Accounting firms should complete a security-plan and access review in late summer or early fall, rehearse suspicious-message procedures before workload rises, recheck controls just before filing volume increases, and use short reminders throughout filing season. This rhythm addresses the IRS warning that the “new client” scam peaks during busy tax filing season, while recognizing that phishing remains a year-round risk.
The calendar below is an operating framework, not an IRS forecast. IRS materials do not establish a universal month-by-month phishing rate for accounting firms. Adapt the timing to your filing deadlines, staffing model, tax applications, cloud services and Written Information Security Plan (WISP).
As an Amazon Associate I earn from qualifying purchases.
What the calendar is designed to prevent
In the “new client” scam, a criminal poses as a prospective client and sends a link or attachment presented as tax information. Opening it can expose an employee’s email credentials or provide a path into systems and client data. The IRS says this particular scam peaks during the busy filing season; that statement should not be broadened into a claim that every phishing attack peaks in one month.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Other messages may impersonate the IRS, a bank, a software provider, a colleague or another trusted organization. They can arrive by email, text, social media, telephone or letter and often create urgency. Recent IRS campaign material also warns about attempts to obtain professional identifiers such as an Electronic Filing Identification Number (EFIN), Preparer Tax Identification Number (PTIN) or Centralized Authorization File (CAF) information.
#1 Best Overall
A practical calendar gives managers a scheduled point to check protections instead of relying on a one-time awareness presentation. It also ensures that a response plan and contact list can be found during the busiest workday.
The tax-season readiness calendar
| When | Primary objective | Actions to complete |
|---|---|---|
| Late summer to early fall | Review the plan and ownership | Update the WISP; confirm security and incident-response owners; review access to email, tax software, cloud storage and administrator accounts; verify multifactor authentication (MFA), unique passwords, updates, backups and secure record storage; refresh IRS, state, leadership and technical-support contacts. |
| October to November | Rehearse before workload rises | Brief staff on the new-client lure; practice verifying unusual requests through a trusted channel; review IRS and trusted-party impersonation, fake cloud portals and payroll or payment manipulation; check secure file-transfer routines and the prohibition on using public Wi-Fi for tax records; use National Tax Security Awareness Week as a reminder when that year’s dates are published. |
| December through filing-season opening | Confirm controls under real conditions | Recheck MFA, password uniqueness, software updates, device protection and backups; confirm internal reporting routes for suspicious messages and the IRS submission route; highlight EFIN, PTIN and CAF theft attempts; ensure managers can locate the WISP and response contacts. |
| Busy filing period | Keep attention active | Send brief, frequent reminders to pause, avoid unsolicited links or attachments and verify unusual requests; watch for new-client messages and account or portal prompts; escalate suspected credential exposure or data theft promptly; continue the routine after the filing deadline. |
| After the filing rush | Learn and reset | Review reports, near misses, account changes and incidents; update training and the WISP; restore routine patching, access reviews and backup checks if peak workload delayed them. |
Late summer to early fall: make the WISP usable
Tax and accounting professionals must create and maintain a WISP under current IRS guidance. The document should not sit in a compliance folder that nobody can reach during an incident. Confirm who can approve account changes, who contacts technical support, who coordinates with leadership and who communicates with clients or authorities.
Confirm the systems and people covered
Inventory the accounts that can expose client information: employee email, tax-preparation applications, cloud storage, remote-access tools and administrative consoles. Review who still needs access, remove accounts that no longer have a business purpose and verify that administrator access is limited to the people who require it. The IRS recommends MFA where available and strong, unique passwords for accounts; check both settings rather than assuming a provider enabled them automatically.
Verify that recovery is possible
Check that endpoint, browser, phone and application updates are installing, and confirm that backups and secure tax-record storage are functioning. A backup that has never been restored is not a demonstrated recovery option, so the responsible lead should know how the firm would retrieve records after an account or device compromise. IRS guidance also recommends encryption for sensitive records and avoiding public Wi-Fi when accessing tax records or financial accounts.
