Top Security Threats for Tax Preparers Right Now

Why Tax Professionals Are Prime Targets for Cybercriminals

Tax professionals handle a concentration of sensitive financial data that few other businesses match. A single tax preparer's client files contain Social Security numbers, employer identification numbers, bank account details, investment records, and prior-year tax returns for hundreds of individuals and businesses simultaneously. That combination makes tax practices among the most attractive targets in the financial services sector.

The IRS reports thousands of data theft incidents targeting tax professionals annually, with attackers stealing an average of 400 taxpayer records per incident. These breaches carry consequences that extend far beyond the immediate disruption: EFIN suspension, state penalties reaching $250,000, mandatory client notification for every affected taxpayer, and lasting reputational harm that can destroy practices built over decades.

The ten threat categories below represent the active attack patterns most frequently targeting tax practices right now, ranked by impact and frequency. Each section covers how the attack works, why tax practices are specifically targeted, and the specific technical and procedural controls that stop it. Understanding these tax preparer security threats is the foundation of any defense aligned with IRS Publication 4557.

1. Ransomware Attacks Timed to Tax Season Deadlines

Ransomware encrypts every file it can reach and demands payment for the decryption key. For a tax practice, that means losing access to every client record, tax return, and business document simultaneously — typically during the most pressured weeks before filing deadlines, when the disruption cost is highest and the pressure to pay quickly is strongest. The tax season ransomware spike illustrated in our overview above reflects a deliberate strategy: attackers time their campaigns to maximize deadline pressure on victims.

The average ransom demand against a small tax practice runs into the tens of thousands of dollars, and paying is no guarantee of recovery. The FBI reports that only 65% of victims who pay the ransom successfully recover their files, and 37% of those who do recover still find data corruption requiring additional remediation work.

The most common delivery mechanisms are phishing emails with malicious attachments disguised as client documents or IRS notices, compromised Remote Desktop Protocol (RDP) connections, malicious macros embedded in Excel or Word files, and software vulnerabilities in unpatched tax software or operating systems.

Prevention requires a layered approach. The 3-2-1 backup rule remains the baseline: maintain three copies of data, on two different media types, with one copy stored offline and air-gapped from any network. For tax practices, daily backups during filing season with weekly offline rotation is the minimum. Pair tested offline backups with an Endpoint Detection and Response (EDR) solution that detects ransomware behavior before encryption begins, and patch all software within 72 hours of each security release. Our ransomware protection guide for tax practices covers layered defense implementation in detail.

2. Phishing and Spear Phishing: The Primary Attack Vector

Phishing is the most common initial attack vector across all industries, responsible for 94% of successful breaches according to the Verizon 2025 Data Breach Investigations Report (DBIR). Generic phishing campaigns send mass emails hoping for any response; spear phishing targets specific individuals with personalized messages built from reconnaissance on your firm, your staff, and your clients.

Tax professionals receive phishing emails impersonating the IRS — fake CP2000 notices, PTIN suspension warnings, e-Services login alerts — as well as tax software vendors such as Intuit, Drake, and Thomson Reuters, clients requesting document status updates, and financial institutions. During peak filing season, some tax offices report 50 to 100 phishing attempts per day in March and April.

The IRS Security Summit has identified several phishing tactics gaining momentum in 2026. AI-generated voice phishing (vishing) uses deepfake audio of partners or clients requesting urgent file access, with enough audio quality to deceive staff under time pressure. QR code phishing arrives in physical mail claiming to be IRS security updates requiring mobile scanning. Multi-channel attacks combine email, text, and phone calls to establish false legitimacy before the actual fraud request. Tax software update scams deliver credential-stealing malware disguised as mandatory security patches. Client portal spoofing replicates your secure portal login page to harvest credentials at scale.

Defense requires both technical controls and human awareness. Deploy email filtering that blocks known malicious domains and analyzes message headers for spoofing indicators. Use DNS filtering to block access to malicious sites even when someone clicks a link. Implement DMARC (Domain-based Message Authentication, Reporting, and Conformance) in enforcement mode — not monitoring mode — to prevent domain spoofing. Pair these technical controls with monthly phishing simulation exercises for all staff with access to client data. Our phishing attack detection guide covers each of these tactics with specific identification and response guidance for tax practices.

