ITINs and SSNs: two numbers offices forget they hold

Ask a tax preparer where they store Social Security numbers and the answer is usually "in the tax software". That answer is rarely complete. The numbers also live in last year's organizer spreadsheet, in an email attachment that was saved to the desktop, in a scanned W-2 someone named "scan001", and in a folder of prior-year client packets that nobody has opened in a while. ITINs travel the same routes and are even easier to overlook, because many offices think of them as a special case rather than as the same kind of risk.

What an ITIN is

An Individual Taxpayer Identification Number, or ITIN, is a tax processing number issued by the IRS. It is for people who have a US tax filing or reporting requirement but are not eligible for a Social Security number. Examples include some nonresident and resident aliens, and their spouses or dependents. It is used only for federal tax purposes; it does not authorize work in the US or change immigration status. The IRS explains the details at irs.gov.

An ITIN has nine digits and is written in the same layout as an SSN: three digits, two digits, four digits. ITINs begin with the digit 9. That is why a scanner can treat the two as related patterns, and why to a person skimming a document they look almost identical.

Why tax and accounting offices hold them

If you prepare returns, you need the taxpayer identification number for the filer, the spouse and every dependent. For a client without an SSN, that means an ITIN. So the firms that serve immigrant communities, international students, foreign investors, or families with mixed status will hold a good number of them. Bookkeepers and payroll providers hold SSNs for the same reason: employees and contractors need to be identified on year-end forms.

That makes these numbers part of your business, not a mistake. The problem is not that you hold them; it is holding them in places you have not accounted for. The FTC Safeguards Rule (16 CFR Part 314) applies to tax preparers and many accounting firms, and it asks you to identify and manage the data, personnel, devices, systems and facilities involved. You cannot manage what you do not know is there.

What the formats look like

Both numbers show up written in two common ways:

• With dashes: 9xx-xx-1234 for an ITIN or xxx-xx-1234 for an SSN, where the x characters stand for digits not shown here.
• Without dashes: nine digits run together, for example 9xxxx1234. This is common in exports from software, CSV files and payroll systems.

Spaces instead of dashes also turn up. MyVaultMate detects SSNs and ITINs by pattern, and the report shows only a short redacted sample such as ***-**-1234, never the full value. MyVaultMate flags the dashed form anywhere. A nine-digit number without dashes is flagged only when it sits right after an “SSN” or “Social Security” label, so a column of bare numbers in an export is worth checking by hand.

Where to look in your own office

1. Organizer and intake spreadsheets. Often one row per client with an SSN or ITIN column, copied forward each year.
2. Prior-year packets. PDFs of filed returns and supporting documents, sometimes sitting on a laptop long after the engagement ended.
3. Email saved as files. A saved .eml message from a client who typed out a list of dependents and their numbers.
4. Synced folders. A OneDrive or Google Drive folder synced to a personal laptop or home computer.
5. USB drives and external disks. The "backup" a staff member made before a software migration.

MyVaultMate scans local drives, synced OneDrive and Google Drive folders and external or USB disks. It reads Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files. It does not read pictures, videos or recordings, or scanned PDFs such as a scanned W-2: they're listed with a risk score of 70, and you choose what to do with them. RTF and PowerPoint files, Outlook .pst data files and zip archives are listed the same way, so look at those by hand.

What to do with what you find

Start with the files where the count of distinct values is highest and the location is least controlled: a desktop, a downloads folder, a shared drive open to everyone. Decide whether the file still needs to exist, and if so, whether it belongs in your tax software or an encrypted location instead. Moving, encrypting or deleting is done by you or your IT provider, not by the product. Retention rules for tax records are specific, so check them with your advisor before you delete anything. General education only; your attorney or advisor can speak to your situation. You can see what a ranked report looks like at /sample.