Cyber Security for Accountants and Bookkeepers

Accountancy and bookkeeping practices hold the keys to their clients' money: bank details, payroll, tax records and the credentials that file returns, often in a small firm with outsourced IT and a busy shared inbox. That makes them a target for payment diversion, tax identity fraud and ransomware, and a weak link criminals use to reach clients. This guide covers the threats that matter most to accountants and bookkeepers, the legal duties that turn an incident into a regulatory matter in the UK and US, and the controls that matter more in a practice than in a typical small business: payment verification, client portals and cloud accounting access, protection of tax filing credentials, and recovery during deadline season. It is written for practice owners and partners, practice managers, sole practitioners and the IT providers that support them. It follows the same approach as the Cybersecurity for Legal Firms Guide.

Key takeaways

Payment instructions are the prize. The FBI's IC3 counted 305,033 business email compromise incidents and about $55.5 billion in exposed losses between October 2013 and December 2023; accountants send and receive exactly the bank detail changes criminals forge.
Tax filing credentials are a target in themselves. The IRS warns that criminals phish tax professionals to steal EFINs and CAF numbers and take remote control of office computers to file fraudulent returns.
US tax preparers must have a written security plan. The FTC Safeguards Rule names tax preparation firms, and requires a Qualified Individual, risk assessment, MFA, encryption and breach notice to the FTC within 30 days for 500 or more consumers.
Every client bank change gets a call-back. Verify any change to your own, a client's or a supplier's bank details on a number already on file, never one in the email.
Plan for the deadline weeks. Ransomware or a locked mailbox in January or April costs far more than in August, so test backups and recovery before the busy season.

Why practices are a distinct target

Money movement: practices prepare payment runs, payroll and tax payments, and clients trust their accountant's emails about where to send money.
Identity data: national insurance or Social Security numbers, dates of birth, bank statements and passport copies are enough to commit tax and identity fraud.
Delegated access: practices hold access to client bank feeds, cloud accounting files, payroll systems and tax authority accounts, so one compromised practice reaches many businesses.
Seasonal pressure: tax deadlines create the urgency that phishing and impersonation rely on, and leave little time for checks.
Small, outsourced IT: the NCSC's small business guidance notes that about one in two small businesses suffer a cyber incident each year; many practices have no in-house IT at all.

Threat picture

The table maps the threats most relevant to practices to MITRE ATT&CK v20 techniques and the control that does most to stop each.

Threat	How it plays out in a practice	ATT&CK	Primary control
Credential phishing	Fake tax authority notice, document share or software login harvests a staff password	T1566.002 Spearphishing Link, T1078 Valid Accounts	Phishing-resistant MFA, link protection, staff awareness
Payment diversion	Lookalike domain or compromised mailbox sends "new bank details" for fees, supplier payments or a client's payroll	T1583.001 Domains, T1534 Internal Spearphishing	Call-back verification, DMARC, show full sender addresses
Mailbox persistence	Inbox rules hide client replies and forward mail to the attacker	T1564.008 Email Hiding Rules, T1114.003 Email Forwarding Rule	Block external auto-forwarding, alert on new rules
Tax credential theft	Attacker steals filing credentials, EFIN or agent account access and files false returns	T1078 Valid Accounts	MFA on tax software and agent accounts, unique logins, monitoring of filings
Remote takeover	Caller poses as IT support or software vendor and installs remote access	T1566.004 Spearphishing Voice, T1133 External Remote Services	Call-back procedure, block unapproved remote tools
MFA fatigue	Repeated push prompts until a tired staff member approves	T1621 MFA Request Generation	Number matching or passkeys
Ransomware and data theft	Unpatched remote access or server, then encryption and threat to publish client files	T1190 Exploit Public-Facing Application, T1486 Data Encrypted for Impact, T1567.002 Exfiltration to Cloud Storage	Patching, MFA on all remote access, offline backups

The IRS lists the same tactics against tax professionals: phishing by email or phone, tricking staff into giving up passwords, stealing EFINs or CAF numbers and taking remote control of computer systems. It asks e-Services users to register for QuickAlerts and has long promoted multi-factor authentication for tax software accounts. See the Business Email Compromise Awareness for Finance Teams Guide and the Invoice Redirection and Supplier Bank Detail Fraud Guide.

