Cybersecurity for CPAs, bookkeepers, and tax preparers who don’t have an IT department.

Protection for accounting firms and bookkeeping practices of 1 to 9 people, built around the threats that hit during tax season and every month in between.

Your clients trust you with their money and their numbers

Bank logins, payroll records, tax returns, and client portals are everything an attacker wants. You don’t have to be a large CPA firm to be a target. Smaller practices are often easier to hit because nobody’s job is watching for trouble, and clients assume you’ve got it covered.

What’s happening right now

Attackers know tax season is the busiest, most distracted time of year. A fake IRS notice, a client asking you to “quickly” update their direct deposit, or a vendor sending a revised invoice can all look routine when you’re buried in returns.

Bookkeepers face the same pattern. A compromised login to QuickBooks or another cloud accounting tool can expose every client you serve, and a single fake vendor invoice can move money out of a client’s account before anyone checks.

The lesson: a payment change, a new document request, or a notice that claims to come from the IRS is a reason to pause and verify, not a reason to rush.

Four habits that close the most common gaps

1. Verify every payment or banking change by phone. If a client or vendor asks to change a bank account, refund destination, or direct deposit, call them at a number you already have on file. Don’t use the number in the email.

2. Confirm before you send or open. Verify unexpected document requests, portal links, and IRS-style notices through the official channel before you click or reply. The IRS does not contact taxpayers by email to demand immediate payment or personal information.

3. Turn on multifactor authentication everywhere that matters. That includes email, your tax software, accounting platform, client portal, payroll, and banking. Many practices protect email and forget the rest.

4. Remove access when people leave, and back up client files you can restore. Seasonal staff and former bookkeepers should lose access to every system, not just email. Test your backups so you know they work before you need them.

Six Threats:
Learn how to spot them

Payment Redirection / Business Email Compromise

A client or vendor asks to change their bank account or direct deposit right before a payment or refund.
A “revised” invoice arrives with a different remittance account and a request to pay today.
The sender’s email domain is one character off from the one you’ve used before.

Phishing / IRS and Client Impersonation

An email claiming to be from the IRS or a state tax agency demands immediate payment or personal information.
A client sends an urgent document request with a link to a login page you don’t recognize.
A message from a known client arrives in a different style, or asks you to skip your normal verification steps.

Ransomware

Client files, returns, or working papers renamed or locked after hours, especially during tax season.
Backups or antivirus turned off without anyone on staff doing it.
Large amounts of client data leaving your network to destinations you don’t recognize.

Insider Threats / Access Control

Former bookkeepers, seasonal preparers, or staff still have logins to your tax, accounting, or client portal software.
No one has reviewed who can see which client files since they were hired.
Offboarding removes email but leaves QuickBooks, tax software, and payroll access untouched.

Credential Compromise

Logins to your accounting platform, tax software, or client portal from places you’ve never been.
Two logins too far apart in time to be the same person.
Password reset emails for accounts you didn’t request.

Third-Party / Vendor Compromise

Your payroll, e-signature, or document-sharing provider reports unusual activity in their system.
An outsourced bookkeeper or software vendor asks for access to files or logins outside the normal process.
A portal login request arrives by email instead of through the official system.