Secure 1099 Filing: A Data Protection Checklist for Payers

Secure 1099 filing means protecting recipient data at every step: collecting the W-9, storing the TIN, transmitting returns to the IRS, and delivering copies to recipients. A 1099 file holds names, addresses and Social Security numbers or EINs. That is exactly what criminals want. This guide covers where the risks sit, what the IRS and FTC expect, and a checklist you can apply before the next filing season.

TL;DR

• Every W-9 and 1099 record holds a TIN. Treat the whole workflow as sensitive: intake, storage, transmission and delivery.
• Tax professionals must keep a written information security plan (WISP) under the FTC Safeguards Rule. Businesses that are not tax preparers should still follow the same basics.
• Use multi-factor authentication, encrypted transfer and encrypted delivery. Do not send W-9s or recipient copies as plain email attachments.
• Verify names and TINs before filing. Mismatches cause CP2100 notices and can trigger backup withholding.
• The IRS is moving information returns to IRIS. Plan for it now, and confirm the system you use transmits securely.

If you would rather not do this on paper, e-file Form 1099-NEC online with TaxFormHero instead.

Why 1099 data is a target

A W-9 is a complete identity package. It lists a legal name, a business name, an address and a taxpayer identification number (TIN), and it is signed. A payer with 40 contractors holds 40 of them. A bookkeeping firm holds hundreds across its clients.

The IRS says plainly that tax practitioners remain high-value targets of cybercriminals who steal tax data so they can file fraudulent returns. Small payers are not exempt. A spreadsheet of contractor TINs on a shared drive, or a thread of W-9 attachments in a mailbox, is an easy target.

The usual weak points are:

• Intake. Contractors email W-9s as attachments, text photos of them, or send them through unprotected links.
• Storage. Files sit in email, downloads folders and shared spreadsheets with no access controls.
• Accounts. One shared login, or a password with no second factor.
• Delivery. Recipient copies go out as plain email attachments or are mailed to outdated addresses.
• People. Phishing emails that imitate the IRS, e-Services or a software vendor. IRS Publication 4557 lists learning to recognize these emails among the basic security steps for tax professionals.

What the rules require

Written security plan

Under the FTC Safeguards Rule, professional tax preparers must maintain a written, accessible information security plan. The IRS checklist says the plan includes a designated oversight employee, risk assessments and regular testing of security controls. Failing to keep one can lead to FTC investigations and penalties.

The same IRS guidance says a WISP is not a set-and-forget document. Review it when your firm grows, adds software, or faces new threats such as spear phishing and ransomware.

If you are a business that only issues 1099s to a handful of contractors, the Safeguards Rule may not apply to you in the same way. The plan structure is still a good template: name an owner, list where TINs live, and write down who may access them.

Multi-factor authentication

The FTC has pointed to weak authentication as a high-risk failure. In its complaint against TaxSlayer, it described attacks that reuse stolen credentials. Passwords alone are not enough. Turn on multi-factor authentication for every account that touches recipient data: your e-filing platform, email, cloud storage and accounting software.

Electronic filing is not optional at volume

Security and compliance overlap here. The IRS says that if you file 10 or more information returns in aggregate, you must file electronically unless the IRS grants a waiver. Failing to e-file when required can lead to failure-to-file penalties. Electronic transmission is also generally safer than paper that passes through several hands. Note that W-2s go to the Social Security Administration, as the IRS e-file page explains, while most other information returns go through IRS systems.

The secure 1099 workflow, step by step

1. Collect W-9s through a protected channel

Do not ask contractors to email a W-9. Use a secure upload link or portal, and request the form before the first payment. Keep the signed W-9 as your record of the payee’s name and TIN.

TaxFormHero includes W-9 collection, so contractors submit their details to a platform instead of sending them through a general inbox.

2. Verify the name and TIN before you file

Security is also about accuracy. The IRS notes that the most common cause of information return errors is a mismatch between the reported name, name control and TIN. Publication 1099 covers the general instructions. Running a TIN check before submission is the cheapest way to avoid a notice later.