Legal and professional duties

Duties depend on jurisdiction and on the services the practice provides. Confirm current requirements with your regulator and professional body; rules are revised.

Obligation	Source	What it means in practice
Security programme for tax preparers (US)	FTC Safeguards Rule (16 CFR Part 314)	Tax preparation firms are listed as covered financial institutions. Nine elements: a Qualified Individual, written risk assessment, safeguards (access controls, data inventory, encryption, MFA, secure disposal, change management, logging), monitoring or annual penetration testing with vulnerability scans every six months, training, service provider oversight, keeping the programme current, a written incident response plan and an annual written report to the board or senior officer. Firms holding data on fewer than 5,000 consumers are exempt from some provisions.
Breach notice to the FTC (US)	FTC Safeguards Rule	Notify the FTC as soon as possible and no later than 30 days after discovery of unauthorised acquisition of unencrypted information about at least 500 consumers.
Written Information Security Plan (US)	IRS Publications 4557 and 5709	The IRS explains how to build a WISP scaled to the firm, recommends a data theft response plan that includes contacting your IRS Stakeholder Liaison, and advises keeping an offsite copy.
Security of personal data (UK and EU)	UK GDPR and EU GDPR Article 32	Security appropriate to the risk, including encryption and the ability to restore data after an incident.
Breach notification (UK and EU)	UK GDPR and EU GDPR Articles 33 and 34	Notify the ICO or lead authority within 72 hours of becoming aware of a reportable breach, and affected individuals where risk is high.
Client confidentiality	Professional body codes of ethics and engagement letters	Confidentiality is a professional duty; engagement terms often add security and notification commitments.

For UK practices, Cyber Essentials is a practical baseline that many clients and insurers recognise. See the Cyber Essentials Guide.

Payment verification and email security

The FBI's BEC guidance is simple and works: verify any request to change account information through a secondary channel, configure computers to show full sender email addresses, check that links point to the claimed domain and never send credentials by email. Turn it into a written practice procedure.

Publish your own rule: tell clients in engagement letters and email footers that the practice will never change its bank details by email, and that they should call a known number before paying.
Call back on every change: any change to a client's, supplier's or employee's bank details, or a new payee in a payment run, is confirmed by phone on a number already on file.
Dual control: a second person approves payroll changes and payment runs above a threshold.
Email authentication: publish SPF, DKIM and DMARC for your domain and move DMARC towards enforcement, so criminals cannot send as you.
Lookalike domains: monitor for domains that imitate yours and your largest clients'.
Mailbox rules: block automatic forwarding to external addresses and alert when inbox rules are created.

If money has gone, contact the sending bank at once to request a recall, then report to the police (in the UK, Report Fraud, or 101 in Scotland) and in the US file at ic3.gov regardless of the amount. See the Business Email Compromise Response Playbook.

Client portals, cloud accounting and delegated access

Modern practices work inside clients' cloud accounting files, payroll platforms and bank feeds. Each delegated login or connected app is a route into the client.

One login per person: no shared practice logins to client software or tax portals. Shared accounts make MFA, offboarding and investigation impossible.
MFA everywhere: on email, practice management software, cloud accounting, payroll, client portals and tax authority or agent accounts. The FTC Safeguards Rule lists MFA among its required safeguards for covered firms.
Least privilege on client files: give staff "standard" or "adviser" roles rather than full admin, and remove access when an engagement ends.
Connected apps: review third-party apps connected to cloud accounting and Microsoft 365 or Google Workspace each quarter, and remove unused ones; their tokens keep working after a password change.
Use a portal, not email: exchange tax returns, payslips and identity documents through a client portal with MFA, rather than email attachments.
Leavers: remove access to every client system on the day someone leaves, using an access register so nothing is missed.

See the Small Business Identity and Access Security Guide and the Microsoft 365 Security Guide.

Where identity fits

Tax filing credentials are identities with financial power. An EFIN, a CAF number, an agent services login or an API token linking practice software to a tax authority can file returns, change client details or authorise payments without anyone touching the client's own accounts. Treat them like privileged accounts: hold them in a password manager or the software's credential store, never in documents or spreadsheets, limit who can use them, enable every available sign-in alert, and review filing activity for returns you did not submit. Service accounts and integrations used by practice software deserve the same inventory and review. See the Shared and Generic Accounts Governance Guide.