Refresh the contact sheet
List internal leadership, technical support, the firm’s incident lead, the local IRS Stakeholder Liaison and the appropriate state tax-agency reporting route. Include the process for reaching each contact without relying on the potentially compromised email account. IRS materials advise tax professionals who experience data theft to report promptly to their local Stakeholder Liaison and to follow current state instructions.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
October and November: rehearse the decisions staff must make
Teach the new-client scenario
Use a realistic example: an unsolicited prospect says a return is due soon and supplies a “prior-year return,” “W-2” or other tax document through a link or attachment. The correct first action is to pause, not to open the file. Staff should verify the prospective client through a trusted channel already obtained independently, then follow the firm’s intake and secure-file procedures.
Practice trusted-channel verification
Define what counts as trusted for your firm, such as a telephone number already recorded in the intake system or a contact method found independently of the message. Do not use the phone number, reply address or portal link supplied in a suspicious message to validate that same message. Rehearsal matters because an unusual request can look plausible when staff are handling a large queue.
Recommended Free Tools
Cover impersonation and payment fraud
Remind employees that an unexpected request can imitate the IRS, a bank, a software provider, a colleague or a government agency. Payroll and human-resources teams should be especially cautious with requests to change employee tax, payroll or payment information, and with fake invoices. Verify any sensitive change through a known channel before acting.
Use annual awareness events correctly
The IRS National Tax Security Awareness Week ran December 1–5 in 2025, ahead of the 2026 filing season. Treat those dates as historical scheduling information. When the IRS publishes a new schedule, use the event as a timely reminder rather than assuming the dates repeat every year.
December through filing-season opening: recheck, do not assume
Controls can drift after a new hire, software migration, phone replacement or emergency access change. Before filing volume rises, verify MFA enrollment, password uniqueness, device protection, current software and backup status again. These are recurring safeguards, not setup tasks that can be checked once and forgotten.
Make the reporting path visible: where an employee forwards or reports a suspicious message internally, who decides whether an account must be isolated or a password reset, and how the firm submits an unsolicited email claiming to be from the IRS. IRS guidance directs recipients to report such email to [email protected]. Follow the IRS submission instructions and the firm’s incident process; do not forward sensitive client data indiscriminately.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsInclude a short reminder that criminals may seek EFIN, PTIN or CAF information. A request for one of these identifiers deserves the same independent verification as a request for a password or payment change.
During the busy filing period: short reminders, fast escalation
Long training sessions compete with filing work. Use brief prompts in team meetings, internal chat or the firm’s task system:
- Pause before opening an unexpected tax document, link or portal prompt.
- Verify unusual requests through a known trusted channel.
- Never enter credentials into a page reached from an unsolicited message without independent verification.
- Report suspected credential exposure immediately, even when no data loss is yet visible.
Pay particular attention to new-client messages and cloud-login prompts. Historical IRS guidance describes realistic fake cloud portals that collect preparers’ credentials; current IRS guidance recommends MFA for cloud services, which can reduce the damage from a stolen password but does not make a fraudulent message safe to open.
If staff believe credentials or client data may have been exposed, use the written response plan immediately. The IRS says rapid reporting can help it take steps to block fraudulent returns filed in clients’ names. Do not wait for the filing deadline to pass. IRS guidance also describes scams as a continuing concern, so the end of a particular filing rush is not a reason to stop reporting or monitoring.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
After the filing rush: turn observations into changes
Schedule a short review while events are still fresh. Examine suspicious-message reports, near misses, unexpected account changes and any incident response. Identify which verification step failed or was difficult to follow, then update the WISP, contact sheet and staff instructions. This is a management loop: the next season’s calendar should reflect what employees actually encountered.
Restore any routine work postponed during peak volume, including patching, account-access reviews and backup checks. Keep the WISP current when systems, vendors, office locations or responsibilities change.
