Secure Team
Cybersecurity Training Built for Tax Preparers
Tax professionals handle some of their clients’ most sensitive information — Social Security numbers, W-2s, 1099s, income records, bank information, identification documents and complete tax returns.
During filing season, that information moves through a constant stream of emails, document uploads, client portals and employee accounts.
That creates a challenge: fraudulent messages can look remarkably similar to normal tax-season work.
Secure Team is building practical cybersecurity awareness training specifically for tax preparation firms.
Help your employees recognize suspicious emails, protect taxpayer information, verify unusual requests and know what to do when something doesn’t look right.
Built for independent tax firms, enrolled-agent practices, CPA tax teams and seasonal tax employees.
Tax Firms Handle Information Attackers Want
Tax preparation businesses have an unusual combination of sensitive information and high-volume communication.
At the same time, employees may be receiving dozens or hundreds of legitimate messages from clients.
A message saying:
“Here are the last documents for my return.”
“I uploaded my W-2.”
“Can you update my bank account information?”
That is exactly what makes social-engineering attacks difficult.
The challenge isn’t simply teaching employees what phishing means.
It’s teaching them to recognize a suspicious request when it looks like ordinary tax-season work.
SENSITIVE INFORMATION
What a Tax Office May Handle
- Social Security numbers
- W-2 and 1099 forms
- tax returns
- bank account information
- refund information
- payroll records
- business financial statements
- identification documents
- client portal credentials
- tax software accounts
- email attachments containing sensitive information
The Messages That Look Normal During Tax Season
Many security incidents begin with something that appears routine.
Secure Team focuses training on the situations tax professionals are actually likely to encounter.
Fake Client Documents
An employee receives an email that appears to come from a client:
“I finally found my missing W-2. I’ve attached it here.”
The sender looks familiar.
The attachment looks ordinary.
But the message didn’t actually come from the client.
Employees should know when to slow down, inspect the message and verify an unexpected document before trusting it.
IRS and Government Impersonation
A message may appear to relate to:
- a taxpayer account
- e-file activity
- a filing problem
- identity verification
- an IRS notice
- an account that allegedly requires immediate action
Training should help employees recognize unusual communications and follow the firm’s approved verification procedure rather than relying on appearance or urgency alone.
Tax Software and Account Phishing
Tax professionals depend on online accounts throughout the day.
An employee may receive:
“Your tax software account requires verification.”
“Your Microsoft 365 password expires today.”
“Unusual activity was detected in your account.”
A convincing fake login page can be used to capture employee credentials.
Secure Team training focuses on helping employees recognize suspicious account messages before entering passwords or authentication information.
Fake Client Portal and Cloud-Sharing Messages
Document-sharing notifications have become ordinary business communication.
A message may claim that a client shared:
- a OneDrive document
- a SharePoint file
- a Google Drive folder
- a Dropbox document
- a secure tax document
- a client portal upload
The employee’s job isn’t to distrust every file.
It’s to develop the habit of verifying unexpected requests before opening them.
Payment, Payroll and Banking Changes
Some attacks don’t involve malware at all.
Instead, someone simply asks an employee to change financial information.
For example:
“Please use this new account for my refund.”
“I changed banks. Update my direct deposit.”
“Our payment instructions have changed.”
“Please send the payment to this new account.”
Employees need a clear process for independently verifying sensitive financial changes.
Owner and Manager Impersonation
An employee receives a message that appears to be from the firm owner:
“I’m with a client and can’t call. I need this handled immediately.”
The request might involve:
- sending information
- purchasing something
- changing payment details
- opening a document
- logging into an account
Increasingly convincing written, voice and other impersonation techniques make verification procedures even more important.
Urgency should never replace verification.
Training Designed Around a Tax Professional’s Workday
Your employees don’t need to become cybersecurity specialists.
They need to know what to notice while preparing returns, answering clients, opening documents and working inside the systems they use every day.
Secure Team is being designed around short, practical lessons covering the most relevant employee risks.
Fake Client Emails
Employees learn to look more carefully at:
- sender information
- unusual wording
- unexpected attachments
- cloud-sharing links
- login requests
- changes in a client’s normal behavior
The objective is not to make employees suspicious of every client.
