Tax Preparer Phishing: How Philadelphia Accounting Firms Can Prepare Before Tax Season

It’s a Tuesday in late October. A staff accountant gets an email that says the IRS needs your firm to re-verify its EFIN before e-filing opens, and it comes with a link and a deadline. She is busy, the email looks official, and she clicks.

Tax preparer phishing is not a January problem. Attackers know Philadelphia firms are quietly staffing up, onboarding seasonal help, and updating software right now, and that is exactly when a request that looks official gets less scrutiny. The IRS and its Security Summit partners have repeatedly warned tax professionals about emails that impersonate the IRS or tax software vendors and demand credential or document verification.

Why Accounting Firms Are Such a Good Target

Your firm holds Social Security numbers, bank details, prior-year returns, and signed engagement letters, all in one place. That is a complete identity kit for filing a fraudulent refund. A criminal who steals one preparer’s login can file dozens of returns that look completely legitimate, because they are filed from a real, authorized account.

What These Phishing Emails Usually Look Like

A message claiming to be from the IRS, e-Services, or your tax software vendor saying your account or EFIN needs “verification” or you will be unable to transmit returns.
A request to fax, upload, or reply with an account summary, a screenshot, or a copy of your credentials.
A new “client” who emails a prior-year return and asks you to prepare this year’s, with a link to download “supporting documents.”
Software update notices that route you to a login page that is a near-perfect copy of the real one.

The common thread is urgency plus a request for something you would never hand a stranger. If the message is trying to rush you, that is the tell.

Why One Click Costs More Than One Return

Once an attacker has a mailbox, they can sit quietly and read. They set up rules that hide replies, then watch client conversations and send convincing follow-ups from your real address. We covered how that works in hidden inbox rules and email compromise. A password reset alone does not clear it.

There is also a regulatory angle. Firms that prepare returns are expected to maintain a written information security plan, and a breach of client tax data triggers notification duties and a very unpleasant call to your insurance carrier. Prevention is cheaper than that phone call.

What to Do Before the Rush Starts

Turn on multi-factor authentication for email, your tax software, and your IRS e-Services account. Use an authenticator app, not text messages.
Set one rule for the whole office: nobody verifies an account by replying to an email. Go to the vendor or IRS site by typing the address yourself.
Remove local administrator rights from staff computers so a bad click can’t install anything. Here is why that matters.
Give seasonal staff their own accounts with limited access, and turn them off the day they leave.
Run a 15-minute phishing refresher with the whole team in early November, using real examples like the ones above.
Verify backups work, and that a copy lives somewhere an attacker with your password can’t reach.

If you want a monthly rhythm for this, our 30-minute IT check is a good place to start. It takes less time than one client call.

A firm that handles this in October is the firm that spends February preparing returns instead of explaining a breach to clients. We work with accounting firms across Philadelphia and the surrounding region on exactly this, and we’re happy to take a look at your setup before the season starts.

Get a Pre-Season Security Check for Your Accounting Firm

Abuzz Technologies helps Philadelphia accounting firms lock down email, tax software logins, and client data before filing season starts.

Book a free 20-minute consultation, and we’ll give you an honest read on where you stand. No sales pitch, no obligation.

(215) 600-0349 | www.abuzztech.com