The consequences are concrete. When you receive a CP2100 or CP2100A notice of possible payee TIN discrepancy, you must track occurrences over three years. If you receive a second notice for the same payee in that period, Publication 2108 says you must begin backup withholding, even if the payee later provides a new W-9.

Our TIN matching page explains the check we offer, and the IRS TIN matching guide for tax professionals goes deeper on the program rules.

3. Confirm who must be reported

Security also means not collecting or filing more than you need. For payments made in 2026, the IRS lists the Form 1099-NEC reporting threshold as $2,000, up from $600. You must still file for anyone from whom you withheld federal income tax under backup withholding rules, whatever the amount. Our guide on paying someone with a 1099 walks through the threshold, and the tax year 2026 changes page summarizes what is new.

4. Enter or import data without leaving copies around

Bulk imports are efficient, but they create files. If you prepare an Excel or CSV template with hundreds of TINs:

• Save it in an access-controlled folder, not a downloads folder.
• Delete local copies after the import is confirmed.
• Do not email the template to a colleague. Share it through the same protected storage.
• Check that column headers and TIN formats are right before upload so you do not need to re-export corrected data.

For field-by-field accuracy, see the box-by-box guide to completing Form 1099-NEC.

5. Transmit to the IRS through a supported channel

The IRS is retiring the FIRE system. According to the IRIS working group Q&A of January 14, 2026, the IRS is targeting the end of December 2026 for retirement, after which IRIS is the only intake system for FIRE-related forms. IRS Topic 801 says filing season 2027 is when IRIS becomes the sole intake system, and it encourages filers to get a Transmitter Control Code (TCC) early because processing can take up to 45 business days.

Two details are worth knowing:

• The IRIS Taxpayer Portal has no test environment. Testing is available only through the Application-to-Application (A2A) channel, which needs its own TCC application and technical certification, per the same IRS Q&A.
• In the A2A XML schema, the combined federal/state filing indicator must be set to false if none of the states on a form participate in the program, even when the transmitter generally does. A wrong flag can cause rejections or missed state filings.

If you file through software, ask which channel it uses. TaxFormHero transmits federal returns to the IRS through IRIS A2A, so you do not have to build or certify your own connection.

6. Deliver recipient copies securely

Recipients need their copies by the deadline. Form 1099-NEC is due on or before January 31 for both the IRS and the recipient. Copies carry the full information the recipient needs, and in some cases a full TIN, so the delivery method matters.

Two safer options:

• Encrypted email delivery. The recipient receives a secure message instead of an open attachment. On TaxFormHero this add-on costs $0.19 per form.
• USPS First-Class Mail. For recipients who prefer paper or have not consented to electronic delivery. Print and mail costs $1.69 per form on our platform.

Recipients can also download their PDF copy at no charge.

A practical security checklist

Use this as a starting point for your WISP or internal policy.

How to evaluate a filing platform’s security

Whatever you use, ask a vendor these questions in writing:

1. Is the provider authorized by the IRS to transmit information returns? Ask for the channel it uses.
2. Is there an independent security attestation? A SOC 2 report is one common answer. Know the type: Type I describes the design of controls at a point in time, while Type II covers how they operated over a period. Ask which one the vendor holds.
3. Is data encrypted in transit and at rest? Ask for the specific standard.
4. Does it support MFA? If not, that is a red flag.
5. How are printing and mailing handled? Ask whether the print vendor is audited.
6. Who can see your data? Look for role-based access if several staff or clients are involved.
7. Can you manage multiple payer accounts separately? Accounting and bookkeeping firms need clean separation between clients.

Our perspective

We built TaxFormHero around one idea: compliance should be done right, and that includes how the data is handled. Most 1099 problems we see are not exotic hacks. They are a W-9 sent in a plain email, a spreadsheet with TINs that nobody owns, or a recipient copy sent without protection.

So we treat security and accuracy as one workflow. Tax Form Hero LLC holds a SOC 2 Type I attestation, data on the platform is protected with 256-bit encryption, and recipient copies can go out by encrypted email or USPS First-Class Mail. The print and delivery services are independently audited. We transmit federal returns through IRIS A2A, and we offer TIN matching at $0.49 per verification because a returned notice costs more than the check.

