Article · Accounting firms
IT security for accounting and bookkeeping firms
Accounting firms hold exactly what criminals want: social insurance numbers, banking details, financial statements and the trust of clients who act on your emails. This guide covers the risks specific to the profession and the controls that address them.
- Published
- 7 min read
On this page
Key takeaways
- Tax season brings a predictable surge in phishing that imitates clients, tax authorities and software vendors; prepare staff before it starts.
- Move document exchange out of email attachments and into a secure client portal or encrypted sharing with MFA.
- Verify every change to payment or banking details by phone using a number you already have on file.
- Protect tax and practice management software with individual accounts and MFA, and offboard seasonal staff promptly.
- Encrypt devices, manage them centrally and keep tested, protected backups of client files.
- Retention and privacy obligations depend on your professional body, jurisdiction and engagements; confirm them with qualified advisers.
Why accounting firms are attractive targets
Accounting and bookkeeping practices concentrate sensitive personal and financial information from many clients in one place. A single compromised mailbox can expose years of tax returns, payroll records and identity documents. That information can be used for identity theft, fraudulent tax filings or targeted fraud against your clients.
Firms also sit in the middle of money movement. Clients expect emails from you about payments, refunds, invoices and filings, so a convincing message that appears to come from your firm carries real authority. Criminals exploit that trust through business email compromise, sending altered banking instructions from a hijacked or look-alike mailbox. And because work is seasonal and deadline-driven, staff are busy and under pressure exactly when attacks increase.
Tax-season phishing patterns to train for
Brief staff before the busy season with real-looking examples of these lures, and make reporting a suspicious email quick and blame-free.
Fake client documents
Emails from new or existing clients with attachments or links labelled as T4 slips, receipts or financial statements that lead to credential phishing pages or malware.
Tax authority impersonation
Messages appearing to come from the Canada Revenue Agency or another authority, urging action on an account, refund or review. Verify through official channels, never through links in the message.
Software and portal alerts
Fake notifications from tax software, document portals or Microsoft 365 asking staff to sign in to keep access, designed to capture passwords and MFA codes.
Prospective client approaches
A new contact who asks for help and then sends a link to their documents, which turns out to be a phishing page or malicious file.
Client portals and secure document exchange
Email attachments are a weak way to move sensitive documents. Messages can be sent to the wrong address, intercepted, forwarded or left sitting in mailboxes for years. They also train clients to open attachments that appear to come from you, which helps attackers who impersonate the firm.
A secure client portal, whether part of your practice management software or a dedicated file-exchange service, lets clients upload and download documents over an authenticated connection, with access logging and the ability to revoke access. Require clients to use MFA where the portal supports it. If you use Microsoft 365, SharePoint or OneDrive sharing with specific-people links and expiry dates, or Microsoft Purview message encryption, can be suitable alternatives for occasional exchanges.
Tell clients clearly how you will and will not communicate: for example, that you will never send banking changes by email and that documents always arrive through the portal. That message makes impersonation harder to pull off.
Stopping payment and banking fraud
Business email compromise is largely defeated by process rather than technology. Write the process down and apply it every time.
Verify out of band
Any request to change banking details, redirect a refund or pay a new payee is confirmed by phone using a number already on file, never one provided in the request.
Require dual approval
Payments above an agreed threshold, and all payee changes, need a second person to approve.
Flag external email
Use external sender tagging and impersonation protection in Microsoft 365 so staff see when a message that looks internal actually came from outside.
Watch for mailbox rules
Alert on new inbox rules that forward or hide messages, a common sign that a mailbox has been compromised.
Act fast
If a fraudulent payment is suspected, contact the bank immediately, then your IT provider and insurer. Speed improves the chance of recovering funds.
Technical controls for an accounting practice
- Multifactor authentication on Microsoft 365, tax preparation software, practice management, cloud accounting platforms, banking and any remote access, with phishing-resistant methods for partners and administrators.
- Individual accounts for every staff member in every system; avoid shared logins for tax software or government online services so activity is attributable and access can be removed cleanly.
- Managed, encrypted laptops and desktops with endpoint protection, automatic patching and no everyday local administrator rights.
- Email authentication (SPF, DKIM and DMARC) on your domain so criminals find it harder to send email that appears to come from your firm.
- Least-privilege access to client folders, organized so staff see the clients and years relevant to their work.
- Protected backups of client files and practice data, including at least one immutable or offline copy, with regular restore tests.
- Secure printing and scanning, including scan-to-email or scan-to-folder configured without legacy authentication.
Seasonal staff and remote work
Many firms add temporary staff and contractors for the busy season. Each new person is a new identity to secure and, later, to remove. Use a standard onboarding checklist that issues a managed device or restricts access from personal devices through app protection policies, assigns access by role, and records an end date.
Offboarding seasonal staff on time is just as important. Disable accounts on the last working day, revoke sessions, recover devices and remove access to third-party systems such as tax software and portals. Accounts left active after the season ends are a common and avoidable exposure.
For remote work, require managed devices or approved app access, avoid local copies of client files on personal computers, and make sure home printing of client documents is covered by your confidentiality policies.
Records retention and privacy obligations
Accounting firms are subject to overlapping expectations: privacy legislation, professional standards from provincial accounting bodies, tax record-keeping rules that apply to clients, and the terms of individual engagement letters. Retention periods and secure destruction requirements can differ depending on the record type and the client.
Technology can support whatever policy you set: retention labels and policies in Microsoft 365, structured folder archives, documented secure disposal of old devices and storage, and audit logs showing who accessed what. Deciding the policy itself, and what to do if a privacy breach occurs, is a matter for your professional body’s guidance and qualified legal and privacy advisers. Keep only what you need for as long as you need it; data you no longer hold cannot be stolen.
A pre-season checklist
Before the busy season: confirm MFA on every system, run a phishing awareness refresher, test a restore of client files, verify devices are patched and encrypted, remind clients how you will communicate, and prepare onboarding and offboarding checklists for seasonal staff.
Frequently asked questions
Is email safe for sending tax documents to clients?
Standard email is not a good channel for sensitive documents. A secure client portal or encrypted, access-controlled sharing reduces the risk of misdirected messages, interception and impersonation.
How long should our firm keep client records?
It depends on your professional body’s requirements, tax record-keeping rules, engagement terms and privacy law. Confirm your retention policy with qualified advisers, then configure your systems to support it.
What should we do if a client says they received a suspicious email from us?
Treat it as a possible mailbox compromise. Contact your IT provider to check sign-in logs and inbox rules, reset credentials and revoke sessions if needed, warn affected clients through a trusted channel, and consult advisers about any notification obligations.
Do small bookkeeping practices need the same controls as larger firms?
The core controls are the same, because the data and the threats are the same. MFA, managed devices, secure document exchange, payment verification and tested backups scale down well to a practice of a few people.
Related services
Products and packages
Prepare your firm before the next tax season
We help accounting and bookkeeping practices tighten Microsoft 365 security, secure devices, set up protected backups and train staff, under a written scope.