Thank you for the response Karl.  The concern I had was not whether our clients would misuse the EFIN, but rather whether they have lax controls on their own files (eg a weak password on their dropbox or Google Drive).  But a larger issue may be if they discontinue using my firm and choose to have another accountant (or friend) do their taxes in the future, they will likely share the 8879 along with the rest of the tax return, and thus the EFIN gets exposed further.  Or worse, the new accountant may use my EFIN.

Agree that we can check the EFIN on our IRS account, but would be better if IRS would send an email each time a return is filed with an EFIN so that we can more proactively react to filings real-time instead of having to constantly check the site and add up number of filings and confirm if any extras were filed that we did not authorize.

Just trying to think of different ways to avoid extra work... Thanks again,