Accounting and bookkeeping firms need email filtering that stops phishing, IRS impersonation and malicious attachments before staff see them, plus a habit of verifying any request to change bank details. iBlockSpam filters inbound mail at the MX level, in front of the platform you already use, and charges one price per domain.
Why accountants are a target
Tax professionals hold exactly what identity thieves want: Social Security numbers, income records, bank details and the means to file returns. IRS Publication 4557 warns that a thief may pose as your tax software provider, your data storage provider, the IRS or even a prospective client. It also notes that phishing emails usually have an urgent subject line meant to get you to open a link or attachment (IRS Publication 4557, Safeguarding Taxpayer Data).
The pressure peaks in tax season, when inboxes are full of genuine client documents and deadlines. In August 2026 the IRS and the Security Summit warned tax professionals again about phishing, spear phishing aimed at a specific firm, and cloned messages that swap a safe link or attachment for a malicious one (IRS IR-2026-85).
Scams accountants see most
| Scam | What it looks like | What stops it |
|---|---|---|
| IRS impersonation | "Update your e-Services account" with a link to a fake sign-in page | Filtering, and never signing in from an email link |
| New client lure | A "prospective client" sends tax documents as a link or attachment carrying malware | Attachment filtering, and contacting new clients by phone first |
| W-2 request | A spoofed executive asks payroll for every employee's Form W-2 | Spoofing protection, and verifying by phone or in person |
| Payroll or refund diversion | A message asks to change the bank account for a paycheck or refund | A call-back to a known number before any change |
The W-2 scheme is well documented. The IRS describes criminals who spoof an executive's email and ask payroll or HR staff for all employees' Forms W-2, and calls it a form of business email compromise (IRS: Form W-2/SSN data theft). The FBI has warned about payroll diversion, in which phished credentials are used to redirect direct deposits to a criminal's account (IC3 PSA I-091818-PSA).
What iBlockSpam does for a practice
Filtering before mail reaches your team
Your MX records point to our filtering servers. Mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to Microsoft 365, Google Workspace, Exchange Server or your hosted server. Advanced settings add:
- Attachment-type filters to hold or block risky file types.
- A Microsoft Office macro filter for documents that carry macros.
- Geographic filters and custom domain rules for patterns specific to your practice.
A quarantine your staff can use in March
Every user gets a personal quarantine and a digest email hourly, daily, on a chosen weekday or on a custom schedule. In busy weeks, an hourly digest means a held client message is never far away. An administrator can review everything in the shared quarantine. Approved and blocked sender lists can require sender verification, so a spoofed message claiming to be from an approved client still gets checked. See quarantine and digests.
Records and resilience
You can search 30 days of message history. If your mail server is down, mail is held for up to 5 days and then delivered. Domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus.
If your practice runs on Microsoft 365, see how a gateway compares with Defender for Office 365 before you decide.
Client attachments without the guesswork
Client documents arrive as PDFs, spreadsheets and scans, often from personal email accounts you've never seen before. That makes "the client sent it" a weak signal on its own. Attachment-type filters let you hold file types your clients never need to send, such as executables and script files, while normal PDFs and images pass through. The Office macro filter targets documents that contain macros, so a "spreadsheet" that runs code gets a second look. An attachment that passes the file-type check can still carry a QR code that leads to a fake sign-in page; our guide to QR code phishing explains what to watch for.
When a real client file is held, the user sees it in the next digest and can release it. If the same client's files are held repeatedly, add the client to the approved sender list with sender verification turned on, rather than turning the filter off for everyone. Firms that also do bookkeeping for property businesses may find our page for real estate and title teams useful, and practices that work alongside attorneys can compare notes with our page for law firms.
Where filtering fits in the FTC Safeguards Rule
The FTC's Safeguards Rule applies to "financial institutions" under its jurisdiction, and the FTC lists tax preparation firms among its examples. The rule requires a written information security program suited to the size of your business, a qualified individual to run it, multi-factor authentication for anyone accessing customer information, and security awareness training for staff (FTC: Safeguards Rule, What Your Business Needs to Know). Whether the rule applies to your firm depends on the activities you perform, not what you call yourself.
