thieves always build a better mousetrap, so stay vigilant.
by donny shimamoto, cpa, citp, cgma
on cybersecurity for accountants
in 2018, fraudsters posed as tax authorities and state accounting and tax professional associations. these were simple phishing attacks trying to get tax practitioners’ email usernames and passwords, allowing fraudsters to obtain client contact information and perform email-based password resets for other systems.
more: future firm growth requires a mindshift | ai, ocr, nlp & cpas: oh my! | accounting nerds, unlock your super powers | early adopters gain an edge in audit | dustin wheeler: for serious cas success, hire tech teams | csr for cpas: the missing ingredient | donny shimamoto explains how ‘agile’ applies to cpa firms | staff retention for remote workers | why the future is in risk advisory | ready for non-cpa “cpa” firms?
exclusively for pro members. log in here or 2022世界杯足球排名 today.
the irs reported seeing threats specifically targeting preparers in illinois, iowa, new jersey and north carolina. additionally, the irs received reports tied to a canadian accounting association.[i]
sadly, this means tax practitioners need to be extra vigilant about being targeted by phishing attacks. if fraudsters obtain client contact information, they can also use that to do “spearphishing” attacks, where they pose as you (a trusted person) telling your client that you need banking or other information from them. if your email username and password are compromised, they can monitor your inbox to see if a client responds and reply to them as if it came from you. they can also delete the client email and response they send from your inbox and sent items, respectively, so you never know it even happened.
in 2019, the irs saw fraudsters go back to attacking taxpayers directly—this time impersonating the irs itself. email subject lines like “automatic income tax reminder” or “electronic tax return reminder” had links that took people to an irs.gov-like website with details pretending to be about the taxpayer’s refund, electronic tax return or tax account. the emails contained a temporary password or one-time password to access the files to submit the refund request. these files were trojans that, when opened, installed malware onto the person’s computer.[ii]
the scary thing about this type of attack is that malware like this can go undetected on a computer for a long time…sometimes even years. we see thieves sit and wait and gather information over time—passwords, account numbers, contact lists—things that could be used to create more attacks later. some will also wait to see if a person connects to a corporate network via vpn or by going into the office. once they see that they’re in a network, they try to go into the servers there and spread further—to other users or to other servers—even eventually potentially getting admin access to the entire network, giving them access to a lot more data.
over the course of the covid-19 pandemic, with everyone working from home and wanting to get their stimulus monies, there was a spike in phishing attacks posed as providing taxpayers with information about their eligibility for or payment status of stimulus funds.
ransomware attacks ran rampant during the pandemic as well. there were 1,251 ransomware-related incidents in 2021, up from 602 in 2020.[iii] the cost of these incidences also escalated. the cost of incidences in 2021 was $1.2 billion, almost triple the $416 million cost in 2020.
consider what would happen if you were hit by ransomware right before a tax deadline. do you know which clients you would need to extend (assuming that was an option)? do you have the contact information for clients available offline so that you can contact them to let them know what is happening? further, the ftc safeguards went into place on june 6. are you at least in compliance?
hackers are consistently evolving. as prime targets of cyber attacks, accounting professionals should always make cybersecurity a top priority.
[i] ir-2018-125, may 14, 2018 | [ii] ir-2019-145, august 22, 2019 | [iii] https://www.accountingtoday.com/news/ransomware-attacks-doubled-from-2020-to-2021-especially-from-russia, nov 2022