Quick Summary
Email security for accounting firms requires more than spam filtering. Phishing, fake client requests, credential theft, business email compromise, malicious attachments, and impersonation can turn normal tax and accounting workflows into security risks.
- Use MFA, email filtering, endpoint protection, access controls, and secure document-sharing methods as layered defenses.
- Verify unusual payment changes, new-client requests, login prompts, attachments, and sensitive data requests through a trusted channel.
- Configure and monitor email authentication and account security to reduce spoofing, impersonation, and unauthorized access risks.
- An MSSP can manage technical security controls and monitoring, but the accounting firm still owns employee procedures, access decisions, incident response, and applicable compliance responsibilities.
Introduction
Email security for accounting firms requires more than spam filtering. CPA and tax firms should combine multi-factor authentication, strong access controls, email authentication, employee verification procedures, endpoint protection, monitoring, encryption, secure document-sharing practices, and an incident response plan to reduce the risk of phishing, account takeover, business email compromise, and malware.
The risk is especially relevant to accounting and tax professionals because email routinely carries conversations about tax documents, payroll, invoices, bank information, client records, and access to business applications.
The IRS reinforced that concern in August 2026, warning tax professionals about phishing, spear phishing, clone phishing, whaling, and scams in which criminals pretend to be prospective clients.
Why Email Security Matters More for Accounting Firms in 2026
Accounting firms have an unusual email-security challenge. A message asking an accountant to review a W-2, download tax documents, verify payroll data, check a client file, open an invoice, or respond to a new tax client may be completely legitimate.
It may also be the beginning of an attack. That overlap between normal accounting work and common phishing lures makes social engineering particularly difficult during periods when teams are processing large volumes of client communications.
Microsoft Threat Intelligence documented this directly during the 2026 U.S. tax season. In one February campaign, more than 29,000 users across 10,000 organizations received phishing emails impersonating the IRS. Microsoft’s analysis found that the attackers were particularly targeting accountants and tax preparers.
Email attacks also create financial risk beyond stolen passwords. According to the FBI’s 2025 Internet Crime Report, 24,768 Business Email Compromise complaints resulted in approximately $3.05 billion in reported losses during 2025.
For an accounting firm, email therefore needs to be treated as part of the firm’s security environment rather than simply as a communication tool.
What Are the Most Important Email Threats to Accounting Firms?
Modern email attacks rarely look like the obvious spam messages firms learned to recognize years ago. Attackers increasingly rely on context, impersonation, legitimate cloud services, compromised accounts, QR codes, and convincing login pages.
1. Phishing and Spear Phishing
Phishing attempts to persuade the recipient to click a malicious link, open a dangerous attachment, provide credentials, or disclose sensitive information.
Spear phishing is more targeted. Instead of sending the same message to thousands of people, an attacker may tailor the message to a particular CPA, partner, payroll employee, bookkeeper, or tax professional.
For accounting firms, common lures can include:
- tax documents
- W-2 or 1099 files
- IRS notifications
- e-file or EFIN issues
- client document requests
- invoices
- payroll questions
- password expiration notices
- cloud storage notifications
- accounting software messages
The IRS specifically warns tax professionals to watch for messages that appear to come from colleagues, banks, tax software providers, cloud storage services, government agencies, or other trusted sources.
2. Fake New-Client Emails
A dangerous email does not always begin with an obvious malicious attachment.
An attacker may first behave like a legitimate prospective client:
“I need help preparing my tax return. Are you accepting new clients?”
The first email can be harmless. Once the accountant responds, the attacker sends supposed tax documents or a link to financial records.
The IRS now specifically identifies the new client scam as a threat to tax professionals.
Microsoft observed similar attacks in 2026 in which criminals approached accountants with realistic tax-filing requests before attempting to deliver malicious remote-management software.
This means firms need verification procedures for prospective clients, not merely rules about emails from unknown senders.
3. Business Email Compromise
Business Email Compromise, or BEC, is an email-based fraud in which an attacker impersonates or compromises a trusted person or organization to persuade someone to transfer money, change payment instructions, purchase something, or disclose valuable information.
The attacker could pretend to be:
- a managing partner
- a CFO
- an existing client
- a vendor
- a payroll administrator
- a bank
- an employee
- another professional adviser
BEC can be particularly convincing when attackers gain access to legitimate email accounts or monitor existing conversations.
