Key takeaways
- The 2026 Dirty Dozen lists spear-phishing and malware campaigns targeting tax professionals as item 11.
- "New client" emails carry links or attachments disguised as tax documents and can expose email passwords and client data.
- The IRS says EFIN requests should be handled only through the software provider's portal after verification.
- The W-2 scam uses a spoofed executive email to request employee W-2 data from payroll or HR staff.
- Tax professionals report spear phishing to phishing@irs.gov and suspected data theft to their IRS Stakeholder Liaison.
Why do tax season scams hit CPA firms before the 2027 filing season?
Tax practices hold what criminals want: client Social Security numbers, bank details, and the e-file credentials needed to submit a return that looks legitimate. The IRS and its Security Summit partners spent the summer and fall of 2026 warning tax professionals about the same small set of lures, and those warnings are the best available guide to what will land in your staff's inboxes this season.
The IRS opened its five-week "Protect Your Clients; Protect Yourself" series in IR-2026-81 (July 7, 2026), naming "new client" schemes, phishing for EFINs, PTINs and CAF numbers, and IRS impersonation by email, text, phone, spoofed caller ID and computer-generated calls. The IRS Dirty Dozen list for 2026 (IR-2026-30, March 5, 2026) includes "spear-phishing and malware campaigns targeting tax professionals" as item 11. In IR-2026-124 (Oct. 16, 2026), the IRS announced Tax Professional Awareness Week for the week of Oct. 19 to help preparers get ready for the 2027 filing season. As of this writing, the IRS has not announced the date the 2027 filing season opens.
None of this is a forecast. It is a list of lures the IRS has already documented, and the firms that train staff on these specific patterns before January are better placed when volume peaks and attention drops.
What does the "new client" lure look like?
A sender poses as a prospective client who needs tax help and includes a link or attachment described as their tax documents. Opening it can expose the staff member's email password or install malware that reaches client data, according to IRS Tax Tip 2024-06.
The IRS warns that a compromised mailbox is then used to target the firm's own clients. Dirty Dozen item 11 adds a variation: a scammer who has hacked a taxpayer's email account can find a genuine past message to that taxpayer's preparer and use it to send a convincing "document request." The Aug. 4, 2026 release (IR-2026-85) also describes clone phishing, where a nearly identical copy of a legitimate email arrives with a new attachment or link swapped in.
The danger for a CPA firm is timing. These messages look exactly like the inbound requests your front desk is supposed to welcome between January and April.
How do scammers go after EFIN, PTIN and CAF numbers?
They impersonate someone with an apparent right to ask, usually the IRS e-Services system or the firm's tax software provider. IRS Tax Tip 2025-57 (Aug. 14, 2025) describes an email posing as a software provider that asks the preparer to fax EFIN documentation; the criminal then uses it to steal client data and file fraudulent returns.
The IRS says EFIN requests should be handled only through the software provider's own portal, after the request is verified. Its identity theft guidance for tax professionals lists the senders scammers most often pose as: IRS e-Services, a tax software company, a cloud storage provider, a potential client or a colleague. It also warns that thieves use stolen PTIN, EFIN or CAF numbers to file fraudulent returns or obtain more taxpayer information.
Which impersonation lures should staff expect by phone and text?
Expect calls and texts that claim to come from the IRS and push for immediate action. Item 2 of the 2026 Dirty Dozen, "AI-enabled IRS impersonation by phone," covers phone scams that use AI tools and spoofed caller ID to imitate the IRS.
The IRS states that it generally contacts taxpayers by mail first and does not leave urgent, threatening prerecorded messages, demand immediate payment or threaten arrest. Item 1 covers IRS impersonation by email and text, and the IRS urges recipients not to click links or open attachments from unexpected messages. For a tax practice, the practical point is that a caller ID showing an IRS number, or a voice that sounds like a known contact, proves nothing on its own.
How does the W-2 scam reach a CPA firm?
The W-2 scam is a business email compromise. A spoofed email that appears to come from an executive asks someone in payroll or human resources for a list of employees and their Forms W-2, as described on the IRS W-2 data theft page.
A CPA firm can be exposed twice: through its own staff records and through payroll work done for clients. IR-2026-85 calls this pattern "whaling" when it targets leaders, and names payroll, human resources and financial offices as targets. The request usually arrives early in the year, when W-2 work is already underway, so it does not look out of place.
What are the signs a lure has already worked?
The IRS lists warning signs on both sides of the relationship. In the office, watch for:
- E-filed returns rejected because a client's Social Security number was already used.
- More e-file acknowledgements than returns you filed.
- A cursor that moves or changes numbers without anyone touching the mouse or keyboard.
- Staff locked out of the network or their computers, or IRS notices about clients you do not represent.
Clients may report authentication letters (5071C, 4883C or 5747C) for a return they did not file, transcripts they did not request, or an IRS Online Account they did not create, according to IR-2026-111 (Sept. 16, 2026). The IRS recommends checking e-file acknowledgements daily and EFIN usage weekly.
What should the firm do this quarter?
Make verification a written routine before busy season starts, so no one has to make a judgment call under deadline pressure. Steps drawn from IRS guidance include:
- Treat any unsolicited "new client" email with a link or attachment as suspect. Confirm the person through a phone number you found independently before opening anything.
- Handle EFIN, PTIN or e-Services requests only by logging in to the provider or IRS portal directly, never through a link or fax number in the message.
- Require a call-back to a known number before anyone sends W-2 data or changes payment details, regardless of who appears to be asking.
- Check sender addresses for small misspellings or different domains, such as irs.com instead of IRS.gov, as IR-2026-85 advises.
- Brief staff on these specific lures. The FTC Safeguards Rule at 16 CFR 314.4(e) calls for security awareness training updated as necessary, and 314.4(c)(5) calls for multi-factor authentication for anyone accessing an information system.
Staff also need to know where reports go. The IRS reporting page asks tax professionals to send spear phishing emails, including new client and EFIN lures, to phishing@irs.gov with the subject "Spearphishing" (or "EFIN" for EFIN fax requests) and to report them to TIGTA. A business that sent W-2 data should email dataloss@irs.gov with the subject "W2 Data Loss" and file a complaint with the FBI's IC3.
If client data may have been stolen, the IRS asks firms to contact their local Stakeholder Liaison right away so it can block fraudulent returns, and to notify state tax agencies through the Federation of Tax Administrators. Separately, 16 CFR 314.4(j) requires notice to the FTC within 30 days of discovering an event involving the information of at least 500 consumers. Publication 4557 covers the broader safeguards in more detail.
For the controls behind these steps, see our FTC Safeguards Rule checklist for tax preparers and our guide to hardening workstations before tax season 2027.
How can s90 help?
s90 manages IT, security and compliance documentation for CPA firms and tax practices in Los Angeles and Orange County. If you would like a second set of eyes on how your staff verify requests and report suspicious messages before the 2027 season, we are happy to talk it through.
