Why this matters
Anyone can print "tax professional" on a business card. Verification takes fifteen minutes and is free, yet skipping it is how businesses end up with lapsed licensees or ghost preparers. You're handing over bank data, your EIN and SSN, and filings with penalty exposure, check first.
What "done" looks like
- CPA license confirmed active in CPAverify or the state board site, no disciplinary flags
- EA status confirmed in the IRS preparer directory
- Reviews and complaint history scanned
- Confirmed they sign returns as the paid preparer
How to do it
- Check CPAs on CPAverify.org for license status (active, lapsed, revoked) and disciplinary markers.
- Check EAs and CPAs in the IRS Directory of Federal Tax Return Preparers (irs.treasury.gov/rpo), it lists only credentialed preparers with an active PTIN.
- Check the state board of accountancy site for complaint or enforcement history if the state isn't covered.
- Read reviews with a filter: patterns about responsiveness and surprise billing matter more than star averages.
- Confirm they sign returns. Refusing to sign as paid preparer is the defining trait of a ghost preparer, walk away.
Common mistakes
- Trusting the framed certificate on the website instead of the live database
- Verifying the firm but not the individual who will handle your file
- Treating an "inactive" or lapsed license as a technicality, it means no current authority
Real-world examples
- CPAverify.org, hosted by NASBA, is populated directly by state boards of accountancy and includes disciplinary markers, free, no registration.
- The IRS directory lists only preparers with an active PTIN and a recognized credential (EA, CPA, attorney, or AFSP participant).
- The IRS issues recurring public warnings about ghost preparers each filing season, refusal to sign the return is the flagged behavior.
From a founder's point of view
Verification is asymmetric: fifteen free minutes against months of unwinding a bad hire. A legitimate professional expects to be looked up and hands over license numbers without friction, hesitation is itself the answer.
Rule of thumb
Look up every credential in the issuer's own database before signing anything. No database entry, no engagement.