The FBI recommends independently verifying changes in account numbers, payment procedures, and financial requests rather than relying only on the email requesting the change.
4. Email Spoofing and Domain Impersonation
A fraudulent email does not need to come from a compromised employee account.
Attackers may spoof a sender or register a look-alike domain designed to resemble the firm’s domain, a client’s business, a vendor, the IRS, Microsoft, Intuit, or another familiar service.
For example, a recipient might overlook a single changed character in a domain when working quickly.
This is why accounting-firm email security should consider technologies such as:
SPF — Sender Policy Framework
Helps specify which systems are authorized to send email for a domain.
DKIM — DomainKeys Identified Mail
Uses cryptographic signatures to help verify that an email was authorized by the sending domain and was not altered in transit.
DMARC — Domain-based Message Authentication, Reporting and Conformance
Builds on SPF and DKIM and allows a domain owner to tell receiving systems how messages that fail authentication should be handled.
These technologies do not eliminate phishing, but properly configured email authentication can make domain impersonation harder and provide better visibility into unauthorized use of a firm’s domain.
5. QR-Code Phishing
A growing phishing message may contain no traditional malicious hyperlink at all.
Instead, the attacker inserts a QR code into:
- an email
- Word document
- invoice
- tax-related notification
Scanning the code may move the user from a managed computer to a personal or unmanaged mobile device and then direct the user to a fraudulent login page.
Microsoft’s email-security telemetry showed QR-code phishing volume increasing from 7.6 million messages in January 2026 to 18.7 million in March 2026. PDF attachments were the most common delivery format during that period.
For accounting firms, “scan this QR code to review a tax document” should therefore receive the same scrutiny as “click this link.”
To reduce this risk, employees can use a QR code scanner to decode a QR code and review the information it contains before opening a link. This helps them identify suspicious URLs and avoid visiting potentially harmful websites. However, scanning a QR code does not guarantee that a link is safe, so employees should verify the destination before proceeding.
6. Credential Theft and Fake Microsoft 365 Login Pages
Some phishing attacks are designed primarily to steal credentials.
The recipient follows a link that appears to open:
- Microsoft 365
- OneDrive
- SharePoint
- a client portal
- a tax document
- cloud storage
- another familiar application
The resulting login page looks legitimate but sends the username, password, or authentication session to an attacker.
Microsoft documented multiple tax-themed campaigns in 2026 using credential-harvesting pages and phishing-as-a-service platforms designed to make these attacks easier to operate at scale.
This is one reason firms should not rely on passwords alone.
7. Malicious Attachments and Remote-Access Malware
A malicious email can also deliver software rather than simply steal a password.
Attachments and links may ultimately install malware or abuse legitimate remote monitoring and management tools to provide attackers with access to a device.
Microsoft observed several 2026 tax-themed campaigns using legitimate remote-management technologies after victims followed fraudulent tax-document workflows.
Endpoint security therefore matters even when the attack begins in email.
What Email Security Controls Should Accounting Firms Use?
No individual product can stop every email attack.
A stronger model uses multiple security layers so that the failure of one control does not automatically expose client data or business systems.
1. Require Multi-Factor Authentication
MFA should protect accounts that provide access to sensitive business and customer information.
The FTC Safeguards Rule requires covered financial institutions to implement multi-factor authentication for people accessing customer information, subject to the Rule’s defined exception for an approved equivalent control.
CISA also recommends organizations move toward phishing-resistant MFA where practical because stronger authentication methods can provide better resistance to credential-phishing techniques.
2. Configure SPF, DKIM, and DMARC Correctly
These controls address different aspects of email authentication and are most effective when configured as a coordinated system.
A firm should know:
- which platforms legitimately send mail for its domain
- whether SPF records are current
- whether legitimate mail is DKIM signed
- what its DMARC policy is
- whether DMARC reports are being reviewed
- whether unauthorized services are using its domain
Misconfiguration matters. Email security is not improved simply by publishing a DNS record and forgetting about it.
3. Use Advanced Email Filtering
Modern filtering should evaluate more than keywords.
Depending on the email platform and security stack, controls may examine:
- sender reputation
- impersonation patterns
- suspicious domains
- malicious URLs
- attachments
- malware
- abnormal message behavior
- unusual forwarding rules
- known threat indicators
Filtering reduces exposure, but employees still need procedures for messages that get through.
