To stop emailing tax documents, give every client one other place to send files, put a no-email rule in the engagement letter and the season's first message, and answer each stray attachment the same way: move the file, delete the email copy, and point the client back to the agreed route. Staff follow the same rule internally.
Is it safe to email tax documents?
Emailing tax documents is risky because an ordinary attachment is only as protected as the weakest mail system it passes through, and it then sits in inboxes, sent folders and backups for years. IRS Publication 4557 tells tax professionals to encrypt sensitive emails or to use another transfer method instead of email.
The exposure has three parts, and each one lasts longer than people expect.
In transit. Mail services encrypt the connection between mail servers with Transport Layer Security (TLS) only when both ends support it, so a client sending a W-2 from a small or old mail provider may not get that protection, and neither the client nor the firm will usually notice. What TLS covers and what it leaves open is explained in TLS versus message-level email encryption.
In inboxes. Once delivered, the attachment sits in the client's sent folder and the firm's inbox. If either account is taken over through a phishing email, every W-2, 1099 and brokerage statement in it is available to the attacker. IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) notes that thieves "may hijack your email account" and use it to send messages under the owner's name.
In archives. Deleting a message from the inbox rarely deletes every copy. Mail clients sync to phones and laptops, and many firms keep mail backups. A Social Security number emailed in 2021 can still be sitting on a former employee's old phone.
The IRS guidance is direct on this. Publication 4557 (Rev. 6-2024) tells tax professionals to "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email." Its checklist, drawn from FTC suggestions, also says to "Caution customers against transmitting sensitive data, like account numbers, via email or in response to an unsolicited email or pop-up message." The FTC's Safeguards Rule, as written at 16 CFR 314.4 on eCFR (current as of October 2026), requires covered firms to protect customer information by encryption "both in transit over external networks and at rest," or to use approved compensating controls where encryption is infeasible.
How in-transit and at-rest encryption differ, and where client files end up unprotected, is covered in encryption at rest vs in transit, for accounting firms.
Is texting tax documents any safer than email?
Texting tax documents is usually no safer than email, and often worse. A phone photo of a W-2 sent by text can travel unencrypted over the carrier network, stays on both phones, and may be copied into the photo library and any cloud backup the owner has turned on. A lost phone exposes every image on it.
Carrier text messages are the weak link. The CISA Mobile Communications Best Practice Guidance (version 2.0, November 24, 2025) states plainly that "SMS messages are not encrypted," and that a threat actor with access to a telecommunication provider's network who intercepts them can read them. The same guidance recommends end-to-end encrypted messaging, but a firm cannot control which app a client's phone falls back to when a message will not send that way.
The photo is a second copy, separate from the message. When a client photographs a 1099 to text it, the picture usually lands in the camera roll first. Whether it then syncs to a cloud photo service depends on the client's settings, which the firm cannot see. Ask clients to delete the photo after the firm confirms receipt, and do the same on any firm phone that received one.
Lost phones are the third risk: a firm phone full of texted W-2s with no screen lock exposes every image on it. Why device encryption protects a lost phone, and where it stops helping, is covered in what encryption at rest protects.
Texting still has a place: as a reminder channel, not a document channel. A text that says "Your 1099-B is still outstanding; please send it through the link we emailed" carries no client data. The post on text message reminders for tax documents covers how to word those and when to send them.
Writing the firm's no-email document policy for clients
A no-email document policy is a short, plain statement telling clients that the firm will not accept or send tax documents by email or text, naming the route the firm uses instead, and saying what happens to anything that arrives by email. It belongs in the engagement letter and in the first message of every season.
Keep it to one paragraph. Clients skim engagement letters, so the policy has to make sense in a few seconds. It should answer three questions: what not to do, what to do instead, and what the firm will do if a client emails a document anyway.
Name the alternative before the prohibition sinks in. A policy that only says "do not email" leaves the client stuck. Give one route and the instructions to use it. Most firms use a per-client upload link, a client portal or an encrypted file transfer; the right choice depends on the client base, and how to get clients to send tax documents covers the habits that make any route stick.
Here is an example paragraph a firm could adapt. The firm name and wording are fictional.