Devices, backups and continuity

Patch and update: automatic updates on laptops, phones and servers; patch internet-facing remote access within days of a critical fix.
Encrypt devices: full-disk encryption on every laptop, and a screen lock on every phone that holds client email.
Backups: daily backups of practice data and cloud mailboxes, with at least one copy offline or immutable; test a restore before each busy season.
Remote access: MFA on all remote access, no exposed remote desktop, and only approved remote support tools.
Continuity plan: know how you will file urgent returns and contact clients if systems are down, including how to request extensions, and keep the plan offsite, as IRS Publication 5709 advises for the WISP.

The FTC's ransomware advice for small businesses is to disconnect infected devices from the network without powering them down, keep backups off the network and report to the FBI. See the Ransomware Basics for Small Businesses Guide.

Implementation roadmap

Month 1: MFA on email, practice software, cloud accounting and tax accounts; written call-back procedure for bank detail changes; block external auto-forwarding.
Month 2: access register of every staff member's access to client systems; remove shared logins and old users; review connected apps.
Month 3: SPF, DKIM and DMARC; device encryption; tested backups with an offline copy.
Month 4: written security plan (WISP for US tax preparers, a security policy and incident plan for UK practices); appoint the person responsible; staff training on tax-season phishing.
Before each busy season: restore test, tabletop of a mailbox compromise and a ransomware day, and refresh of client warnings about bank details.

Small practices and sole practitioners can do most of this with built-in features of Microsoft 365 or Google Workspace and a password manager; larger practices should add email security filtering, endpoint detection and response, and an external review against Cyber Essentials or the FTC rule elements.

Detection and measurement

Percentage of staff accounts with MFA on email, practice software and tax accounts (target 100%).
Bank detail changes verified by call-back, as a percentage of changes logged (target 100%).
New inbox rules forwarding externally detected per month (target zero unexplained).
Days from staff departure to removal of all client system access (target same day).
Days since last successful restore test (target under 90, and before each busy season).
DMARC policy at quarantine or reject (yes or no).

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Least privilege and access reviews on client systems	PR.AA-05	AC-2 Account Management
MFA for staff and tax accounts	PR.AA-03	IA-2 Identification and Authentication
Supplier and software provider terms	GV.SC-05	SR-6 Supplier Assessments and Reviews
Backups and restore tests	PR.DS-11	CP-9 System Backup
Remote access and boundary protection	PR.AA-03	SC-7 Boundary Protection
Client and regulator notification	RS.CO-02	IR-4 Incident Handling

Common failure patterns

Trusting the email thread: a reply in an existing conversation with new bank details is paid because it looks routine; compromised mailboxes produce exactly that.
Shared logins to client software and tax portals: no MFA, no audit trail and no clean way to remove a leaver.
Tax credentials in a spreadsheet: one infected laptop exposes every filing credential the practice holds.
"IT support" calls without verification: staff install remote access for a caller during a busy week.
Backups on the same network: ransomware encrypts the backup drive along with the server.
Connected apps never reviewed: a forgotten integration on a client's cloud accounting file keeps a valid token long after the engagement or the staff member who added it has gone, and nobody notices when it is misused.
No US WISP: tax preparers who never wrote the plan the FTC requires find out during a breach.

Practitioner checklist

Turn on MFA for email, practice management, cloud accounting, payroll, portals and tax accounts.
Write and enforce a call-back procedure for every bank detail change, and tell clients about it.
Replace shared logins with named accounts and keep an access register for client systems.
Store tax filing credentials in a password manager, and enable every available sign-in and filing alert.
Block external auto-forwarding and alert on new inbox rules.
Publish SPF, DKIM and DMARC and move DMARC to enforcement.
Keep offline or immutable backups and test a restore before each busy season.
US tax preparers: maintain a WISP that covers all nine FTC Safeguards Rule elements.
Know your notification duties: FTC within 30 days (500 or more consumers), ICO within 72 hours where reportable.

Cyber Security for Accountants and Bookkeepers Guide: Threats, Duties and Priority Controls