4. Protect the Endpoint Behind the Inbox
If an attachment or URL reaches a workstation, the endpoint becomes another security boundary.
Endpoint Detection and Response, or EDR, can help identify suspicious behavior, investigate security events, and respond when a workstation or server behaves abnormally.
For firms accessing hosted QuickBooks, tax applications, Microsoft 365, client portals, or financial systems, protecting the device and the user account is just as important as filtering the original message.
5. Control Access to Client Information
Email security is closely connected to identity security.
Firms should periodically review:
- active users
- privileged accounts
- former employees
- shared mailboxes
- administrator roles
- forwarding rules
- application permissions
- third-party integrations
The FTC Safeguards Rule requires covered organizations to implement and periodically review access controls and monitor authorized-user activity for unauthorized access.
6. Avoid Sending Sensitive Documents as Ordinary Attachments
Tax returns, Social Security numbers, payroll documents, banking information, and other sensitive files should not automatically move through ordinary email attachments simply because email is convenient.
Where appropriate, firms should use controlled document-sharing systems, encrypted methods, or secure client portals and apply access restrictions consistent with the sensitivity of the information.
7. Train Employees for Accounting-Specific Attacks
Generic annual cybersecurity training is not enough by itself.
Training should reflect situations accounting employees actually see:
- “new client” requests
- W-2 documents
- IRS-themed messages
- changes to banking details
- urgent partner requests
- fake Microsoft login pages
- tax-software notifications
- payroll changes
- QR codes
- cloud-sharing links
Staff also need a simple way to report suspicious messages without being punished for raising a false alarm.
8. Use Independent Verification for Financial Changes
Email should not be the only authentication mechanism for high-risk financial actions.
Changes involving:
- bank accounts
- wire instructions
- payroll deposits
- payment destinations
- vendor details
- large purchases
should be verified using a known phone number, established workflow, or another trusted communication channel.
The FBI specifically recommends independently verifying changes to account numbers and payment procedures.
Email Security and the FTC Safeguards Rule
Email security should also be considered within the firm’s broader information-security program.
For organizations covered by the FTC Safeguards Rule, required safeguards include areas such as:
- access controls
- data inventory
- encryption
- MFA
- application security
- monitoring and logging
- security testing
- staff training
- service-provider oversight
- incident response.
The IRS also tells tax professionals that protecting client data is a legal obligation and points firms to Publication 4557 and Written Information Security Plan resources.
A hosting provider, MSP, or MSSP can support technical controls, but it does not transfer the accounting firm’s compliance responsibility to the service provider.
Firms should determine their specific legal and regulatory obligations based on their activities and applicable requirements.
The IRS Security Six for Tax Professionals
The IRS’s August 2026 guidance continues to recommend six baseline protections for tax professionals:
- Anti-virus protection and software updates
- Firewalls
- Multi-factor authentication
- Backup software or services
- Drive encryption
- A VPN for secure remote network connections.
These measures should be considered a starting point rather than the complete email-security architecture of a modern accounting firm.
Can an MSSP Improve Email Security for an Accounting Firm?
Yes. A Managed Security Service Provider can help a firm operate and monitor security controls that may be difficult for a small internal IT team to manage consistently.
Depending on the provider and service scope, managed security may assist with:
- identity and access security
- endpoint security
- security monitoring
- firewall management
- threat detection
- vulnerability management
- incident response
- security configuration
- Microsoft 365 administration
- email-security coordination
- backup and recovery
- security policy implementation
The important question is not simply:
“Do we have an MSSP?”
It is:
“Which security responsibilities does the provider actually manage, and which responsibilities remain with our firm?”
That distinction should be documented.
What an Accounting Firm Still Needs to Own
Managed security does not remove the human and organizational side of cybersecurity.
The accounting firm still needs to manage responsibilities such as:
- approving user access
- maintaining internal policies
- maintaining its WISP when required
- training employees
- determining how sensitive information should be shared
- verifying payment requests
- reporting suspicious behavior
- notifying the provider quickly about incidents
- reviewing third-party access
- maintaining appropriate software licensing
- determining its regulatory obligations
The strongest arrangement is a shared-responsibility model in which those boundaries are clear before an incident occurs.
What Should You Do If an Email Account May Be Compromised?
