Security and social engineering for tax firms
Plain-language guidance for tax and accounting firms on phishing, impersonation and data theft: how the scams work, how to check a request, and what to do if one gets through.
Most attacks on a tax practice do not start with a clever piece of code. They start with a person being talked into something: opening an attachment from a "new client", typing a password into a fake sign-in page, or sending a list of W-2s to someone who only looks like the boss. The IRS says data thefts at tax professionals' offices are on the rise, and that identity thieves now target tax practitioners directly, because the data a firm holds is exactly what they need to file fraudulent returns.
This section is written for everyone at a firm, from partners to seasonal staff, and one page is written for you to share with your clients.
The pages
| Page | What it covers |
|---|---|
| Social engineering at a tax firm | The tricks criminals use on tax firms, the red flags, and what to do when you spot one. |
| Verifying a request | The one habit that stops most of these scams: confirm through a channel you already trust. |
| For your clients | A page to share with clients: what a firm will and will not ask for, sending documents safely, and how the IRS really contacts people. |
| If something went wrong | A first-hour checklist: contain it, secure accounts, keep evidence, and report it to the IRS and others. |
| Security basics for a firm | Multi-factor authentication, the IRS "Security Six", devices and email, staff training and least privilege. |
For how Journey itself handles sign-in, multi-factor authentication and keeping each firm's data separate, see Account & security.
A note on the law
Several of these pages mention legal duties, such as the Federal Trade Commission's Safeguards Rule and state breach notification laws. We summarize what the IRS and the FTC publish, and link to their pages so you can read the source. This is general information, not legal advice. Rules differ by state and by the size and nature of a practice, so talk to a qualified attorney about what applies to your firm.
Sources
- IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf