Updated on October 15, 2026 by Whole Technology
Why attackers target CPA firms
An accounting firm’s data is the mother lode for cybercriminals: Social Security numbers, bank account details, payroll records, and full tax returns — everything needed for identity theft and fraudulent refund claims, in one place. Attackers time their campaigns to tax season deliberately, when staff are processing hundreds of emails a day and are far less likely to scrutinize a suspicious message. And a compromised firm email account doesn’t just hurt the firm — it’s used to defraud the firm’s own clients through business email compromise.
The phishing plays we see every tax season
Fake tax-authority notices. Emails posing as the IRS or state revenue departments demanding you “verify your e-file credentials” or pay a balance through a link. The IRS does not initiate contact by email.
Client impersonation. “Hi, here are my new bank details for the refund” — sent from a spoofed or lookalike address. One changed direct-deposit instruction can divert a client’s refund to an attacker.
Vendor impersonation. Fake Thomson Reuters, CCH, or Intuit login pages that harvest your tax-software credentials. These are often pixel-perfect copies of the real portals.
Malicious “tax documents.” Attachments and shared-file links labeled as W-2s, 1099s, or prior-year returns that install malware when opened.
What actually stops it
Multi-factor authentication, everywhere. Especially on email and tax software. MFA stops the most common outcome of phishing — credential replay — cold.
Email authentication. Properly configured SPF, DKIM, and DMARC make it far harder for attackers to spoof your firm’s domain to your clients — and harder for them to spoof others to you.
Training timed before tax season. A 15-minute refresher in January beats a two-hour seminar after an incident. Staff should know the current plays, not last year’s.
24/7 monitoring that catches the click. People will click — the question is how fast someone notices. In our Huntress case study, managed detection turned security alerts into action before damage was done.
An incident response plan. Know who to call in the first hour. The firms that recover fastest are the ones that decided the playbook before they needed it.
The click is inevitable. The breach isn’t.
No training program gets the click rate to zero — especially in February and March. The difference between an incident and a catastrophe is detection speed and a practiced response. If you’re not sure where your firm stands, our free 27-point IT and security assessment will tell you. To get a head start on readiness, walk through our 2027 tax-season IT prep checklist.
Frequently asked questions
Why are CPA firms prime phishing targets?
Concentration of value. One compromised firm yields thousands of complete identity profiles — names, Social Security numbers, bank accounts, and income details — plus trusted email relationships with clients who can be defrauded next.
What does a tax-season phishing email look like?
Usually urgency plus authority: a fake IRS notice demanding credential verification, a “client” sending new bank details, or a vendor login page that looks identical to the real Thomson Reuters or Intuit portal. The tell is almost always in the sender address or the link destination — hover before you click.
Does MFA really stop phishing?
It stops the most common outcome — attackers reusing stolen passwords. It doesn’t stop every technique (session-cookie theft exists), which is why MFA belongs alongside email authentication, monitoring, and training, not instead of them.
What should our firm do if someone clicks?
Act in minutes, not days: disconnect the device, reset the user’s credentials and any shared passwords, and call your IT or security provider immediately. Then review what the attacker could have accessed — email rules, inbox content, and connected tax software — before declaring it contained.