How to send us your documents. To protect your Social Security number and account details, Example Ridge CPAs does not accept tax documents by email or text message, and we will not send your return by email. Please upload every document, including phone photos, through the personal upload link we send you each January. If you email us a document by mistake, we will move it to your file, delete the email, and reply to remind you of the upload link. If you cannot use the link, call us at (555) 010-4821 and we will arrange another way.
That paragraph does four jobs: it gives the reason in one clause, names the single route, covers phone photos, and promises a consistent response to mistakes. The phone number gives clients who struggle with technology a way out that does not involve attaching a W-2 to an email.
Repeat the policy where clients will see it. Put it in the engagement letter, the first request of the season, the email signature of anyone who handles client documents, and the auto-reply on the firm's intake mailbox. Consistency matters more than wording.
Expect some clients to keep emailing for a season or two. The goal is to make email the inconvenient option, not to refuse service. A firm that sometimes accepts emailed documents without comment teaches clients that the policy is optional.
What to do when a client emails a tax document anyway
When a client emails a tax document anyway, the firm saves the file to the client's folder, deletes the email from the inbox and the trash, and replies without attaching anything to remind the client of the upload route. The same steps every time keep the response quick and keep the habit from spreading.
Work through the steps in this order:
- Save the attachment to the client's file. Do not leave it as the only copy in the inbox. A document deleted before it is saved is a document the client has to send twice.
- Delete the email from the inbox, then from the deleted items or trash folder. Check whether the firm's mail system keeps a recoverable copy after that, and note what your retention settings do.
- Reply without quoting the original message. A reply can carry the earlier message and its attachment details along with it. Start a fresh message or remove the quoted text.
- Ask the client to delete the sent copy. The client's sent folder is outside the firm's control, so the request is all the firm can do.
- Note it on the client's record. A client who emails documents three times in one season needs a call, not a fourth template.
Here is an example reply for an emailed W-2. Names are fictional.
Subject: Your document arrived; next time, please use your upload link
Hi Dana,
Thanks for sending your 2026 W-2 from Lakeside Logistics. We have saved it to your file and deleted the email from our system, because email is not a safe way to send documents with your Social Security number on them.
For anything else this season, please use your personal upload link: it is in the email we sent on January 6. You can also upload phone photos through the same link.
Could you also delete the message from your sent folder? If the link gives you any trouble, call us at (555) 010-4821.
Thanks, Priya, Example Ridge CPAs
The subject line names no form and no client details. That habit keeps personal details out of inbox lists, search results and phone notifications, where anyone glancing at a screen can read them.
When the firm itself must send something sensitive by email, such as a document a third party insists on receiving that way, use message encryption rather than a plain attachment. The post on email encryption for accountants walks through the built-in options and what the recipient has to do to open one.
Stopping internal email of tax documents between staff
Internal email of tax documents is staff sending client files to each other, or to themselves, as attachments. It recreates every risk of client email inside the firm, multiplies copies across mailboxes and devices, and leaves no clear record of which copy is current. The fix is a rule that staff share a location, never a file.
The habits that leak data inside a firm are familiar:
- Forwarding a client's email to a colleague so they can "take a look." The attachment now lives in two mailboxes.
- Emailing files to a personal address to work from home. Publication 4557 (Rev. 6-2024) suggests firms "Develop policies for employees who telecommute," including whether staff may keep or access customer data at home.
- Attaching a return to an internal review request instead of pointing to where it is saved.
- Sending scans from the office copier to email. A copier set up to scan to email puts every scanned W-2 in someone's inbox.
Replace each one with a pointer. A review request says "Return for the Moreno household is in the 2026 folder, ready for review" instead of attaching the PDF. Copier scans go to a shared folder rather than an inbox. A preparer who needs to work remotely uses the firm's remote access, not a personal email account.
Who can open each folder matters as much as where files live. If every staff member can see every client, moving files out of email only moves the exposure. The post on access controls for accounting firm staff covers mapping roles to folders.
A single intake point makes the internal rule easier to keep. Schema CPA gives each client one upload link, and email attachments, phone photos and portal downloads all land in that client's file, sorted by document type, issuer and period. Staff then work from one file instead of forwarding attachments to each other, and the workflow section of the homepage shows each step. The firm's own security measures still decide who can open that file and how it is protected.
Check the habit at the end of each season. Search staff mailboxes for common attachment names such as "W2," "1099" and "K-1." Each hit is a copy that should have been saved to a client file and deleted, and a sign of where the rule is not yet followed.