Security

Direct File was built atop information security foundations that the IRS has developed over

many years. These foundations paid off, as an attempted distributed denial of service (DDoS)

attack on April 15, 2024, was thwarted without any impact to taxpayers. Even as Direct File

leveraged these existing protections, the IRS went above and beyond what was required for

the system, implementing measures such as the use of stricter encryption methods of

taxpayer data.

Direct File joined the Security Summit public-private partnership and implemented all of the

Summit’s Trusted Customer protections, leveraging insights gained over more than two

decades of e-filing. The IRS has not identified new threats associated with Direct File, with the

system’s IAL2 identity verification, and its limited scope further reduced risk.

27