Tax practices are a favorite target for identity thieves because one firm holds what criminals need to file hundreds of fraudulent returns. The good news is that most attacks on small firms are not sophisticated, and a short list of controls stops nearly all of them.

Here they are, in the order we would put them in place.

1. Turn on multi-factor authentication everywhere

Email, tax software, the client portal, remote access, your bank and payroll. A stolen password is the most common way in, and a second factor shuts that door. Use an authenticator app rather than text messages where you can.

2. Put real endpoint protection on every computer

Free antivirus is not enough. Endpoint detection and response (EDR) watches for behavior, not just known viruses, and a 24/7 security team can isolate a computer at 2 a.m. before ransomware spreads.

3. Encrypt every drive

BitLocker on Windows and FileVault on Mac. If a laptop is stolen from a car or an old desktop goes out with the recycling, encryption is the difference between an inconvenience and a breach you have to report.

4. Back up, keep a copy offsite, and test it

A backup only counts if you have restored from it. Keep at least one copy that ransomware cannot reach or delete, include the tax software data folder, and back up Microsoft 365 mail and files separately.

5. Lock down email

Filter for impersonation and malicious links, and set up SPF, DKIM and DMARC so criminals cannot send email that looks like it came from your firm. Our free domain security grade shows whether yours are in place.

6. Stop emailing tax documents

Use a client portal or expiring encrypted links. Email gets forwarded, sits in mailboxes for years, and lands in the wrong inbox more often than anyone admits.

7. Give people only the access they need

Seasonal preparers do not need the firm’s entire file share. Admin rights belong to IT, not everyday logins. Review access at least once a year.

8. Remove access the day someone leaves

Disable the account, collect the laptop, change shared passwords and remove them from the tax software and portal the same day. Write it down as a checklist so it happens every time, including for seasonal staff in May.

9. Train your staff

A short session before tax season and simulated phishing emails through the year. Staff who know what a fake client request looks like are your best filter.

10. Write it down

Paid tax preparers are required by federal law to keep a Written Information Security Plan (WISP). It records the controls above, names a Qualified Individual responsible for them, and says what happens after an incident. Our sister firm, Sunesis Services, builds and maintains WISPs for accounting firms.

Where most firms fall short

When we assess firms in Spokane and North Idaho, the gaps are remarkably consistent: MFA on email but not on the tax software, backups that skip the tax data folder, no DMARC record, and former employees who still have accounts. None of these are expensive to fix.

If you want to know where your firm stands, our IT assessment checks all ten on-site and gives you a written list you keep.