Tax season is open season for attackers. W-2 fraud, IRS impersonation, and client-data breaches hit accounting firms hardest between January and April — when your team is at maximum pressure.
Attackers impersonate partners or payroll clients via email to request bulk W-2 exports. In one documented case, a 12-person CPA firm lost 847 client W-2s in a single reply.
"IRS e-Services credential expiration" emails are sent at scale every January. They look identical to real IRS notices and harvest Secure Access credentials used to pull client transcripts.
Fake "urgent tax penalty" emails from spoofed client domains instruct accountants to wire funds immediately. Average loss for small CPA firms: $82,000 per incident.
IRS Publication 4557 requires all tax professionals to maintain a written information security plan (WISP) and train staff annually. The FTC Safeguards Rule (GLBA) mandates security awareness training for firms that handle client financial data. Non-compliance puts your PTIN and firm license at risk.
Take our free Phishing IQ Quiz to benchmark your team's awareness in 5 minutes — or book a 15-minute consult with one of our instructors.