Email filtering can support parts of that program, such as reducing phishing exposure and keeping a 30-day message history. It isn't a program on its own, and iBlockSpam doesn't make any firm compliant. IRS Publication 4557 and the FTC's guide are good starting points for the written plan.
A short checklist for tax season
- Turn on multi-factor authentication for email, tax software and cloud storage.
- Never sign in from an email link. Type the address or use a bookmark.
- Phone new clients before opening their first attachment, as Publication 4557 suggests.
- Verify every bank account change by calling a number you already have. Our guide to vendor invoice fraud and payment redirection sets out a call-back process.
- Use a client portal or secure file transfer for tax documents instead of plain attachments.
- Report IRS-themed phishing to phishing@irs.gov (IRS: report phishing).
- If someone clicked, follow our guide on what to do after clicking a phishing link.
Priced per domain, not per preparer
| Item | Protect | Protect Plus |
|---|---|---|
| Billed annually | $12 per domain/month ($144/year) | $19 per domain/month ($228/year) |
| Month-to-month | $15 per domain/month | $24 per domain/month |
| Mailboxes | Unlimited (count, not volume) | Unlimited (count, not volume) |
| Inbound messages included | 100,000 per domain/month | 100,000 per domain/month |
| Domain monitoring | Weekly | Daily |
| Human setup session | No | Yes |
Prices are beta pricing in USD, excluding tax. Seasonal staff don't add cost. See pricing for details.
Honest limits
- No filter catches every phishing message, and sometimes a real client message is held. Digests help people find it quickly.
- A message from a client's real, compromised mailbox can pass authentication checks. Call-back verification is the defense for bank changes.
- iBlockSpam filters inbound mail. It doesn't encrypt outgoing email, protect your tax software logins or replace staff training.
- Mail is processed in the United States. iBlockSpam holds no SOC 2 or ISO certification.
Start with the free Email Health Check, then create your account.
Sources
- IRS Publication 4557: Safeguarding Taxpayer Data
- IRS IR-2026-85: Security Summit warns tax pros to watch out for phishing emails and other attacks
- IRS: Report fake IRS, Treasury or tax-related emails and messages
- IRS: Form W-2/SSN data theft, information for businesses and payroll service providers
- FBI IC3: Payroll diversion PSA (I-091818-PSA)
- FTC: Safeguards Rule, What Your Business Needs to Know
Frequently asked questions
Does iBlockSpam make us compliant with the FTC Safeguards Rule?
No. The Safeguards Rule requires a written information security program with specific elements, such as a qualified individual, risk assessment, multi-factor authentication and staff training. Email filtering can be one safeguard in that program. It doesn't create the program or make a firm compliant.
Does the IRS email tax professionals?
The IRS says it doesn't email or text people without their permission. Treat any unexpected message that claims to be from the IRS, especially one with a link to sign in, as suspect. Forward IRS-themed phishing to phishing@irs.gov, as the IRS asks.
Will filtering block legitimate client attachments?
It can sometimes hold one, especially if you turn on strict attachment-type or macro filters. Held messages go to the user's personal quarantine, and the digest email lets them release it. IRS Publication 4557 suggests secure file transfer instead of plain email attachments where you can.
What about requests to change a client's refund or payroll bank account?
Treat them as suspicious until verified. The FBI has warned about payroll diversion, where criminals phish credentials and change direct deposit details. Confirm any bank account change by calling the client or employee on a number you already have, not one in the message.
How much does it cost for a small practice?
Protect is $12 per domain per month billed annually ($144 a year) or $15 month-to-month (beta pricing), with unlimited mailboxes. Adding seasonal staff doesn't change the price. Each domain includes 100,000 inbound messages per month.
Related guides
How to stop vendor invoice fraud and payment redirection
How vendor invoice fraud and payment redirection scams work, the red flags, a call-back procedure for bank detail changes, and what to do if money was sent.
9 min read Phishing & threatsPayroll diversion scam emails: how to stop direct deposit fraud
How payroll diversion scams use fake 'change my direct deposit' emails to HR, the red flags to look for, and a verification procedure that keeps salaries safe.
9 min read Phishing & threatsWhat is email thread hijacking, and how do you spot it?
How attackers reply inside real email threads from a compromised partner mailbox, why SPF, DKIM and DMARC still pass, the red flags, and how to verify safely.
9 min readLast updated: