The phishing scams targeting tax preparers most often pose as a new client with an attached "return", as the IRS or e-Services, or as the firm's software or storage vendor. Each pushes for a quick click. Staff spot them by checking the sender's real address, hovering before clicking, and confirming any urgent request by phone.
The new-client phishing scam aimed at tax preparers
The new-client phishing scam is an email from a stranger posing as a prospective client, usually with an attachment or link described as last year's return or a W-2. Opening it installs malware that lets the sender watch the preparer's screen or record keystrokes. It works because answering prospects is a normal part of a preparer's day.
The IRS names this scam directly. Its release IR-2026-85 (Aug. 4, 2026) says "new client scams target tax pros with emails from senders who pretend to be potential clients," with the aim of getting practitioners to open links or attachments "that infect computer systems to steal client information."
IRS Publication 4557 (Rev. 6-2024) describes what that attachment can do. It may contain malware, and "a common malware is keystroke tracking," which lets the criminal see what the preparer types and so collect usernames and passwords for the tax software, the bank or encrypted client files. The same publication tells firms: "Never open or download attachments from unknown senders, including potential clients; make contact first by phone, for example."
The fake prospect has a recognisable shape. The message is polite but vague about who referred them. It describes a tax situation in general terms ("I have some rental income and a side business") and then asks the preparer to review an attached file before any call. The attachment is often a compressed file, a document that asks to enable editing or macros, or a link to a "secure document" on a file-sharing page that asks for an email password.
A firm-level rule removes most of the risk: new prospects get a phone call or a short intake form first, and documents arrive only after the engagement starts, through the firm's normal channel. When every client has a file and a known route for sending documents, an emailed attachment from someone with no client file stands out as unusual. Schema CPA, for example, gives each client one upload link and keeps what that client sends in one file; the workflow section of the homepage shows the collect step. The post on what a client portal for accountants does covers the other common way firms take in documents, and the client document collection category covers intake in general.
IRS and software-vendor impersonation emails
IRS and software-vendor impersonation emails pretend to come from the IRS, e-Services, the PTIN system, the firm's tax software maker or its cloud storage provider. They ask the preparer to update an account or install an update through a link. The fix is to ignore the link and reach the sender through a bookmark or known phone number.
Publication 4557 tells firms to "learn to recognize phishing emails, especially those pretending to be from the IRS, e-Services, a tax software provider or cloud storage provider." It describes the usual pattern: an urgent subject line such as "Update Your Account Now" and a link to "a fake web page designed to look like a familiar website," with IRS e-Services given as the example. Entering a username and password there hands them to the thief.
The IRS also says what it does not do. IRS Publication 5293 (5-2018), the Data Security Resource Guide for Tax Professionals, says: "The IRS never initiates initial email contact with tax pros about returns, refunds or requests for sensitive financial or password information." The current IRS page on reporting fake IRS emails (reviewed July 30, 2026) adds: "We never email without your permission."
Confirming the real sender takes three checks:
- The domain. IR-2026-85 lists an address or link that is "slightly misspelled or has a different domain name or URL," and gives the example "irs.com instead of IRS.gov."
- The route in. Open e-Services, the PTIN account or the software's admin page from a saved bookmark, not from the email. If a notice is real, it will be waiting there.
- A known phone number. Call the vendor's support line from the number on its website or an invoice, never the number in the message.
Suspicious IRS-related messages go to phishing@irs.gov. The IRS reporting page asks senders to use "Forward as attachment" if their email program has it, because plain forwarding strips data the IRS needs to trace the sender.
What do spear phishing emails to tax preparers look like?
Spear phishing is a phishing email written for one specific person or firm, using real names, vendors and deadlines to look routine. IR-2026-85 says it "targets a specific person or firm and delivers a more realistic email known as a lure." The three examples below show where the warning signs sit.
Publication 4557 notes the thief may find the target's address on the office website, and may pose as the bank or "a professional colleague whose email was compromised." All three samples are fictional. Names, domains and numbers are invented for illustration, and the domains use the reserved .example ending.
Sample 1: the prospective client
From: Daniel Reyes dreyes.consulting@mail-inbox.example Subject: New client - need help before deadline
Hi, a friend recommended your firm. I had a messy year with a rental and some 1099 work. I've attached my prior return and W-2s. Can you look and tell me if you can take me on? I need to file soon.
Attachment: 2025_return_docs.zip
Warning signs: (1) no named referrer; (2) a free-mail address with no business behind it; (3) a compressed attachment sent before any call; (4) time pressure ("I need to file soon").
