2 min read

IRS Warning – Hackers Are Targeting Accountants

Picture of Byron Martin Byron Martin : Feb 27, 2025

Cybersecurity Compliance

2:49

Tax season is already stressful enough—tight deadlines, demanding clients, and long hours. But cybercriminals are counting on that chaos to catch accountants off guard. Hackers actively target CPA and accounting firms with sophisticated phishing scams designed to steal sensitive client data and take over email accounts.

The IRS has issued an urgent warning about this, and if you’re not prepared, your firm could be the next victim.

How the Scam Works

Hackers are getting smarter. Instead of generic phishing emails, they’re posing as potential clients in need of tax assistance. Here’s what happens:

1. A hacker reaches out pretending to be a new client looking for help.

2. They send an email with an attachment or link to “tax documents” that actually contains malware.

3. Once you click, they gain access to your email account, passwords, and client data.

4. The hacker then targets your clients directly, sending fake tax updates, fraudulent wire instructions, or additional phishing emails—making it look like they’re coming from you.

Why This Threat Is So Dangerous

Cybercriminals know that accountants handle some of the most valuable financial and personal data. They also know that during tax season, firms are swamped, distracted, and under pressure—making it easier to trick even the most cautious professionals.

One click on the wrong email, and suddenly:

Your entire client list is compromised.
Your firm’s reputation is at risk.
You may face legal and regulatory consequences under FTC Safeguards and Gramm-Leach-Bliley regulations.

What You Can Do to Protect Your Firm

You don’t have to be a cybersecurity expert to defend against these attacks, but you do need a plan. Here’s where to start:

✅ Educate Your Team – Make sure everyone in your firm is aware of this scam and trained to recognize phishing emails. A quick internal meeting can prevent costly mistakes.

✅ Have a Strong Security Plan – If your firm isn’t following the latest cybersecurity best practices, you may already be out of compliance with federal regulations. The FTC requires accounting firms to have a Written Information Security Plan (WISP)—without it, you may not even be able to file an insurance claim in the event of a breach.

✅ Schedule a Cybersecurity Assessment – If you’re unsure whether your current security measures are enough, now is the time to act. A Cybersecurity Assessment can help you identify vulnerabilities before hackers do.