Protect Your Tax Practice from Phishing Attempts

Tax professionals should be on high alert for a new wave of phishing emails masquerading as potential clients seeking tax preparation services. These deceptive messages typically come from mismatched email addresses, provide minimal contact information, and are signed with only a first name. The scammers aim to establish communication with tax preparers, ultimately attempting to trick them into clicking malicious links or sharing access to secure document portals.

To protect yourself and your practice, implement a strict new client verification process that includes phone consultations and formal identification before sharing any sensitive information or portal access. Never click links or download attachments from unverified senders, and consider establishing a standardized intake process that requires potential clients to initiate services through your firm's website or office phone number. Remember: legitimate new clients will understand and appreciate your commitment to security.

This type of targeted attack is known as "spear phishing," or more specifically, "Business Email Compromise" (BEC) when targeting professional services. Unlike traditional phishing attempts that cast a wide net with generic messages, spear phishing involves carefully researched, highly targeted communications aimed at specific professionals or organizations.

Tax preparers are particularly valuable targets due to their access to sensitive financial information and tax filing systems. The FBI and IRS have issued specific warnings about these attacks, as criminals recognize the potential value of compromising a tax professional's systems. The timing of these attacks often aligns strategically with tax season or preparation periods, when professionals expect to receive new client inquiries.

What makes this attack notably sophisticated is its patient, methodical approach. Rather than immediately attempting to deploy malware or gain system access, these attackers first aim to establish a seemingly legitimate business relationship. They demonstrate knowledge of industry terminology, standard business processes, and professional norms. In this case, the attacker shows familiarity with tax preparation workflows, client intake procedures, and common practices like reviewing previous years' returns.

The ultimate goal of these attacks is typically to either deliver malware through document sharing, gain access to client portals, or extract sensitive information that can be used for identity theft or financial fraud. By first establishing trust and legitimacy, attackers increase their chances of success when they eventually deploy their actual attack. This patient approach makes spear phishing particularly dangerous and difficult to detect without proper awareness and verification procedures.