Improving myIR security campaign continues

Inland Revenue (IR) will continue to call people about updating and improving security in their myIR accounts even with feedback from some customers that the calls feel like a scam.

Inland Revenue started calling customers about two-step verification (2SV) near the end of January. As at the end of February, calls were made to nearly 47,000 people and almost 10,000 people had set up 2SV as a result. 

2SV is used to better protect their information held in myIR. Once they have it set up, they’ll be asked to provide a unique security code to verify their identity each time they log in.

Two-step verification is currently optional but will become compulsory for all myIR accounts in a phased roll out throughout the year, starting from 22 April 2025.  

Inland Revenue Deputy Commissioner James Grayson says many people are worried about scam calls and concerned about online security, so it’s been good to see they’re cautious when we’ve called.  

“Some people have questioned our caller’s identity, concerned that they were being hustled by fraudsters. It’s good they’re being vigilant”, James Grayson says.  

“From now on, before we call, we’ll send a secure message to customers via their myIR accounts explaining how to set up 2SV. And we will only call customers who have not set up 2SV after they received the message.  

“We’re keen to talk to people who may not have had much recent contact with Inland Revenue, or who may only look at their myIR once a year, so they know about the improved security two-step verification brings.  

When IR calls

“It’s always good to be cautious of a call from an unknown number and there are ways to verify it is Inland Revenue calling including cross-checking the number displayed on someone’s phone against the numbers published on our website (When we call you). 

“People can also either request that IR send a web message to their secure myIR account to verify that it is IR calling or they can call IR back on 0800 775 247.  

“When we call, we won’t ask people to click on a link to get to their accounts to make the necessary 2SV changes. We’re also not asking for personal information such as credit card or bank account details and we won’t be asking people to pay anything.  

“We won’t use intimidating language or threaten sudden arrest or pressure anyone to act immediately, without warning. We will never ask for passwords”, James Grayson says. 

Self-help 2SV set up

If a customer wants to set up 2SV themselves, they can do this in their myIR account by heading to the ‘Manage my profile’ screen, then: 

• Change two-step settings 

• Set up an authenticator app’ and/or ‘Use email

• Save 

The calling campaign runs until the end of April this year.