Sample 2: the e-Services notice
From: IRS e-Services no-reply@irs-eservices-support.example Subject: ACTION REQUIRED: Your e-Services access expires in 24 hours
Your e-Services account will be suspended due to incomplete identity verification. Click here NOW to verify and avoid disruption to e-file.
Warning signs: (1) a domain that is not irs.gov; (2) a 24-hour deadline; (3) a "Click here NOW" call to action, the exact phrase Publication 4557 uses as its example; (4) an unrequested email about account access, which the IRS says it does not send.
Sample 3: the colleague with a shared file
From: Karen Holt, CPA karen.holt@holtcpa-partners.example Subject: Re: client file you asked about
Here is the file we discussed. It's in our shared folder: [View document]. You'll need to sign in with your email account.
Warning signs: (1) "Re:" on a thread that never existed; (2) a domain one letter off the colleague's real one; (3) a document link that asks for the preparer's email password. IR-2026-85 lists "a duplicate email from what appears to be a known trusted source that contains a new attachment or hyperlink" as a sign in its own right.
Running a phishing drill for tax season staff
A phishing drill is a short exercise where staff look at sample emails, decide which are fake, and say what they would do next. A small firm can run one in 30 minutes in November or December, before new prospects and IRS notices start arriving in January, and repeat a shorter version when seasonal staff join.
Publication 4557 says "all employees in your office must be educated on the dangers of phishing scams" and that "educated employees are the key to avoiding phishing scams." Its FTC checklist adds security awareness training with regular refreshers. A drill turns that into a habit people practise rather than a policy they signed.
One-page staff drill script (example)
This script is an example for a fictional five-person firm. Adapt the names and timing.
- Set up (5 minutes). The owner prints the three sample emails above, plus two real, harmless emails the firm received this month. Remove sender details from the real ones so nobody recognises them.
- Sort (10 minutes). Each person marks every email "real" or "phishing" and circles the parts that decided it. No discussion yet.
- Reveal (5 minutes). Go through each email. For the fakes, read out the warning signs listed under each sample. For the real ones, point out what made them trustworthy, such as an expected sender and no request for a login.
- Practise the response (5 minutes). Ask each person: "You clicked sample 2 and typed your password. What do you do in the next ten minutes?" Check the answers against the steps in the next section.
- Debrief (5 minutes). Agree on three rules and write them on one card for each desk: no attachments from prospects before a call; no logins from email links; any surprise login prompt or odd request goes to the owner.
Record who attended and the date. Run the response step again on each new hire's first day. Two follow-ups make the drill stick: forward any real suspicious email to the group with the warning signs marked, and thank people who report one, even when it turns out to be harmless.
A drill also tests the backstop. If someone enters a password into a fake page, multi-factor login is what stops the thief from using it; the post on multi-factor authentication for tax professionals covers which factor types hold up against phished codes.
What should a preparer do after clicking a phishing link?
A preparer who clicks a phishing link or opens a bad attachment should disconnect the computer from the network, change exposed passwords from a different device, and tell the owner, all within the first ten minutes. Speed matters more than certainty. A false alarm costs a few minutes; a hidden infection can expose every client file on the network.
Publication 4557's checklist for a breach says to "take immediate action to secure any information that has or may have been compromised" and gives the example: "if a computer connected to the Internet is compromised, disconnect the computer from the Internet." It also says to "preserve and review files or programs that may reveal how the breach occurred."
The first ten minutes, in order:
- Minute 0 to 2: disconnect. Unplug the network cable or turn off Wi-Fi on the affected computer. Do not shut it down or wipe it; leave it as it is for whoever investigates.
- Minute 2 to 6: change passwords from another device. If a password was typed into a fake page, change it now from a computer or phone that was not involved, starting with email, then the tax software and storage. Sign out other sessions where the service allows it.
- Minute 6 to 10: tell the owner. Say what was clicked, when, and what was typed or downloaded. Write it down while it is fresh.
After that, the owner decides whether a security professional should check the machine and whether client data may have been exposed. Publication 4557 tells firms to forward IRS-related phishing to phishing@irs.gov. If client data was taken, a separate reporting process starts with the IRS Stakeholder Liaison; the post on how to report data theft to the IRS as a tax preparer walks through it in order.
The most common mistake after a click is silence. A preparer who is embarrassed and says nothing gives the attacker days instead of minutes. Make reporting a click the easy, blame-free path, and say so in the drill.