyber Security Guidance
- CERT NZ Cyber Security Advice
Disclaimer
This article is intended for general information purposes only and should not be considered tax, legal, cybersecurity, accounting, or financial advice. Inland Revenue policies and online security recommendations may change over time. Always refer to official guidance and seek professional advice where appropriate.
Key Takeaway
Protecting your myIR account is essential in today’s digital environment.
By enabling two-step verification, using strong passwords, monitoring account activity, securing devices, and staying alert to phishing scams, New Zealand taxpayers can significantly reduce the risk of unauthorised access and protect valuable tax information.
As Inland Revenue continues expanding digital services, good cybersecurity habits remain one of the best ways to safeguard your financial and personal information.
