Cybersecurity for accounting and tax firms: What the IRS expects

A tax office keeps the records an identity thief needs to file a fake return: Social Security numbers, bank accounts for refunds, W-2s, and last year's figures for every client. The Security Summit, the IRS's partnership with state tax agencies and the tax industry, says every tax professional is a potential target, right down to "an owner of a one-person storefront."

This guide explains what the IRS asks of tax and accounting firms and the everyday steps behind it. It isn't legal advice, so confirm what applies to your practice with the IRS and FTC pages linked here or with an advisor.

What does the IRS say tax preparers must do about security?

Have a written plan. In Publication 4557, Safeguarding Taxpayer Data, the IRS writes that "Protecting taxpayer data is the law" and that "According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data."

That rule comes from the Gramm-Leach-Bliley Act. The FTC's Safeguards Rule guide lists "tax preparation firms" among its examples of financial institutions and says your information security program "must be written." In August 2026 the IRS repeated the message: "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan to help protect client information from identity thieves and data breaches."

How the rule applies to your firm is a question for the FTC's guidance or an advisor. The IRS's expectation is clear enough to act on now: if your office has no written plan, put two hours on the calendar to start one.

How do I write a WISP for a small practice?

A written information security plan (WISP) describes how your office protects client data, who is in charge of it, and what happens when something goes wrong. The IRS gives you a template in Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice.

You don't need a binder. Publication 5708 says "There is no one-size-fits-all WISP" and that "a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." Its outline walks you through six parts:

1. State the plan's objectives, purpose and scope.
2. Name a qualified individual to coordinate security, and list who can reach which data.
3. Identify risks by listing the client information you handle and where it could be lost.
4. Inventory your hardware, with each device's location and what it stores.
5. Write down your safety measures, such as data retention, remote access and Wi-Fi rules.
6. Add an employee code of conduct and an implementation clause.

The FTC says the qualified individual "doesn't need a particular degree or title." In a two-person office, that's usually the owner. Publication 5708 also suggests having each person sign an acknowledgment that they've read the plan, and keeping a copy offsite or in the cloud.

A WISP is only useful if it matches what your office does. Use these steps as the safeguards your plan documents, then review it every year and after big changes like new tax software or a new hire.

How do scammers target tax offices during filing season?

Email is the main route. The IRS's August 2026 phishing warning calls phishing and related scams "among the most common threats facing tax pros." One version is built for small offices: the new client scam, where a sender poses as a prospective client and attaches "tax documents" that install malware when opened.

Filing season gives that scam cover, because real new clients are emailing you attachments and a message from a stranger looks routine in February. The IRS also describes clone phishing, where a scammer resends a copy of a legitimate email with the link or attachment swapped for a malicious one.

Warning signs from the IRS release:

• The email claims to come from a colleague, your bank, your cloud storage, your tax software provider or the IRS, and you weren't expecting it.
• It duplicates a message you already have, now with a new attachment or link.
• It pushes you to act fast, for example by saying your password has expired.
• The address or link is slightly off, "such as irs.com instead of IRS.gov."

Publication 4557 gives a simple rule for unknown senders: never open their attachments, "including potential clients; make contact first by phone." Make that an office policy before January, and have staff forward suspicious IRS-themed emails to phishing@irs.gov.

Should you email tax documents or use a client portal?

Use a portal for anything with a Social Security number on it. An email attachment sits in two inboxes, gets forwarded, and passes through servers you don't control. If either mailbox is ever taken over, every return in it goes with it.

Publication 4557 says to "Send only password-protected and encrypted documents if you must share files with clients via email," or to use secure file transfer instead. The sample policy in Publication 5708 says client data won't be emailed unprotected and that the password goes by "a method other than what is used to send the data," such as a phone call or text.

Your tax software or practice management tool may already include a portal, so check before you buy another. Then make it the default:

• Show new clients how to upload during onboarding, and tell them documents only come through the portal.
• Send portal notifications without attachments, so clients learn that a "your documents" email with a file attached didn't come from you.
• If a client insists on email, send an encrypted file and give them the password by phone.
• Delete old files from the portal on a schedule so it doesn't turn into a second, unmanaged archive.

