Here is a time-saving tip for busy season. Pick one password and use it for your tax software, your client portal, your IRS e-Services account, and the firm’s bank login. Add the year to the end if you are feeling cautious. You will save several seconds a day, and whoever finds that password in a leaked list will save even more.
For partners and firm managers who would rather not explain a breach to clients in March, here is what password reuse costs a firm and how to stop it.
Key takeaways
- Credential stuffing turns a breach at an unrelated website into access to your firm, and it only works when passwords are reused.
- Firm logins are chained together, so one reused password can expose email, client documents, and bank accounts.
- The FTC Safeguards Rule requires multi-factor authentication (MFA) for anyone accessing client information, and IRS Publication 4557 calls for strong, unique passwords on every account.
- A password manager, multifactor authentication, individual logins, and breached-password screening close most of the gap.
Why password reuse hits accounting firms harder
A tax and accounting firm holds Social Security numbers, bank details, and prior-year returns: everything a criminal needs to file a fraudulent return or redirect a refund. Attackers rarely guess their way in. They collect usernames and passwords from breached websites and let automated tools try those same combinations against other services. This is credential stuffing.
The attack depends entirely on reuse. If a staff member’s portal password has never been used anywhere else, a breach at another website gives the attacker nothing.
Firm logins are also connected. Email resets the portal password. The portal holds the documents. The bank login moves the money. One reused password can open all three.
A hypothetical example
Picture a fictional four-partner firm. A staff accountant uses the same password for the firm’s document portal and for a continuing education website. The education site is breached. In February, an automated tool tries that email and password on the portal, where staff accounts have no multifactor authentication. The attacker downloads prior-year returns for dozens of clients. Weeks later, those clients start receiving e-file rejections because a return has already been filed in their name.
The firm’s software was never hacked. Someone logged in with a password that worked.
Recommended Articles
Action steps for firm leaders and IT
- Inventory every login that touches client data or money: Include tax preparation software, the client portal, e-Services, payroll, banking, practice management, and email.
- Deploy a business password manager: Each of those logins gets a unique, generated password, and staff remember one strong passphrase.
- Require MFA on all of them: Never opt out of MFA in your tax software, and use the strongest option your bank offers.
- Give every preparer an individual login: That includes seasonal staff. Avoid shared accounts, and end seasonal access when the season does.
- Screen for breached passwords: Ask IT to block known compromised passwords, which current NIST guidance calls for, and to monitor for firm credentials appearing in new leaks.
- Change passwords when there is evidence of exposure: Calendar-based changes encourage predictable patterns such as the same word with a new season on the end.
- Update your Written Information Security Plan: The WISP should describe your password and MFA rules as they are practiced, not as they were drafted years ago.
These steps also make a useful checklist for advisory conversations. Your business clients run payroll, banking, and accounting systems behind the same kinds of logins, and many of them share credentials with your firm.
Questions your clients may ask
Q: How is my tax information protected when I upload it to your portal?
A: The portal is encrypted, and every staff member signs in with a unique password and a second verification step.
Q: Who at your firm can see my return?
A: Only the staff assigned to your work. Each has an individual login, so access is recorded by person.
Q: What happens if one of your employees’ passwords is stolen?
A: A password alone will not get anyone into our systems. We also monitor for exposed credentials and change them immediately when one appears.
Q: Why do I need a code from my phone to log in to the portal?
A: Passwords get stolen from other websites every day. The code keeps a stolen password from being enough to reach your documents.
Before busy season starts
Password reuse is a habit, and habits are easiest to change when the office is quiet. A firm that spends a few hours this fall on a password manager rollout, MFA enforcement, and a WISP update goes into filing season with a far smaller target on its back. A firm that waits is betting that none of its staff has ever reused a work password on a website that was later breached.
ABOUT THE AUTHOR:
Scott Carr, owner of Farmhouse Networking in Grants Pass, Oregon, is a veteran Network & Computer Systems Architect with over 30 years of IT experience. For over a decade, he’s led his team in delivering proactive, secure, and fully managed IT services to more than 80 businesses—including accounting and finance firms that rely on data security, compliance, and efficiency. Scott’s hands-on, jargon-free approach ensures every client understands their technology and gains confidence in their systems. His firm is known for fast, responsive support—most issues are resolved within 15 minutes—and deep expertise in cybersecurity, network design, and IT compliance. Learn more about how Farmhouse Networking supports the accounting industry at https://www.farmhousenetworking.com/finance-it-support/.
Photo credit: Upklyak/Freepik
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
