Before the Rush: Five Email Habits Every Tax and Accounting Firm Should Set Now

From January to April, a tax or accounting practice runs on email. New client inquiries, scanned documents, portal notifications, engagement letters, payroll questions, and "can you look at this before Friday" all arrive at once, often to people working long days. That volume is useful cover for anyone trying to slip in a message that only looks routine.

The habits that help most are simple, but they are hard to teach in February. Nobody has time, and new rules introduced mid-season tend to get skipped the first time they slow someone down. Late fall is the window: the work is lighter, seasonal staff haven't started, and there is room to agree on a few rules and practice them.

What the IRS keeps warning about

The IRS and its Security Summit partners repeat the same warnings to tax professionals every year, and the 2026 versions are specific. In August, they named five kinds of attacks aimed at practices: broad phishing and text-message "smishing," targeted spear phishing, clone phishing, whaling aimed at leaders and at "payroll offices, human resource departments, and financial offices," and the new client scam, in which senders "pretend to be potential clients" to get practitioners to open links or attachments that infect their systems.¹

The IRS's 2026 "Dirty Dozen" list makes the same point: tax professionals and businesses "remain targets of 'new client' or 'document request' emails" that deliver malicious links or attachments.² And the IRS guide for practices, Publication 4557, notes that the sender "may pose as your tax software provider, your data storage provider, the IRS or even a prospective client."³

None of these depends on a technical flaw. Each one depends on a busy person doing the normal thing with a message that looks normal. That is why habits matter more than any single tool here.

1. New clients start through your intake path, not their attachment

A prospective client who emails a tax return "for a quote," or a link to "my documents," is one of the most common lures the IRS describes. Publication 4557 is direct: never open or download attachments from unknown senders, "including potential clients," and "make contact first by phone."³

Turn that into a firm rule. New inquiries get a reply pointing to your normal intake process, whether that is a phone call, a scheduled consultation, or an invitation to your client portal that you send. Staff don't open attachments or links from someone the firm has not yet spoken with. The rule protects the front desk too: "I'm sorry, our policy is to start with a call" is easier to say than a judgment call about whether a file looks safe.

2. Go to the portal yourself; don't click the notification

Clone phishing copies a real email "and resends a nearly identical message," swapping the safe link or attachment for one that leads to malware or a fake sign-in page.¹ In a season full of real "you have a new document" notices from portals, software, and storage services, a cloned one is very hard to spot by appearance alone.

The habit that sidesteps the problem: when a notification says something is waiting, open the portal or application from a bookmark or by typing the address, and look there. If the document is real, it will be there. The IRS lists "a duplicate email from what appears to be a known trusted source that contains a new attachment or hyperlink" as a specific warning sign.¹ Teach staff to treat a second copy of an email they already received as a reason to slow down, not as a reminder.

3. Any change to where money goes gets a callback

Business email compromise is mostly about redirected payments, and it is expensive. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with about $3.05 billion in reported losses.⁴ Those are only the incidents that were reported.

A tax practice handles more payment details than most firms realize: its own vendors and payroll, and in many practices, client bank information used for refunds or payments. The rule is the same for all of them. A request to change bank details, sent by email or text, is confirmed by calling the requester at a number you already had on file, never one taken from the message. For changes to the firm's own payments, a second person approves. The same check appears in Five Email Red Flags Worth Checking Before You Click or Pay.

4. Make reporting easy, and know who to call

The IRS notes that phishing attempts "are often sent to multiple email addresses at a business," increasing the chance that someone falls for one.¹ The flip side is that one person reporting a message quickly can protect everyone else who received it. Pick one simple way to report (a shared address, a button, or "message the office manager") and thank people who use it, including when the message turns out to be harmless.

Write down the outside contacts too, before you need them:

• Suspected IRS-impersonation emails go to phishing@irs.gov.²
• If client data may have been stolen, the IRS asks practices to contact their local IRS Stakeholder Liaison, "so the IRS can take steps to block fraudulent returns."⁵
• Your IT provider, and anyone else your plan names, with phone numbers rather than only email addresses.

5. Seasonal staff are trained before they get access

Many practices add seasonal preparers, receptionists, and contractors in January. They are often the people answering new client email and handling incoming documents, and they arrive at the busiest possible moment. Publication 4557 says "every employee, both professional and administrative staff, should be educated about security threats and safeguards."³

Decide now what a new hire sees before getting a login: the four habits above, how to report a suspicious message, and a few realistic examples. If your firm has a written information security plan, this is also where it already says training should happen. We walk through the training and personnel section, including who the IRS template says is covered, in What the WISP Requirement Actually Asks of Your Staff.

Why practice beats a memo

A memo in November states the rules. It doesn't build the reflex to pause when a convincing "new client" email lands at 6 p.m. in mid-March. That reflex comes from seeing realistic examples a few times, in a setting where getting it wrong costs nothing and nobody is embarrassed. We explain why short, repeated practice tends to stick better than a once-a-year session in Why Annual Security Training Doesn't Stick.

To start this week, pick one habit, write it in a sentence, and share it at your next staff meeting. For a broader self-check covering account access, payment verification, and reporting, use the Email Fraud Readiness Checklist. If you are also tightening the training section of your WISP, our WISP training one-pager sets out the requirements with citations and a short self-check.