IRS Warns Tax Professionals Against Phishing Emails And Cloud-Based Attacks

TL;DR: You’re a tax professional, and you know that cybercriminals are constantly evolving their tactics to steal sensitive taxpayer information. This guide explains who qualifies, the rules that apply, and how to apply them to your situation.

You’re a tax professional, and you know that cybercriminals are constantly evolving their tactics to steal sensitive taxpayer information. As part of an ongoing effort to protect the tax system, the Security Summit is warning you to be on high alert against phishing emails and cloud-based schemes designed to trick you and your clients. These attacks can come in many forms, from convincing emails to sophisticated cloud-based scams, and it’s crucial that you remain vigilant to protect your business and your clients’ sensitive information.

Before we investigate the details, it’s vital to understand that phishing scams are a significant threat to tax professionals. These scams are designed to trick you into disclosing sensitive information, which can lead to identity theft and fraud.

Types of Phishing Scams

You should be aware of the different types of phishing scams that target tax professionals. These include:

• Phishing/Smishing: attempts to trick you into clicking a suspicious link, filling out information, or downloading a malware file.
• Spear Phishing: targets specific individuals with realistic emails, making them seem more legitimate.
• Clone Phishing: clones a real email message and resends it to the original recipient, pretending to be the original sender.
• Whaling: targets leaders or executives with access to secure large amounts of information.

Perceiving these types of scams is crucial to protecting yourself and your clients.

Warning Signs of a Scam

Professionals should be aware of the warning signs of a scam, including:

Scams often come in the form of unexpected emails or texts claiming to come from a known or trusted source. Be cautious of messages with urgent tones, duplicate emails with new attachments or hyperlinks, and email addresses or links that are slightly misspelled or have a different domain name or URL.

By being vigilant and recognizing these warning signs, you can protect yourself and your clients from falling victim to phishing scams.

Cloud-Based Schemes Remain a Threat

One of the most critical threats facing tax professionals is cloud-based schemes designed to steal sensitive taxpayer information. According to the Security Summit warns tax pros to remain vigilant against phishing emails and cloud-based attacks, tax professionals using cloud-based systems that store information or run tax preparation software should take extra precautions to safeguard that data.

Importance of Multi-Factor Authentication

Importantly, the Federal Trade Commission now requires all practitioners to secure sensitive client personally identifiable information (PII) using multi-factor authentication. This provides an additional layer of security to access a system by using a phone, text messages, or tokens, helping to guard against potential vulnerabilities.

Securing Sensitive Client Information

Remain vigilant when storing and accessing sensitive client information in cloud-based systems. Ensure you have robust security measures in place, including multi-factor authentication, to prevent unauthorized access.

Client data is a valuable target for cybercriminals, and tax professionals must take proactive steps to protect it. By implementing robust security measures, such as multi-factor authentication, you can significantly reduce the risk of a data breach and safeguard your clients’ sensitive information.

Protecting Yourself and Your Clients

Some tax professionals may think they’re immune to phishing scams and cloud-based attacks, but the reality is that these threats can happen to anyone, at any time. As the IRS warns, “We continue to see a barrage of email and related attacks designed to trick tax professionals and gain access to their sensitive information.”

According to the IRS, tax professionals can protect themselves and their clients by being aware of these scams and looking for warning signs. For example, an unexpected email or text claiming to come from a known or trusted source, such as a colleague, bank, or credit card company, should raise red flags. You can read more about the IRS’s warning to tax pros of a “barrage” of phishing scams here.

Reporting Incidents to the IRS and State Tax Agencies

Reporting incidents quickly is crucial in protecting your clients and preventing further attacks. If you’re a victim of any of these schemes or identity theft, contact your IRS stakeholder liaison immediately to provide details of the situation. You can also share information with the appropriate state tax agency by visiting a special Report a Data Breach page with the Federation of Tax Administrators.

Understanding Federal Trade Commission Requirements

Any tax professional handling sensitive client information must understand the Federal Trade Commission’s (FTC) data breach response requirements. This includes reporting an incident to the FTC when 500 or more people are affected within 30 days of the incident.

Another critical aspect of the FTC’s requirements is securing sensitive client personally identifiable information (PII) using multi-factor authentication. As a tax professional, it’s vital to use multi-factor authentication to safeguard your clients’ data, especially when using cloud-based systems that store information or run tax preparation software.

To wrap up

With this in mind, you should remain vigilant against phishing emails and cloud-based attacks that target your sensitive taxpayer information. As a tax professional, you’re a prime target for scammers, and it’s crucial to educate yourself and your employees on how to identify and avoid these threats. By being aware of the warning signs of phishing scams and using multi-factor authentication to secure your cloud-based systems, you can protect your clients and your business from potential attacks. Stay informed, stay vigilant, and report any incidents quickly to prevent further damage.