If a CPA or accounting firm suspects an email-security incident, speed matters.
Immediately:
- Contact the firm’s IT or security team.
- Disable or secure the affected account.
- Revoke active sessions where appropriate.
- Reset compromised credentials.
- Review MFA methods and account-recovery settings.
- Examine forwarding rules and mailbox changes.
- Identify suspicious messages sent from the account.
- Determine whether sensitive files or customer information were accessed.
- Preserve relevant logs and evidence.
- Follow the firm’s incident-response and WISP procedures.
If money was transferred because of BEC, the FBI recommends contacting the financial institution immediately and reporting the incident to the Internet Crime Complaint Center.
Tax professionals affected by data theft or related schemes should also follow current IRS incident-reporting guidance.
Email Security Checklist for CPA and Accounting Firms
| Security Area | What to Check |
|---|---|
| MFA | Enabled for email, cloud applications and sensitive systems |
| Email Authentication | SPF, DKIM and DMARC properly configured |
| Filtering | Phishing, malware, impersonation and malicious-link protection |
| Endpoints | Updated protection and EDR where appropriate |
| Access | Least privilege and periodic user reviews |
| Sensitive Files | Secure sharing instead of unnecessary email attachments |
| Verification | Independent checks for financial or account changes |
| Training | Accounting-specific phishing awareness |
| Monitoring | Suspicious access and account activity reviewed |
| Backups | Critical data backed up and recoverable |
| Incident Response | Documented process and responsible contacts |
| WISP | Maintained where applicable and aligned with the firm’s actual environment |
How OneUp Networks Supports a Layered Security Strategy
OneUp Networks helps accounting firms, CPAs, tax professionals, and businesses manage the infrastructure around their business-critical applications.
Its managed hosting environments can include security controls such as multi-factor authentication, Endpoint Detection and Response, firewalls, encryption in transit, network segmentation, access controls, brute-force protection, and 24/7 infrastructure monitoring.
OneUp Networks also supports managed hosting for accounting and tax applications including QuickBooks, Thomson Reuters applications, UltraTax CS, CCH, Sage, Drake, Microsoft applications, and other business software.
The objective is not to promise that any technology can make an accounting firm completely immune to cyberattacks. It is to reduce unnecessary exposure, improve control of the hosted environment, strengthen detection and recovery capabilities, and reduce the technical workload placed on the firm’s internal team.
Frequently Asked Questions
Accounting and tax firms regularly exchange financial records, tax documents, payroll information, credentials, and other sensitive information. Attackers can therefore use realistic tax, client, invoice, payroll, or document-sharing messages to imitate normal workflows.
There is no single threat, but phishing, credential theft, business email compromise, impersonation, malicious attachments, and account takeover deserve particular attention. The most effective defense combines technical controls with employee verification procedures.
No. MFA substantially strengthens account security, but modern phishing techniques can target authentication sessions and users themselves. Firms should combine MFA with email filtering, strong access controls, endpoint protection, monitoring, training, and independent verification.
For organizations covered by the Safeguards Rule, the Rule requires MFA for access to customer information unless the Qualified Individual has approved in writing another equivalent form of secure access control.
An MSSP can help manage security technologies, monitoring, endpoint protection, access controls, incident response, vulnerability management, and other technical safeguards. The exact responsibilities should be documented because the firm’s compliance and internal-policy obligations do not disappear when security is outsourced.
Build Email Security Into Your Firm’s Broader Cybersecurity Strategy
Email protection works best when it is connected to identity security, endpoint protection, access control, monitoring, backups, incident response, and the way your accounting applications are hosted.
For CPA and accounting firms, the goal is not to eliminate email or depend on employees to recognize every sophisticated attack. The goal is to create enough security layers that one convincing message does not automatically become a compromised account, exposed client file, fraudulent payment, or business interruption.
Talk to a Managed Security Expert
Talk to OneUp Networks about strengthening the security around your accounting applications, users, endpoints, and managed cloud environment. Ready to Strengthen Your Accounting Firm’s IT Security?
- Schedule a Demo – See how OneUp Networks can support secure access, managed infrastructure, and accounting application workflows.
- Start Your 15-Day Free Trial – Experience OneUp Networks’ managed cloud environment with no credit card required.
- Get a Free Consultation – Discuss your firm’s security, hosting, and IT requirements with a OneUp Networks expert.