It’s to help them recognize situations that deserve verification.
IRS and Tax-Season Impersonation
Employees learn to recognize suspicious messages involving:
- IRS-related requests
- taxpayer accounts
- e-file activity
- tax software
- account verification
- tax documents
- urgent requests involving taxpayer information
Training focuses on behavior:
Stop. Verify. Report.
Taxpayer Data Handling
Tax-office employees routinely make small decisions involving highly sensitive information.
Should this return be sent through normal email?
Should this file be downloaded to a personal computer?
Can this document stay on a shared drive?
What should happen to printed taxpayer information?
What if a client texts a Social Security number?
Training should help employees understand the firm’s approved procedures for handling sensitive data.
Passwords, MFA and Account Protection
Employee accounts can provide access to valuable information.
Training should reinforce safer behavior around:
- business email
- Microsoft 365
- tax preparation software
- client portals
- payroll systems
- cloud accounting platforms
- multi-factor authentication requests
Employees should understand that even a professional-looking login page can be fraudulent.
Payment and Refund Fraud
Financial instructions deserve additional verification.
Training can reinforce procedures around:
- changed bank information
- refund account changes
- payroll modifications
- vendor payment instructions
- client payment requests
- unusual financial transactions
A simple verification step can prevent an employee from relying solely on an email message.
AI and Executive Impersonation
Employees should understand that a convincing message — or even a convincing voice — does not automatically prove identity.
Training should reinforce independent verification for unusual or sensitive requests.
Incident Reporting
Employees will occasionally make mistakes.
Someone may click a suspicious link.
Open the wrong attachment.
Enter credentials somewhere they shouldn’t.
Or simply realize afterward that an email didn’t look right.
A good security culture encourages employees to report those situations quickly.
The most important lesson should be:
If something feels wrong, report it immediately.
The goal is not to embarrass employees for mistakes.
The goal is to give the firm time to respond.
SEASONAL STAFF
Seasonal Tax Employees Need Security Training Too
Many tax firms expand rapidly before filing season.
A seasonal employee may only work with your firm for a few months.
But during those months, they may handle the same sensitive taxpayer information as permanent employees.
That makes security awareness an important part of seasonal onboarding.
FTC business-security guidance specifically recommends regular employee security training and says training should include temporary help and seasonal workers.
A Tax Firm May Temporarily Add
- seasonal preparers
- administrative staff
- document-processing employees
- interns
- temporary customer-service staff
Within Days, Seasonal Staff May Access
- tax software
- client portals
- taxpayer documents
- Social Security numbers
- bank information
- and internal systems.
Security Should Be Part of Seasonal Employee Onboarding
Before a seasonal employee begins handling sensitive client information, they should understand the firm’s basic security expectations.
Secure Team is being designed to make that easier.
A tax firm could assign a short seasonal security program covering:
Recognizing Suspicious Client Emails
Can the employee distinguish a normal document request from one that deserves additional verification?
Protecting Login Credentials
Does the employee know how to react to unexpected password-reset and MFA requests?
Handling Taxpayer Information
Does the employee understand where client files may and may not be stored, sent or downloaded?
Identifying Suspicious Financial Requests
Does the employee know when changes to banking or refund information require verification?
Reporting Incidents
Does the employee know exactly who to contact if something suspicious occurs?
Train Seasonal Staff Before the Inbox Gets Busy
Timing matters.
The worst time to introduce basic security concepts is after a new seasonal employee is already processing a full inbox of client documents.
A better approach is to provide security training before peak filing activity begins.
01
Before system access
Complete basic security onboarding.
02
Before client-document access
Complete taxpayer data-handling training.
03
Before peak filing season
Complete phishing and impersonation refresher training.
04
During filing season
Use short reminders and realistic scenarios to reinforce important behaviors.
This turns employee security awareness into part of normal onboarding rather than another task added during the busiest week of the year.
Short Lessons for the Busiest Time of Year
Tax professionals don’t need another hour-long presentation during filing season.
Secure Team is being designed around short, focused training.
A typical lesson might take approximately 4–7 minutes and focus on one situation.
The purpose isn’t to make the employee memorize cybersecurity terminology.
It’s to create a safer habit:
Stop. Verify. Report.
