Tax-season phishing
Fake client documents, IRS notices and software updates sent during peak workload.
Accounting & Financial Services
Protect financial information and client confidence.
Security for CPA firms, bookkeepers and financial advisers who manage tax records, payroll data and access to client accounts.
Why it matters
Tax season is attack season.
Accounting firms handle Social Security numbers, bank details and tax filings for every client. Attackers time their phishing campaigns to the busiest weeks of the year, when staff are least likely to pause and check.
Many tax and accounting professionals are also subject to the FTC Safeguards Rule, which requires a written information security program, risk assessments, MFA and other safeguards. We help firms design and maintain those programs.
Operating risks
Risks CPA and accounting firms recognize
Payment redirection
Fraudulent requests to change bank details for refunds, payroll or vendor payments.
Account compromise
Stolen credentials used to access tax software, client portals and email.
Retention obligations
Records that must be kept for defined periods and disposed of securely afterward.
Prioritized solutions
Where we would start.
Priorities are confirmed during an initial assessment. This is the order we most often recommend for organizations like yours.
-
1
Governance, Risk & Compliance
Build and maintain a written information security program aligned with the Safeguards Rule.
-
2
Managed Microsoft 365
Enforce MFA, protect email and control how client files are shared.
-
3
Managed Detection & Response
Monitor for compromised accounts and malicious activity, especially during tax season.
-
4
Managed IT & Remote Support
Keep workstations patched, encrypted and managed through peak periods.
Microsoft 365 use cases
Microsoft 365, configured for CPA and accounting firms
Protected client file exchange
Secure sharing through SharePoint or a client portal instead of email attachments.
DLP for tax identifiers
Policies that detect Social Security and account numbers in outgoing email and shared files.
Retention for financial records
Purview retention policies aligned with your record-keeping obligations.
Improvement journey
A practical path, one step at a time.
- 01 · First
Confirm MFA on every system that holds client data, protect email and assign a qualified individual for the security program.
- 02 · Next
Complete a written risk assessment, apply DLP and retention, and formalize vendor oversight.
- 03 · Ongoing
Monitor accounts, test incident procedures and report to firm leadership each year.
Questions
Common questions
Does the FTC Safeguards Rule apply to us?
The Safeguards Rule applies to many non-bank financial institutions, which the FTC has said includes tax preparers and many accounting firms. Confirm your obligations with counsel. We can help you build the required program.
What is a written information security program?
It is a documented program describing how you protect customer information: who is responsible, what risks you have identified, which safeguards you use and how you test and update them.
Can you help before tax season?
Yes. We recommend completing identity and email hardening before peak season so changes do not disrupt staff during the busiest period.
Next step
Talk to us about security for CPA and accounting firms.
We will listen to how your organization works, explain the risks we see most often among CPA and accounting firms and recommend a proportionate first step.