Executive Summary
- Client documents sent as email attachments end up in mailboxes, backups, and devices your firm does not control.
- “Anyone with the link” sharing needs no sign-in and can stay active long after the engagement ends.
- The FTC Safeguards Rule treats tax preparers and accounting firms as financial institutions, with written security plan and encryption requirements.
- A secure client portal, encrypted email for exceptions, and a short written policy close most of the gap.
- Review sharing settings and existing links before the next filing deadline.
Meet Marcy, the hypothetical owner of a six-person tax and accounting firm. It is the last week of March, and her inbox is a conveyor belt. Clients send W-2s and bank statements as attachments. Staff reply with draft returns as attachments, Social Security numbers, and all. Marcy’s rule: if the client emailed it, we email it back. Nobody has time for a portal login.
In April, one client’s email account is compromised. The attacker finds a thread that has gone back and forth for weeks, and every attachment in it is now theirs.
Why this matters for accounting firms
The FTC Safeguards Rule treats tax preparers and accounting firms as financial institutions. That means a written information security plan and encryption of customer data in transit and at rest. IRS Publication 4557 lays out what the IRS expects tax professionals to do to protect taxpayer data. If a security event involves unencrypted information on 500 or more consumers, the FTC expects notice within 30 days of discovery.
Email is where many firms leak. Your mailbox holds years of returns, and your clients’ mailboxes hold the other copy. You control only one of them, and your clients are trusting you with both.
Common risk points:
- Attachments in both directions: Clients send them, staff reply to them, and the thread lives on indefinitely.
- Photos of bank statements sent by text or personal email: Convenient for the client, unmanaged for the firm.
- “Anyone with the link” folders: Handy during busy season, still open in July.
Action steps for firm owners and IT
Owner decisions
- Update your written information security plan to name the approved channels for client documents.
- Tell clients up front, in the engagement letter, that documents move through the portal.
- Set a retention rule for client documents and attachments in mailboxes.
- Assign one person to review external sharing each quarter.
IT tasks
- Deploy a secure client portal for document exchange and make it the default path.
- Turn on data loss prevention to flag or block SSNs and account numbers in outbound email.
- Offer encrypted email for the occasional exception.
- Restrict “anyone” links, default to specific people, and set expiration.
- Audit existing shares and revoke anything stale.
- Remove old attachments from mailboxes once files are saved to the document system.
- Require multifactor authentication on mail, portal, and storage accounts.
- Monitor for mass downloads and unusual external sharing, and remove access promptly when staff leave.
Questions your clients may ask
Clients notice when a firm changes how it handles their documents. Prepare answers before they ask.
Q: Why can’t I just email you my W-2?
A: Email attachments sit in mailboxes and backups long after the return is filed. The portal keeps your documents in one protected place, with a record of who accessed them.
Q: Can I send a photo of my bank statement by text?
A: Please use the portal’s upload feature instead. Text messages are stored by carriers and on devices we cannot secure.
Q: How long do you keep my documents?
A: We keep them for the period our retention policy requires, then dispose of them securely.
Q: How do I know a portal link is really from your firm?
A: We will never ask for your password or SSN by email or text. If a message feels wrong, call us before clicking.
Make the safer path the easy path
Most file-sharing breaches start with a reasonable shortcut taken under deadline pressure. Clients will follow whatever process makes their own lives easiest, so the firm has to make the secure option the simple one. A portal that takes a minute to use beats a policy that nobody follows.
Start with an audit of what is already shared, then fix the defaults, then change the habits. The sequence matters, because old links stay live until someone finds them.
ABOUT THE AUTHOR:
Scott Carr, owner of Farmhouse Networking in Grants Pass, Oregon, is a veteran Network & Computer Systems Architect with over 30 years of IT experience. For over a decade, he’s led his team in delivering proactive, secure, and fully managed IT services to more than 80 businesses—including accounting and finance firms that rely on data security, compliance, and efficiency. Scott’s hands-on, jargon-free approach ensures every client understands their technology and gains confidence in their systems. His firm is known for fast, responsive support—most issues are resolved within 15 minutes—and deep expertise in cybersecurity, network design, and IT compliance. Learn more about how Farmhouse Networking supports the accounting industry at https://www.farmhousenetworking.com/finance-it-support/.
Photo credit: magnific/Freepik
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