We will also be direct about what a platform cannot do. It cannot write your WISP, turn on MFA in your email, or stop someone in your office from forwarding a W-9. Those controls belong to you. Pick the tool that does its part, then close the gaps on your side.

— Nazrul

Where TaxFormHero fits

If you are ready to prepare returns, TaxFormHero is pay-per-form with no subscription, signup fee or annual contract. For 1099 forms the first 150 cost $1.99 each, forms 151 to 500 cost $0.99 each, forms 501 to 1,000 cost $0.60 each, and forms above 1,000 cost $0.45 each. Each tier applies only to the forms within it. Add-ons such as state filing ($0.99), e-delivery ($0.19), print and mail ($1.69) and TIN checks ($0.49) are priced per form. See the full pricing page, or go straight to 1099-NEC filing. Firms with large volumes can look at enterprise information return filing.

Common mistakes to avoid

• Waiting until January. TCC processing can take up to 45 business days, and W-9 gaps take time to chase. Start in the fall.
• Skipping TIN checks for “known” contractors. Names change, typos happen, and a long-standing vendor can still trigger a CP2100.
• Ignoring the notice clock. The three-year tracking rule for CP2100 notices needs a record. Keep one per payee.
• Keeping everything forever. Retain what the law and your policy require, and set a deletion date for the rest.
• Mixing clients. Firms that file for several payers should keep each payer’s data and access separate.
• Assuming a test mode exists. The IRIS Taxpayer Portal has none, so verify your data before submission.

Industry-specific situations follow the same pattern. If you pay single-member LLCs, subcontractors, consultants or franchisees, the W-9 and TIN handling is the same. Contractors in trades often change business names or entity types, which makes name and TIN verification more important.

FAQ

Is it safe to email a W-9?

It is risky. An email attachment sits in two or more mailboxes and may sync to devices you do not control. Ask contractors to use a secure upload link or portal instead, and limit who can open the stored form. If a W-9 does arrive by email, move it to protected storage and delete the message.

Do I need a written information security plan if I only issue a few 1099s?

The FTC Safeguards Rule requirement applies to professional tax preparers, per the IRS checklist cited above. A small business that is not a tax preparer should check with a tax professional or attorney about its own obligations. A short written policy naming who handles TINs, where they are stored and how they are deleted is still sensible.

What happens if the name and TIN on a 1099 do not match IRS records?

The IRS may send you a CP2100 or CP2100A notice. You then request a corrected W-9 and track the notice. If you get a second notice for the same payee within three years, backup withholding must begin under IRS Publication 2108. Matching names and TINs before you file reduces the chance of this.

Is electronic filing more secure than paper?

Used correctly, generally yes, because data moves through an authenticated channel instead of the mail and multiple hands. It is also required if you file 10 or more information returns in aggregate, unless the IRS grants a waiver. Security still depends on your own account controls, such as MFA and individual logins.

What is IRIS and why does it matter for 1099 filers?

IRIS is the IRS Information Returns Intake System. The IRS is retiring FIRE and plans for IRIS to be the sole intake system for these returns beginning with filing season 2027. If you file through software, confirm that your provider supports the IRIS channel so you are not caught by the change.

Sources

• IRS: Am I required to file a Form 1099 or other information return?
• IRS: Electronic filers
• IRS: E-file information returns
• IRS: Tax Security 2.0, The Taxes-Security-Together Checklist
• IRS Publication 4557
• IRS Publication 1099 (2026)
• IRS Publication 2108
• IRS: Topic no. 801, IRIS
• IRS: IRIS Working Group Q&A, January 14, 2026
• IRS: Instructions for Forms 1099-MISC and 1099-NEC
• FTC: TaxSlayer complaint

Recommended

• The 1099 Compliance Checklist Every Business Needs
• Avoid 1099 Rejections: 8 Compliance Checks for U.S. E Filing Software
• Avoid 1099 Penalties: E Filing for Small Businesses & Tax Pros
• 1099 Electronic Delivery: Consent, Proof, and the Audit Trail