Right now, your office is buried in W-2s, 1099s, and client financial records. Your team is working overtime. Everyone’s stressed, moving fast, and trying to hit deadlines.

Cybercriminals know this. And they’re counting on it.

Tax season is the Super Bowl for hackers targeting accounting firms. The combination of exhausted staff, massive volumes of sensitive data, and tight deadlines creates the perfect storm. One wrong click on a phishing email, one compromised password, and suddenly you’re explaining to 200 clients why their Social Security numbers are for sale on the dark web.

If you run an accounting firm in Utah — whether you’re a solo CPA in Lehi or a 50-person firm in Salt Lake City — this is the most dangerous time of year for your business. Let’s talk about why, and what you can do about it.

Why Accounting Firms Are Irresistible Targets

Think about what sits on your servers and in your cloud apps right now: Social Security numbers, bank account details, income records, business financials, tax IDs. It’s everything a criminal needs to commit identity theft, file fraudulent tax returns, or drain bank accounts.

According to the IRS’s own Dirty Dozen list, tax preparer impersonation and client data theft are among the most pressing threats facing the industry. Fake W-2 forms, spoofed e-filing emails, and identity theft attempts now closely mimic legitimate communications — and AI is making them even harder to spot.

Here’s what makes 2026 different: AI-powered phishing has gone mainstream. Those obvious scam emails full of typos and broken English? They’ve been replaced by perfectly written, personalized messages that reference your actual clients and use context scraped from LinkedIn and public filings. A CPA Practice Advisor report found that deepfake audio, AI-crafted phishing, and fake tax portal websites are all surging this season.

The Attacks Your Firm Will Face This Season

Here’s what we’re seeing hit Utah professional services firms right now:

Client impersonation emails. An email that looks exactly like it’s from your client, asking you to update their bank account for their refund deposit. The email address is off by one character. Your overworked staff member processes it without a second look.

Fake tax software portals. Websites that perfectly mimic Intuit, Drake, or Thomson Reuters login pages. Your team member clicks a link in what looks like a routine software update notification. Now the attacker has their credentials — and access to every client file.

Ransomware timed to deadlines. Attackers encrypt your systems on April 10th. They know you can’t afford to be down for even a day with the filing deadline looming. The ransom demand? They know you’ll pay.

Credential stuffing attacks. Automated bots trying stolen username/password combinations against your client portal, email, and tax software. If anyone on your team reuses passwords — and statistically, they do — the attackers get in.

You’re Legally Required to Have a Security Plan (Most Firms Don’t)

Here’s something that surprises a lot of accounting firm owners: federal law requires you to have a Written Information Security Plan (WISP). This isn’t optional. It’s not a best practice. It’s the law.

The FTC Safeguards Rule explicitly lists tax preparation firms as “financial institutions” that must comply. The updated rule, which took full effect in 2023, requires you to:

  • Designate a qualified individual to oversee your security program
  • Conduct a written risk assessment of your systems and data
  • Implement specific safeguards including encryption, multi-factor authentication, and access controls
  • Monitor and test your security measures regularly
  • Create an incident response plan for when (not if) something goes wrong

The IRS reinforces this requirement through its Security Summit partnership, providing a WISP template specifically for tax professionals. Yet the IRS has noted that many small and mid-size firms still haven’t created one.

The penalty for non-compliance? The FTC can pursue enforcement actions with fines up to $100,000 per violation. And if you suffer a breach without a WISP in place, good luck explaining that to your state board, your insurance carrier, and your clients.

The Tax Season Security Checklist Your Firm Needs

You don’t need to overhaul everything overnight. But if you’re not doing these things right now, you’re playing Russian roulette with your clients’ data and your firm’s reputation.

Before April 15th — Do These Now

1. Turn on multi-factor authentication everywhere. Email, tax software, client portals, cloud storage — every system that touches client data. This single step blocks over 99% of credential-based attacks. No excuses.

2. Train your team on tax-season-specific phishing. Generic cybersecurity training isn’t enough. Your staff needs to know what a fake W-2 request looks like, how to verify client bank account changes by phone, and why they should never click links in “software update” emails.

3. Verify client requests through a second channel. Client emails you asking to change their bank account or sends a document you weren’t expecting? Call them. Use a phone number you already have on file, not one from the email. This 30-second step prevents the most common tax-season attack.

4. Lock down remote access. If your team works from home during tax season, make sure they’re connecting through a VPN or secure remote desktop — not accessing client files from their personal laptop over coffee shop WiFi.

5. Back up everything, and test your restores. Ransomware can’t hold you hostage if you can restore from a clean backup. But backups you’ve never tested are backups you can’t trust. Run a test restore this week.

Ongoing — Build These Habits

6. Review who has access to what. Does the receptionist need access to client tax returns? Does last year’s seasonal hire still have active credentials? Trim access to the minimum each person needs.

7. Keep software updated. Tax software, operating systems, antivirus — patch everything. The WannaCry ransomware attack exploited a vulnerability that had been patched two months earlier. The victims just hadn’t updated.

8. Encrypt client data in transit and at rest. If someone steals a laptop or intercepts an email, encryption means they get gibberish instead of Social Security numbers.

9. Get your WISP written. Use the IRS’s free WISP template as a starting point. It doesn’t have to be perfect — it has to exist, and it has to reflect what you actually do.

10. Have an incident response plan. If you discover a breach at 2 AM on April 14th, who do you call? What’s the first step? Having this written down before it happens is the difference between a contained incident and a catastrophe.

What This Looks Like in Practice

Let’s say you’re a 15-person CPA firm in Provo. You’ve got three partners, eight staff accountants, two admins, and two seasonal hires. Here’s what good security looks like for a firm your size:

  • Every employee uses a password manager and unique passwords for every system
  • MFA is enforced on Microsoft 365, your tax software, and your client portal
  • New seasonal hires get a 30-minute security training before they touch any client data
  • Client bank account changes require verbal confirmation via phone
  • Laptops are encrypted and can be remotely wiped if lost
  • A managed IT provider monitors your systems 24/7 and handles patching
  • Your WISP is documented, reviewed annually, and updated when you add new software
  • Backups run nightly to an offsite location, with quarterly restore tests

Is this a lot? Not really. Most of it is set-and-forget once it’s properly configured. The hard part is getting started.

The Cost of Getting This Wrong

The average cost of a data breach for a small professional services firm isn’t just the technical cleanup. It’s the client notifications, the potential lawsuits, the regulatory fines, the reputational damage, and the clients who leave. For an accounting firm, a breach during tax season can mean losing the client relationships you’ve spent decades building.

Compare that to the cost of doing it right: a few hundred dollars per employee per month for managed IT security, a day of staff training, and the discipline to follow basic security hygiene.

The math isn’t close.

Don’t Wait Until After Tax Season

The most common thing we hear from accounting firms is “we’ll deal with security after April 15th.” That’s exactly what attackers are hoping you’ll say.

If your firm needs help getting a security plan in place, implementing MFA, or just figuring out where you stand, reach out for a free assessment. We work with professional services firms across Utah, and we understand the unique pressures of tax season.

Your clients trust you with their most sensitive information. Make sure that trust is well-placed.