Pick your portal for this season, and switch off any setting that attaches documents to notification emails.

See what clients and scammers see from the outside

Run a free check of your firm's website and email records, including SPF, DKIM and DMARC, and get plain-English fixes.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I protect tax software and e-Services logins?

Turn on multi-factor authentication (MFA) everywhere you can, starting with tax software. Publication 4557 notes that "Tax software products for both taxpayers and tax professionals now offer multi-factor authentication" and tells preparers to "Use the most secure option available," for tax software and also for email and storage accounts. The IRS's "Security Six" list describes MFA as "a requirement under Federal Trade Commission Safeguards Rule."

Separate logins come next. Publication 4557 says not to share passwords among employees and that "Each individual with access to client accounts should have a unique password." With one shared front-desk login, nobody can tell who did what, so give everyone their own account and a password manager.

Then watch for misuse of your credentials. Publication 4557 recommends checking weekly how many returns were filed under your Electronic Filing Identification Number (EFIN). In e-Services, open your EFIN application and select EFIN Status. If the total is higher than the returns you filed, contact the IRS e-help Desk.

This week, list every system that touches client data and write down whether MFA is on for each one.

How can clients tell your emails are really from you?

Publication 4557 warns that thieves may hijack an email account "to send spam emails under your name, tricking colleagues and clients into disclosing information." One of its listed signs of data theft is clients "responding to emails that practitioner did not send."

MFA protects your mailbox. Your domain needs its own protection: three DNS records called SPF, DKIM and DMARC. The FTC explains that without them, "scammers can use your domain name to send phishing emails that look like they're from your business." SPF lists the services allowed to send your mail, DKIM signs each message, and DMARC tells receiving providers what to do with mail that fails those checks.

Tax firms often have several tools sending mail as them. Your tax software, client portal, e-signature service and billing system may all send messages from your domain. Add each one to SPF and set up DKIM before you tighten DMARC. Otherwise portal notices start landing in spam. Begin with p=none, read the reports for a few weeks, then move to p=quarantine.

Set expectations with clients too. Publication 4557 says "A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service." Put a line in your engagement letter saying you won't ask for Social Security or bank numbers by email. It also tells preparers to educate clients about the Identity Protection PIN, a six-digit number that stops someone else from filing with their Social Security number. The IRS says it "will never ask for your IP PIN."

Check your domain with the free website security scan. If DMARC is missing, follow how to fix a missing DMARC policy.

What should you do if client data is stolen?

Report it quickly. Publication 4557 says tax practitioners should report data losses or thefts "immediately to the IRS so that appropriate precautions can be made to protect clients from fraudulent returns being filed in their names." Its signs of theft include e-filed returns rejecting because a client's Social Security number was already used, and clients who haven't filed yet receiving IRS identity verification letters.

The IRS lists who to contact:

• Call your local IRS Stakeholder Liaison, who takes reports from tax professionals.
• Notify each state where you prepare returns through the Federation of Tax Administrators' "Report a Data Breach" page.
• File a police report, and contact the FBI if the IRS directs you to.
• Bring in a security expert to find and stop the breach, and tell your insurance company.

For ransomware, Publication 4557 adds the FBI and CISA alongside the IRS. The FTC says covered financial institutions must also notify it no later than 30 days after discovering a breach involving at least 500 consumers' unencrypted information. State breach laws may apply as well, so put an advisor's number on the list.

Write these contacts into your WISP and keep a printed copy, since your email may be the thing that's compromised.

What should you do next?

Start with the steps that protect client data before the next filing season.

1. Download Publication 5708 and fill in the template, using the checklist above as your safeguards section.
2. Turn on MFA for tax software, e-Services and every mailbox, and give each person their own login.
3. Run the free website security scan to check your website and email records in one go. Our guide to SPF, DKIM and DMARC explains each result.
4. Use the cybersecurity risk assessment to fill in the risks section of your plan.