Threat patterns and the warning signs to teach
New-client spear phishing
The sender claims to be a prospective client and supplies a tax-related link or attachment. Urgency, a request to start work before an intake call, an unfamiliar file-sharing site or pressure to use a personal email address are reasons to stop and verify. The IRS specifically identifies this scam as peaking during busy filing season.
IRS or trusted-party impersonation
A message may demand immediate action, threaten penalties or offer a refund. Verify through contact details already held by the firm or published independently, not through message-supplied links or numbers. The channel can be email, text, social media, phone or physical mail.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fake cloud portals
A realistic sign-in page may imitate a tax, storage or collaboration service. The objective is to harvest credentials for later access. Use MFA, avoid signing in from unsolicited links and report the message according to the firm’s process.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Professional-identifier theft
Requests for EFIN, PTIN or CAF details can support fraudulent filing activity or impersonation. Treat these identifiers as sensitive business information and verify the requester independently.
Payroll and payment manipulation
Fake invoices, W-2 requests and payroll-change instructions target the payment and human-resources workflows that may be adjacent to tax preparation. Require an independent confirmation before changing bank details, employee information or payment instructions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Baseline safeguards the IRS recommends
| Safeguard | What the firm should verify |
|---|---|
| Multifactor authentication | MFA is enabled wherever available, especially for email, cloud services, tax software and administrator accounts. |
| Passwords | Passwords are strong and unique for each account; exposed or reused credentials are changed promptly. |
| Updates | Operating systems, browsers, phones and applications receive current security updates. |
| Secure records | Tax records are stored securely, with encryption appropriate to the firm’s systems and backups that can be recovered. |
| Network habits | Employees avoid public Wi-Fi for tax records and financial accounts unless the firm’s approved protections and procedures address the risk. |
| Awareness and reporting | Staff know how to recognize scams, verify unusual requests and report suspected phishing internally and to the appropriate authority. |
| Written Information Security Plan | The firm maintains a current WISP that assigns ownership, describes safeguards and gives employees an accessible response process. |
These measures are IRS recommendations, not a guarantee that a firm cannot be compromised. Their value comes from combining technical controls with repeatable human decisions and a response plan.
What to do when someone clicks or credentials may be exposed
- Report internally at once. Tell the designated incident lead and preserve the message, headers, attachment and relevant timestamps according to the firm’s procedures.
- Contain the account or device. Follow the WISP and technical-support instructions for password reset, session revocation, device isolation or other containment. Do not improvise actions that could destroy useful evidence.
- Assess what was reachable. Determine whether email, tax software, cloud storage, client records or professional identifiers were exposed.
- Contact the right authorities promptly. For tax professionals victimized by data theft, IRS guidance points to the local Stakeholder Liaison. Follow current state tax-agency instructions and any applicable federal fraud or law-enforcement reporting route.
- Notify affected parties through the approved process. Use the firm’s legal, leadership and communications procedures, taking account of the state requirements that apply to the affected records.
- Update the plan. Record the control or decision point that failed, then revise the WISP, training and calendar before the next filing cycle.
How to judge whether the calendar is working
Use operating evidence rather than a guessed seasonal attack rate. A sound review asks whether the firm completed its WISP update before the season, whether email, tax software and cloud-storage access were checked, whether staff practiced independent verification, whether reminders continued during peak workload, and whether response contacts were reachable. The calendar is stronger when these checks are documented and repeated after major staffing or system changes.
Frank J. Bisignano, the IRS chief executive officer, summarized the year-round principle: “Taxpayers and tax professionals can help protect sensitive information and strengthen the security of the tax system by making cybersecurity practices part of their routine year-round.” Taylor Rodier of Drake Software similarly described tax professionals as trusted partners whose protection of client data is essential to the integrity of the tax system. Those statements support a steady operating rhythm, not a promise that one training date will eliminate phishing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
