Email security for accounting firms: the threats and what to do

An accounting firm's email holds everything an identity thief wants: W-2s, prior-year returns, bank statements, payroll files and scanned IDs. Many firms also pay bills or run payroll for clients, so a fake email can move real money. This guide covers the email threats specific to CPA, tax and bookkeeping firms, how they show up in a typical workweek, and what to do before and after an incident.

It doesn't repeat the IRS rulebook. For the safeguards IRS Publication 4557 expects, read IRS Publication 4557 and email security. For the legal requirements, read the FTC Safeguards Rule and email security. This is general information, not legal advice.

Why are accounting firms targeted by email attacks?

Accounting firms are targeted because one mailbox can contain hundreds of clients' identities and bank details, and many firms can also send money on clients' behalf. Criminals use the data to file fraudulent returns or open accounts, and use the payment access to redirect funds.

The IRS and its Security Summit partners repeat this warning every year. In August 2026 they told tax professionals that spear phishing "targets a specific person or firm and delivers a more realistic email known as a lure," and that these scams are harder to spot because they don't arrive in large numbers (IR-2026-85). The 2026 Dirty Dozen list says "tax professionals and businesses remain targets of 'new client' or 'document request' emails" that deliver malicious links or attachments to steal client data or access systems (IR-2026-30).

Firms also face rules that turn an email incident into a reporting event. Paid tax preparers are treated as financial institutions under the FTC Safeguards Rule (16 CFR Part 314), and a firm that handles a healthcare client's records may be a HIPAA business associate.

What email threats do accounting firms see?

Accounting firms see general phishing plus lures built around client intake, document exchange and payments. The table lists the common ones and the safe check for each.

Spear phishing means a targeted phishing email written for one person or firm. Thread hijacking means a criminal replies inside a real conversation from a compromised mailbox.

The new client and document request lure

The new client scam works because answering prospects is part of the job. IR-2026-85 describes it simply: "New client scams target tax pros with emails from senders who pretend to be potential clients." The attachment or link is the payload. Here is an example to treat with suspicion:

Example: "Hello, I was referred by a friend and need help with my 2025 return, which is a bit complicated this year. My W-2 and last year's return are in the secure link below. Please let me know your fee. Thanks, Daniel."

The same release lists warning signs, including "an unexpected email or text claiming to come from a known or trusted source," a duplicate message from a trusted sender with a new attachment or link, an urgent password-expiration notice, and an address with a slightly different domain, "such as irs.com instead of IRS.gov." For attachments to block, see dangerous email attachment types and PDF phishing attachments.

When the client's own mailbox is the attacker

A message from a client's genuine address isn't automatically safe. The IRS warns that "by gaining access to a hacked email account, scammers can locate a genuine email" sent from a previous victim to their tax professional, and reuse it (IR-2026-30). That email passes SPF, DKIM and DMARC because it really came from the client's account. The only reliable check is a phone call. See email thread hijacking.

Payment fraud on clients' books

If your firm pays bills or runs payroll for clients, you're the person a BEC criminal needs to convince. Business email compromise (BEC) is fraud where someone impersonates or takes over a trusted email account to redirect a payment. The FBI's IC3 counted $55,499,915,582 in exposed BEC losses worldwide between October 2013 and December 2023, and its first protective tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). Our guides to vendor invoice fraud and payroll diversion give the call-back routines. During W-2 season, also read W-2 phishing scams.

Your firm's mailbox used against your clients

When a firm mailbox is taken over, attackers often use it to phish your clients, because clients expect documents and payment requests from you. Publication 4557 lists "tax professionals or clients responding to emails that practitioner did not send" as a sign of data theft (IRS Publication 4557). If a client asks about an email you didn't send, treat it as an incident. Our guide to signs your email account is compromised lists the other clues, and malicious inbox rules shows how attackers hide.

Can an accounting firm be a HIPAA business associate?

Yes. A firm that receives protected health information from a healthcare client, such as patient details in billing or financial records, can be a HIPAA business associate with its own Security Rule duties. In August 2025, HHS's Office for Civil Rights announced a settlement with BST & Co. CPAs, LLP, a New York accounting and advisory firm that it described as a business associate receiving "financial information that also contains protected health information" from a covered entity client. BST had found ransomware on part of its network in December 2019, affecting that client's PHI. OCR found no accurate and thorough risk analysis, and BST paid $175,000 and agreed to a two-year corrective action plan (HHS OCR).