3. Business Email Compromise (BEC) and Refund Fraud

Business Email Compromise involves compromising or spoofing a trusted email account to manipulate the recipient into transferring money or sensitive data. The FBI's Internet Crime Complaint Center (IC3) reported $2.9 billion in BEC losses in 2025, with tax professionals representing a disproportionately targeted sector because of their direct connection to client financial accounts and refund processing.

In a tax context, a common BEC attack works like this: an attacker compromises a client's email account and sends a request to change refund direct deposit routing to an attacker-controlled account. By the time the legitimate client realizes their refund never arrived, the funds have moved through a network of money mules and are unrecoverable. A second common pattern involves attackers impersonating firm partners or senior preparers to instruct junior staff to send client data to an external address for an "urgent prospective client meeting" — a request that appears legitimate to an untrained employee.

Prevention starts with email authentication. DMARC, DKIM, and SPF records verify that emails claiming to come from your domain are actually sent from your authorized mail servers. Equally important: establish verbal verification procedures for any change to financial information, including refund routing, payment instructions, or wire transfer details. A 30-second call to a known, pre-established phone number — not a number provided in the suspicious email — prevents losses that cannot be reversed after the fact.

For a deeper look at the security program requirements that address BEC at the organizational level, see our FTC Safeguards Rule guide for tax preparers, which covers the access controls and authentication requirements that reduce BEC exposure.

4. Credential Theft and Account Takeover

Attackers steal login credentials through phishing, keylogger malware, credential stuffing (automated testing of passwords exposed in prior data breaches), or by purchasing credentials from dark web marketplaces. The 2025 Verizon DBIR found stolen credentials involved in 49% of breaches — the second most prevalent attack pattern after phishing, which is itself frequently used to steal credentials in the first place.

Once an attacker has your tax software credentials, they can access your entire client database. If they obtain your IRS e-Services credentials, they can compromise your EFIN and file fraudulent returns under your professional identity. Credential stuffing is particularly effective against tax professionals who reuse passwords across multiple services — automated tools can test billions of username/password combinations obtained from unrelated breaches in a matter of hours.

IRS Publication 4557 Section 2.3 specifically requires strong authentication controls: unique passwords for every account with no reuse across services, complex passwords following NIST SP 800-63B guidelines (minimum 12 characters, recommended 16+), and multi-factor authentication (MFA) on all systems containing taxpayer data. For tax software, the IRS requires MFA for all professionals accessing EFIN-linked systems.

A practical starting point: use an enterprise password manager to generate and store unique credentials for every account — our password manager comparison for tax practices covers the options best suited to small and mid-sized firms. Enable MFA with a preference for authenticator apps or hardware security keys over SMS codes. Add dark web monitoring to receive alerts when your credentials appear in breach datasets, often before the attacker has used them, giving your practice time to respond before account takeover occurs.

5. Insider Threats: The Risk Within Your Organization

Not every threat originates outside your organization. Current or former employees, contractors, and business partners with legitimate system access can compromise client data intentionally or by accident. The 2025 Ponemon Cost of Insider Threats Study found that insider incidents cost organizations an average of $16.2 million annually, with malicious insiders accounting for 26% of incidents and negligent employees responsible for 56%.

In a tax practice, the most common insider threat scenarios look like this: a departing seasonal preparer copies the client database to a personal USB drive before leaving to start a competing practice; an employee falls for a phishing email and enters credentials into a spoofed portal; a contractor misconfigures cloud storage permissions and inadvertently exposes client files to public access; or staff share login credentials with colleagues, creating untracked access that bypasses your audit trail entirely.

Prevention requires least-privilege access controls — users should only access the systems and client files necessary for their specific job function. Revoke access within one hour of termination for involuntary departures, and the same business day for resignations. Monitor user activity logs for unusual patterns: access at atypical hours, bulk downloads, or accessing client files with no clear business justification.

The FTC Safeguards Rule (16 CFR § 314.4) requires tax preparers to implement access controls and monitor for insider threats as part of their formal information security program. Audit logs of who accessed what data and when must be retained for at least three years. Your Written Information Security Plan (WISP) must document your access control and monitoring procedures by name — this is a required element, not optional documentation.

