Accounting firms hold exactly what criminals want: social insurance numbers, banking details and access to client accounts. Attacks spike when you're busiest and least likely to stop and check.
The five scams we see most
- Fake CRA messages asking you to "confirm" a refund or log in through a link. Always sign in to CRA services by typing the address yourself, never through an email or text.
- The new client who sends a "tax document" that's really malware. Treat unexpected attachments from new contacts with suspicion, and open them only from a secure portal.
- Hijacked client email asking you to change where a refund or payment goes. Confirm any change by phone using a number on file.
- Fake software update or support calls claiming to be from your tax software vendor and asking for remote access.
- Password reuse: one breached personal account leads attackers straight into a staff member's work email.
Protect the firm before the busy season
- Multi-factor authentication on email, tax software and remote access.
- A secure client portal instead of email attachments.
- Encrypted laptops and tested backups of client files.
- A ten-minute phishing refresher for every staff member each year.
Get ready before the next tax season. See how we help accounting firms or book a call.