If you have medical or dental clients, ask counsel whether you need a business associate agreement and include those records in your risk analysis. Our HIPAA email security requirements guide explains the rule.

How should an accounting firm exchange documents with clients?

Use one secure channel, such as a client portal, for every document that contains personal or financial information, and tell clients that's the only way your firm sends or asks for files. Publication 4557 says to send only password-protected and encrypted documents if you must share files with clients by email, or use secure file transfer. A single channel also makes phishing easier to spot: a "document from your accountant" that arrives any other way is suspicious by definition.

Tell clients three things in your engagement letter and on your website:

1. How you'll send and request documents (for example, "only through our portal").
2. That you'll never change your own bank details by email.
3. Who to call if they receive an email from you that seems unusual.

For the encryption options, see email encryption types for business.

What should an accounting firm do after an email breach?

Act quickly and follow a set order. The IRS's data theft page for tax professionals lists who to contact. Combine it with your mailbox clean-up:

1. Contain the mailbox. Reset the password, sign out all sessions, check MFA methods and remove forwarding or inbox rules you didn't create. See what to do after clicking a phishing link.
2. Report to the IRS. "Report client data theft to your local IRS stakeholder liaison."
3. Report to the states. Use the Federation of Tax Administrators' Report a Data Breach page for state tax agency contacts, and check whether you must notify the attorney general in each state where you prepare returns.
4. Report to the FTC if required. The IRS page says to file with the FTC if 500 or more people are affected. The Safeguards Rule sets the details; see our Safeguards Rule guide.
5. Bring in help. Call a security expert to find the cause and scope, and your insurer to check what the policy covers.
6. Tell law enforcement. The IRS lists your local FBI office and police. For payment fraud, also file at ic3.gov.
7. Warn clients whose data or mail was exposed, and tell them how to recognize follow-up scams. If the firm is a business associate, follow your HIPAA breach procedure too.

Is Microsoft 365 or Google Workspace security enough for an accounting firm?

For many small firms, Microsoft 365 or Google Workspace set up properly is a reasonable baseline: both filter spam and malware and support MFA and external sender warnings. Review Microsoft 365 preset security policies or Google Workspace advanced phishing and malware protection first.

An MX-level filter adds a checkpoint before mail reaches staff. MX-level filtering means your domain's MX records point to a filtering service that checks mail before your platform delivers it. It helps when seasonal staff need a simple way to find a held client document (each person gets a quarantine digest), when you want to block risky attachment types and Office macros without writing rules, and when you want mail held for up to 5 days if your server is down in April. It doesn't replace MFA, your WISP or a call-back rule. Our accounting firms page explains how iBlockSpam fits.

Accounting firm email security checklist

1. Turn on MFA for every mailbox, tax software, portal and payroll login, including seasonal staff.
2. Give each person their own account and disable seasonal accounts when the season ends.
3. Accept first documents from new clients only through your portal, after a phone call.
4. Write a payment change rule for every client whose bills or payroll you handle: phone call plus a second approver.
5. Publish SPF, DKIM and DMARC so criminals can't easily send mail as your exact domain; check with the DMARC Checker.
6. Watch for lookalikes of your domain with the Lookalike Domain Generator.
7. Review inbox rules and external forwarding each quarter and before filing season.
8. Train staff on new client lures, hijacked client threads and IRS impersonation before each season.
9. Put the IRS reporting steps above into your WISP's incident response section.
10. If you have healthcare clients, settle the business associate question with counsel.

Next steps

• Run the free Email Health Check on your firm's domain to see your MX, SPF and DMARC setup.
• Add your document and payment rules to your engagement letter before the next filing season.
• Read IRS Publication 4557 and email security to map these steps into your WISP.
• If you want an inbound filtering layer that seasonal staff can manage from a digest email, see email protection for accounting firms. Pricing is per domain, so adding staff in tax season doesn't change it.

More threat guides are in our phishing and threats topic.