6. Remote Desktop Protocol (RDP) Exploitation

Many tax practices use Remote Desktop Protocol (RDP) to allow remote access to office computers, enabling work from home or access to desktop tax software from outside the office. Exposed RDP services are among the most targeted entry points for ransomware operators. The Cybersecurity and Infrastructure Security Agency (CISA) lists RDP as one of the top three initial access vectors in ransomware attacks, with automated brute-force tools testing thousands of password combinations per minute against any RDP port exposed directly to the internet.

Once inside via RDP, attackers have the same access as if they were sitting at your workstation — tax software, client files, email, and a launchpad for attacks against other systems on your network. The problem compounds when practices use weak passwords on RDP accounts, expose RDP without a VPN gateway, or fail to monitor login attempts for brute-force patterns.

NIST SP 800-46 and IRS Publication 4557 require these controls for any practice using RDP: never expose RDP directly to the internet — require VPN authentication as a mandatory first step before any RDP connection is possible; enable Network Level Authentication (NLA) so credentials must be provided before a full session is established; implement account lockout after five failed login attempts; require 16-character minimum passwords with MFA enforced at the VPN layer; and alert on unusual geographic activity or abnormal login failure rates.

Our guide to choosing a VPN for remote tax practice access covers configuration for common scenarios including desktop tax software access and multi-location firm environments.

7. Web Application Attacks and SQL Injection

Tax practices using web-based client portals, intake forms, or custom-built applications face web application attacks including SQL injection. SQL injection occurs when attackers insert malicious database commands into web form fields, exploiting inadequate input validation to access or manipulate the underlying database. A successful attack against your client portal could expose your entire client dataset — names, Social Security numbers, tax returns, and financial records — without triggering the failed-login alerts that protect against credential-based attacks.

The OWASP Top 10 consistently lists injection attacks among the most prevalent web application security risks. Prevention requires parameterized queries (prepared statements that separate database commands from user input), input validation and sanitization on all user-submitted data, and least-privilege database accounts so web applications never connect with administrative credentials.

If you use a third-party secure client portal for tax professionals, verify the vendor undergoes annual penetration testing and holds a current SOC 2 Type II certification — and request their latest audit report before onboarding. Vendors who cannot provide a recent SOC 2 report represent unquantified third-party risk to your practice's client data.

8. Wi-Fi Eavesdropping and Network Attacks

Unsecured or poorly secured wireless networks allow attackers to intercept data transmitted across the network. If your office Wi-Fi uses weak encryption — WEP, or WPA with a short or long-unchanged password — an attacker in a nearby car or building can intercept client data moving across your network without triggering any alerts. This is especially acute in shared office buildings where wireless signals overlap with neighboring businesses, or in retail tax preparation locations where public foot traffic provides cover for wireless reconnaissance.

NIST SP 800-153 provides wireless security guidance for organizations handling sensitive data: use WPA3 encryption (WPA2 at minimum — WEP and WPA with TKIP are broken by tools readily available to unsophisticated attackers); implement a strong, unique Wi-Fi password of at least 20 characters changed annually and whenever staff with Wi-Fi access depart; completely isolate guest and business networks so waiting room Wi-Fi cannot reach practice systems; and disable WPS (Wi-Fi Protected Setup), which has documented vulnerabilities allowing password bypass without brute force.

For any sensitive transactions — bulk client data transfers, tax software logins while traveling, or accessing client portals from uncertain networks — use a VPN that encrypts all traffic regardless of the underlying network's security posture. This applies equally to hotel networks, client office Wi-Fi, and any shared connection outside your own controlled environment.

9. Physical Theft and Loss of Devices

Stolen laptops, lost USB drives, and office break-ins trigger data breach notification requirements under laws in all 50 states. A single stolen laptop containing unencrypted client data can affect hundreds of taxpayers, triggering state notification timelines — generally 30 to 90 days from discovery — along with potential IRS reporting obligations and PTIN consequences. Physical security failures are among the most preventable breach causes and among the most frequently overlooked in small practices.

