Answering "Is my return done?" calls safely: identity checks by phone

A tax office can answer "Is my return done?" calls safely if the caller proves who they are before hearing anything. A practical check is a one-time code texted to the phone they are calling from, plus their date of birth. After that, a phone agent may share status, missing documents and payments received, never balances due or document contents.

Last verified: October 24, 2026. Primary sources: IRS Publication 4557, Safeguarding Taxpayer Data, IRS, Where's My Refund, IRS FS-2017-7, How to know it's really the IRS calling, and the FCC guide to unwanted robocalls and texts.

Why status calls are a security question

Status calls are the most routine call a tax office gets, which is exactly why they are risky. The person at the front desk wants to be helpful, the caller sounds like the client, and the answer seems harmless: "Yes, we sent it Tuesday." But that answer confirms that this person is your client, that you prepared their return, and when. Add "your refund is about four thousand" and you have disclosed tax information to someone you have not identified.

IRS Publication 4557 is blunt about the stakes. Under the FTC Safeguards Rule, tax return preparers count as financial institutions and must have a written information security plan to protect client data. Your phone line is part of that plan whether a person or a machine answers it. The question is the same either way: how do you know who is on the line?

What makes a phone identity check strong enough

Most offices verify callers with something the caller knows: date of birth, last four digits of the SSN, the address on file. The trouble is that those facts are exactly what data breaches expose. Anyone holding a stolen record can answer them.

Publication 4557 describes multi-factor authentication for access to client data as using at least two kinds of factor: something you know (like a password), something you have (like a token), and something you are (like a fingerprint). A phone check can borrow the same idea without pretending to be a login system:

Check	Kind of factor	What it stops
A one-time code texted to the number the caller is using, read back on the call	Something they have: the phone	A caller who fakes the client's caller ID: the code goes to the real phone behind that number, not to the impostor
Date of birth	Something they know	A caller who borrowed or picked up the client's phone but does not know the client's details

Neither check is perfect alone. Together they make a casual or opportunistic disclosure much less likely, and they work the same way at 2 p.m. with a busy front desk as at 9 p.m. with nobody in the office. That consistency is the real gain: the check does not get skipped because a caller sounds friendly or impatient.

Notice what the check does not ask for: no Social Security number, no account numbers. The FCC tells consumers never to share account numbers, Social Security numbers, passwords or PINs over the phone. A process that asks for them trains your clients to ignore good advice.

What a phone agent may say after the check

The XyloDocs AI receptionist uses exactly this check: a code texted to the calling number plus the caller's date of birth. Only after both pass does it answer status questions, and even then it sticks to a short list.

May say after the check	Never says, on any call
Where the return stands in your office's process	A balance due or an amount owed
Which documents are still missing	The contents of any document, read aloud
Which payments have been received	Tax advice, or what an IRS letter means
Which documents are waiting for a signature	Anything at all before the check passes

Each "may say" item comes with a next step the receptionist can take on the same call. A missing document gets an upload link by text. A document waiting for signature gets a signature link. A client who wants to pay gets a payment link. The caller leaves the call with something to do, which is why status calls stop coming back the next day.

Why never a balance due

Amounts owed are where misunderstandings cost the most and where scammers do their best work. The IRS says it does not call to demand immediate payment with a prepaid debit card, gift card or wire transfer, and generally mails a bill first. Clients who have heard that warning are right to be wary of any caller, or any call, that leads with a dollar figure. Keeping amounts out of automated calls entirely means a client never has to wonder whether a call about money was really from you. Payments received can be confirmed; what is owed is a conversation with your staff.

Why never read a document aloud

A W-2 read over a speakerphone is a disclosure to everyone in the room. A link to the portal is not. The receptionist can say "your 1099 from the bank is still missing" without reading a single number.

When the check fails, or the call is about IRS refund status

If a caller cannot receive the code or gets the date of birth wrong, the receptionist gives no status. It offers what any careful front desk would: take a message for the preparer, or transfer the call. Your staff can then call the client back on the number in the client's file. That is the same move the FCC recommends to consumers in reverse: when in doubt, end the call and call back on a number you already trust.

Some callers really mean "where is my refund from the IRS?" Your office's status tells them where the return is in your process. Once the IRS has the return, the IRS's own Where's My Refund tool takes over. According to the IRS, status is available 24 hours after a current-year return is e-filed, 3 days after a prior-year return is e-filed, and 4 weeks after a paper return is mailed. Checking without signing in needs the exact refund amount, the SSN or ITIN, the filing status and the tax year, so it is worth telling clients to keep their copy of the return handy.

Write the process down

Whether a person or an AI receptionist answers your phone, put the identity check in your written information security plan. Publication 4557 says the plan should cover how you select service providers that can maintain appropriate safeguards, and an AI receptionist is a service provider like your phone carrier. It uses outside AI and voice services to understand and answer callers. Our Privacy Policy explains how we handle personal information.

Documents are a separate matter. Documents your clients upload through the links the receptionist texts are read by private AI that runs on XyloDocs's own servers or on hardware in your own office, never sent to an outside AI company, never sold, and never used to train AI models. The security page has the details, the AI receptionist page lists everything the receptionist does, and voice rates are on the pricing page. Each feature, including status checks, has an on/off switch for your office.

Frequently asked questions

Is date of birth alone enough to verify a caller?

It is a weak check on its own, because birth dates appear in many data breaches and public records. Pairing it with something the caller has, such as a one-time code texted to their phone, makes a casual disclosure much less likely. IRS Publication 4557 describes the same two-kinds-of-factor idea for multi-factor authentication when people access client data on your systems.

Should a phone agent ever ask for a Social Security number?

For a status call, there is no need. The FCC tells consumers never to share Social Security numbers, account numbers, passwords or PINs over the phone, and a tax office that asks for them on routine calls teaches clients to ignore that advice. New-client intake is different: the caller is giving information to open a file, not proving identity to hear it.

Can the receptionist tell a client their refund amount?

No. After the identity check it can say where the return stands in your office, which documents are missing or waiting for signature, and which payments you have received. It never states a balance due and never reads a document aloud. For the IRS's side, clients can use Where's My Refund, which needs the exact refund amount from their return.

What happens if a caller fails the identity check?

The receptionist gives no status at all. It offers to take a message for the preparer or to transfer the call to your office. The message appears on the Calls page, and your staff can call the client back on the phone number already in the client's file, which is the safest way to confirm who they are talking to.