Let’s face it: Tax season brings enough stress without worrying about cybersecurity threats. But before you dismiss the idea of needing any tax season security tips and move along on your merry way, you might want to think twice. Especially given the amount of personally identifiable information (PII) your firm has. These numbers probably won’t ease your mind:
- Tax-related identity theft has increased by 45% since 2020.
- The IRS flagged more than 1 million tax returns for potential identity theft during the 2023 tax season.
- 61% of small businesses were victims of a cyberattack in the last year.
- The FBI’s Internet Crime Complaint Center saw a 10% increase in 2023 complaints compared to 2022, highlighting the growing threat landscape that includes tax professionals as targets.
- Of $31.6 billion in financial crimes identified, tax fraud represents $5.5 billion of that total.
If you think cybercriminals take it easy during tax season, think again. They actually ramp up their efforts when you’re at your busiest. It makes sense, right? That’s part of the reason the Security Summit—a coalition of IRS, state tax agencies, and various providers and professionals in the nation’s tax community—has designated, for the ninth year, a full week as National Tax Security Awareness Week.
And while December 2-6, 2024, has come and gone, that doesn’t mean cybersecurity awareness ends. If anything, this dedicated week should just confirm the importance of kicking off the holidays and the 2025 tax season in the right frame of mind.
So, in the spirit of the season, let’s talk about how to keep your firm and your clients safe through the holidays, the 2025 filing season and beyond. It’s time to make our cybersecurity checklist…and check it twice.
1. Get serious about email security
Did you know that 61% of security threats start with an email? Or that the median time for users to fall for phishing emails is less than 60 seconds? That makes your inbox a prime target during the holidays and the upcoming busy season. Defending your firm starts with the battle in your inbox. Your staff must be your first line of human defense, especially when tax season can become a communication and document-sharing frenzy. Here are the basic things you need to do:
- Make encrypted email your best friend for sensitive communications.
- Double-check sender identities before opening any attachments.
- Put robust spam filtering in place.
- Never (and I mean never) send sensitive tax documents through regular email.
2. Make secure client portals your standard
It’s time to stop relying on email for document exchange. Instead, think about this:
- Set up secure client portals for all tax document uploads.
- Only accept sensitive information through encrypted channels.
- Choose portals that come with built-in security features and access controls.
- Train your clients on how to use the portal properly.
3. Put security training front and center
Your team can be your greatest asset or your biggest vulnerability. The choice is yours. Here are some ways to prioritize security training and keep awareness top of mind:
- Run regular phishing simulations.
- Teach everyone how to spot tax season scams.
- Have weekly security refreshers leading up to and during tax season.
- Make security awareness part of your daily conversations.
4. Lock down those access controls
Implementing strong access controls is essential if you want to protect your firm against ransomware and other cyberthreats during tax season. This means ensuring only team members who truly need access to sensitive data can access it. Here’s how:
- Set up multifactor authentication on everything.
- Only give access to client data on a need-to-know basis.
- Regularly review and update who has access to what.
- Keep detailed logs of who’s accessing your systems.
5. Stay on top of software updates
Here’s the thing: Cybercriminals love outdated software. Don’t make it easy for them. Instead:
- Turn on automatic updates for all your systems.
- Schedule regular patch management reviews.
- Keep your antivirus protection current.
- Document all your software update procedures.
6. Back up your data like your business depends on it (because it does)
Don’t let a security incident throw your tax season into chaos. Ensure business continuity with:
- Daily automated backups of all client data.
- Regular testing to make sure those backups actually work.
- Encrypted offline backup copies.
- Clear procedures for accessing backup data when you need it.
7. Keep your eyes open for suspicious activity
Stay alert to potential security threats. Everyone on your team needs to think like a security guard who is watching your firm’s digital doors around the clock. Here are a few steps to take:
- Set up 24/7 system monitoring.
- Create alerts for unusual login attempts.
- Watch for unexpected system changes.
- Have an incident response plan ready to go.
8. Make remote work secure work
With so many firms operating in remote and hybrid environments these days, you need to protect your distributed workforce. Your remote security checklist should include the following:
- Require VPN usage for all remote connections.
- Secure home office networks.
- Implement clear device management policies.
- Put limits on accessing sensitive data from personal devices.
Don’t let the bad guys win this tax season
Look, we understand: Implementing all these security measures while managing tax season workload can sound overwhelming. But you have to remember that cybercriminals don’t take a break during the holidays or during tax season. In fact, they never take a break. That’s why many accounting firms choose to partner with a cybersecurity provider who can handle these security measures for them. This frees up your team to focus on what they do best during tax season: serving your clients.
The bottom line? With the right layered security framework in place, you can face tax season 2025 with confidence, knowing your firm’s data is protected against whatever cyberthreats come your way.
Ready to stop worrying about cybersecurity and get back to focusing on your clients this tax season and beyond? Let’s talk. Our team of security experts is ready to help you protect what matters most: your firm, your clients and your reputation.
And for more advice on securing your firm, subscribe to our blog below. ⬇️⬇️⬇️