IRS Publication 4557 Section 3.2 explicitly requires encryption of all portable devices and removable media containing taxpayer data. Use BitLocker for Windows and FileVault for macOS on all laptops and desktops. Enable remote wipe capability through Microsoft Intune or a comparable Mobile Device Management (MDM) platform so a lost or stolen device can be wiped before its contents are accessed. For mobile tax preparers who work at client locations, encrypted cloud storage reduces exposure from local device theft — though any cloud provider must be vetted for current security certifications. Where local storage is necessary, use FIPS 140-2 validated encryption solutions and maintain a current inventory of every device containing client data.

10. Supply Chain Attacks and Third-Party Risk

Supply chain attacks compromise a software vendor or service provider your practice relies on, then use that trusted relationship as a pathway into your systems. The 2020 SolarWinds incident demonstrated the scale of this threat: attackers infiltrated the software development process and distributed malware through trusted updates to over 18,000 organizations worldwide. The 2023 MOVEit Transfer vulnerability showed how a single zero-day in a widely used file transfer platform could simultaneously affect thousands of organizations, with attackers systematically exploiting the flaw across the vendor's entire customer base before a patch was available.

Tax software vendors face the same attack surface. Their automatic updates install on tens of thousands of tax professional systems, making them high-value targets for this attack pattern. When your software vendor pushes an update, you have implicitly trusted their entire software development and distribution chain with access to your systems and client data — a risk most small practices have not explicitly evaluated.

The FTC Safeguards Rule requires tax preparers to assess and address third-party service provider risks. In practice, this means vetting security practices before engagement — request SOC 2 Type II reports, penetration test results, and security policies; limit access granted to third-party software using least-privilege principles; review vendor contracts for security requirements and incident notification obligations; and monitor for unusual activity from vendor connections. Require vendors to notify you of security incidents within 24 to 72 hours contractually, not as a courtesy request.

Your WISP must document your third-party risk management process per IRS Publication 4557 Section 4.2, including a vendor inventory and evidence of security due diligence for each vendor with access to taxpayer data. Maintain independent offline backups not controlled by any single vendor — if your cloud storage provider is compromised, your offline backup remains intact and unaffected.

Emerging Tax Preparer Security Threats in 2026

Several attack categories are gaining momentum specifically against tax professionals this year, and they differ meaningfully from the ten established threats covered above.

AI-Powered Social Engineering — Attackers are using generative AI to produce phishing emails that match the recipient's communication style, use flawless grammar, and reference specific details scraped from public records and social media. These campaigns are harder to detect because they lack the traditional red flags — poor grammar, generic greetings — that standard awareness training teaches staff to recognize. AI-generated voice phishing (vishing) can now convincingly impersonate partners, managers, or clients, and the FBI has reported significant growth in vishing attacks targeting financial services professionals during filing season.

Double-Extortion Ransomware — Ransomware groups have shifted to demanding payment while simultaneously threatening to publish stolen data publicly if the ransom is not paid. For tax professionals, a public dump of client Social Security numbers, financial records, and tax returns is an existential threat to client relationships and professional standing — one that tested offline backups alone cannot address, because restoring your data does not stop the attacker from publishing what they have already exfiltrated.

Identity-Based Attacks Targeting IRS Systems — Attackers who compromise a tax professional's IRS e-Services credentials can file fraudulent returns under your EFIN, request transcripts of clients' prior-year returns for use in future fraud campaigns, and access the Income Verification Express Service (IVES) to harvest wage and income data at scale. The IRS Security Summit has documented these attack patterns in detail and requires practitioners to implement specific controls addressing e-Services credential security.

Dark Web Trading of Tax Professional Data — Stolen tax professional credentials and client databases command significant prices on dark web marketplaces because a tax preparer's data gives buyers access to complete financial profiles of hundreds or thousands of individuals simultaneously. Dark web monitoring services alert your practice when credentials or client data appear in these markets — often before the attacker has used the data — giving you time to respond and contain the damage before account takeover occurs. For a full picture of how these emerging threats interact in real attacks, our incident response plan guide for tax practices covers containment and recovery procedures for the attack patterns described above.