Tax season cybersecurity: which daily habits protect a tax practice?

Why does tax season cybersecurity depend on daily habits?

Tax season cybersecurity depends on daily habits because the controls in a written information security plan only work if people follow them when they are rushed. Tax preparers are financial institutions under the FTC Safeguards Rule (16 CFR 314.2(h)(2)(viii)), and the IRS and Security Summit reminded preparers in IR-2026-92 that a WISP is required by federal law. A plan built from IRS Publication 5708 describes the safeguards. Staff habits decide whether those safeguards hold up in March.

Filing season brings the conditions that break habits: high volume, new and seasonal staff, clients sending documents from every channel, and deadline pressure that rewards shortcuts. The IRS has not yet announced when it will begin accepting 2026 returns, so now is the time to settle the routine before the first rush. If the plan itself needs work first, see our guide to IRS WISP requirements for the 2027 filing season.

What should staff do before opening a new client's documents?

Staff should verify a new client by phone, using a number found independently, before opening any attachment. IRS Publication 4557 tells preparers to never open or download attachments from unknown senders, including potential clients, and to make contact first by phone. The IRS has warned specifically about the new client email scam, where a fake prospect sends a link or attachment that installs malware or harvests credentials.

• Call back on a number from your records or a public listing, never one supplied in the email.
• Move new clients to your secure portal before they send documents, instead of accepting email attachments.
• Treat any request to change refund deposit details or send copies of returns as suspect until confirmed by phone.
• Forward suspicious IRS-themed emails to phishing@irs.gov, as Publication 4557 recommends, and do not reply to them.

For the specific lures circulating this year, see our rundown of tax season scams that target CPA firms.

Which login habits do the Safeguards Rule and the IRS expect?

The Safeguards Rule and IRS guidance expect multifactor authentication for every user, individual accounts and screens that lock when unattended. The Safeguards Rule at 16 CFR 314.4(c)(5) requires MFA for any individual accessing any information system, unless your Qualified Individual approves an equivalent or stronger control in writing. In IR-2026-106, the IRS urged MFA "across all services and data access points" and told preparers to use individual accounts and never share usernames or passwords.

In daily practice that means:

• Every preparer and seasonal worker signs in to tax software, email and the portal with their own account and MFA.
• No shared front-desk or "scanner" logins that several people use during a busy day.
• Screens lock automatically after inactivity. Publication 4557 recommends password-activated screen savers, and staff should lock manually when stepping away.
• Passphrases that are unique to each system. Publication 4557 recommends at least eight characters, and 16 for administrator passwords.
• Anyone who receives an MFA prompt they did not start reports it instead of approving it.

What should you check every week during filing season?

Check how many returns have been filed under your EFIN and PTIN every week. Publication 4557 tells preparers to "Check e-File Applications and PTIN accounts weekly" for total returns filed and to deactivate unused EFINs. A count higher than the returns you actually filed is one of the clearest signs of data theft.

Publication 4557 lists other signs to watch for each week:

• Client e-filed returns rejected because a return with the same Social Security number was already filed.
• Clients who have not filed receiving IRS authentication letters (5071C, 4883C or 5747C).

Two more weekly checks belong on the list. Confirm that backups completed and test a restore, since Publication 4557 calls backups "your best protection against ransomware attacks." Review active accounts so that anyone who left, including seasonal staff, has no remaining access. The Safeguards Rule's access control requirement at 16 CFR 314.4(c)(1) expects access to be limited to authorized users who need it.

How should client data travel during busy season?

Client data should travel encrypted, over networks the firm trusts. Publication 4557 tells preparers to encrypt sensitive files and emails, to use a VPN for remote work and not to use public Wi-Fi "to access business email or sensitive documents."

• Staff working from home connect through the firm's VPN or remote access service.
• Client documents go through the portal or encrypted email, never personal email or text messages.
• Nobody forwards client files to a personal account to finish work at night.
• Laptops that leave the office have full-disk encryption and are logged in your WISP's device list.

Device settings such as disk encryption and automatic screen locks are covered in more detail in our workstation checklist for tax season 2027.

What should happen in the first day after something goes wrong?

Contain the incident, then report it to the IRS as soon as possible and no later than the next business day after you confirm it. Publication 1345 says Authorized IRS e-file Providers "must report security incidents to the IRS as soon as possible but not later than the next business day" after confirming the incident, and providers acting only as Electronic Return Originators contact their local Stakeholder Liaison. The IRS data theft page for tax professionals lists the contacts and steps.

Publication 4557 adds law enforcement, the states where you prepare returns, your insurer and your security provider, plus the FBI and CISA for ransomware. Under 16 CFR 314.4(j), a notification event involving the information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. The Safeguards Rule also requires a written incident response plan at 16 CFR 314.4(h).

The habit that makes this work is preparation: a printed sheet with your Stakeholder Liaison contact, insurer claim line, IT provider and the person who decides when to call each one.

What should a tax practice do before filing season starts?

Settle the routine before the first rush, so every preparer and seasonal hire starts the season with the same habits. Our FTC Safeguards Rule checklist for tax preparers covers the program-level requirements behind them.

• Turn this list into a one-page card of daily security habits and hand it to every preparer and seasonal hire.
• Give seasonal staff security awareness training before they get access. 16 CFR 314.4(e) requires security awareness training for personnel.
• Confirm MFA is on for tax software, email, the portal, cloud storage and remote access.
• Confirm the protections the IRS calls the Security Six are in place on every device: anti-virus, a firewall, two-factor authentication, backups, drive encryption and a VPN.
• Put the weekly EFIN and PTIN check on the calendar with a named owner.
• Print the incident contact sheet and keep a copy away from the computers.
• Check that your WISP describes these routines, so the plan matches what staff actually do.

How does s90 support tax practices during busy season?

s90 can take on the technical safeguards behind these habits, such as MFA enforcement, device management, backups and access reviews, so staff can focus on returns. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production, which helps when you need records for an IRS or FTC report. If you would like a second look at your busy-season routine before January, we are glad to help.