EXAMPLE LESSON
Fake Client Tax Documents
Approximate lesson time: 5 minutes
An employee receives an email:
“Hi, I just found another 1099. Please add this to my return.”
The lesson walks through:
- checking the sender
- recognizing unexpected links
- evaluating an attachment
- identifying a suspicious login page
- independently verifying unusual requests
- reporting the message
Practice Before a Real Attack Happens
Reading about phishing is useful.
Recognizing phishing during a busy workday is harder.
Secure Team is being designed to include educational phishing scenarios based on situations tax professionals commonly encounter.
The objective of a simulation should never be to embarrass someone for making a mistake.
It should help employees recognize warning signs in a controlled environment so they’re better prepared when a real message arrives.
EXAMPLE PHISHING SCENARIOS
Tax-Season Scenarios Employees May Encounter
- “Your client uploaded W-2 documents.”
- “A secure tax document has been shared with you.”
- “Your Microsoft 365 password expires today.”
- “Your tax software account needs verification.”
- “Please update my refund bank account.”
- “I’ve changed my payroll direct deposit.”
- “The owner needs this handled urgently.”
Support the Employee-Training Portion of Your WISP
Employee training doesn’t exist separately from the firm’s broader security program.
Current IRS guidance states that tax professionals are required to maintain a Written Information Security Plan (WISP) and specifically identifies employee training and management as one of the key areas a WISP should address. IRS
The IRS also says the plan should be tailored to the size, scope, complexity and sensitivity of the information the firm handles. IRS
That matters for small tax practices.
A 7-person firm does not need to operate its training program like a multinational corporation.
But it still needs an organized way to manage employee awareness.
Secure Team is being designed to help tax firms organize the training side of that process.
Planned capabilities include:
- assigning employee training
- tracking completion
- recording completion dates
- documenting topics covered
- scheduling recurring refreshers
- maintaining employee training history
- exporting straightforward training records
The IRS’s August 2026 guidance again emphasized that federal law requires tax and accounting professionals to create and maintain a WISP and identified employee management and training as a core area. IRS
Secure Team does not provide legal advice and does not guarantee regulatory compliance.
Training is one component of a broader information-security program.
Know Who Has Been Trained
When temporary employees arrive quickly before tax season, training administration can become messy.
You shouldn’t have to wonder:
- Did Sarah complete training?
- Did the new preparer receive the phishing lesson?
- Did all seasonal employees finish onboarding?
- When was the last refresher?
Secure Team is intended to provide a simple view of employee training.
This makes it easier for an owner or office manager to identify missing training before an employee is deep into filing-season work.
EXAMPLE TRAINING DASHBOARD
| Employee | Training | Status | Completed |
|---|---|---|---|
| Sarah M. | Seasonal Tax Security Onboarding | Completed | December 12 |
| Michael R. | Tax-Season Phishing | Completed | January 4 |
| David T. | Taxpayer Data Handling | Pending | — |
Example data for illustration only.
A Simple Security Training Calendar for Tax Firms
Small firms shouldn’t have to search through a library of 1,000 unrelated cybersecurity courses and decide what employees need.
Secure Team is being designed around a straightforward annual training cycle.
NOVEMBER
Seasonal Employee Security Onboarding
Prepare incoming seasonal employees before they begin handling significant taxpayer information.
Topics might include:
- phishing basics
- passwords and MFA
- client-data handling
- incident reporting
DECEMBER
Pre-Tax-Season Security Refresher
Review important security behaviors with permanent and returning seasonal staff.
JANUARY
Fake Client Documents
Practice recognizing suspicious attachments, tax-document requests and document-sharing messages.
FEBRUARY
IRS and Tax Software Impersonation
Reinforce verification during high-volume filing activity.
MARCH
Account Security and MFA
Refresh employees on protecting email, portals and tax software accounts.
APRIL
Incident Reporting
Make sure employees know what to do if they clicked something suspicious or notice unusual activity.
JUNE
Client Data Handling
Review secure handling practices after peak filing season.
SEPTEMBER
Payroll and Payment Fraud
Reinforce verification of banking and financial changes.
NOVEMBER
Annual Review
Prepare permanent staff and the next group of seasonal employees for another filing season.
This is an example framework rather than a universal schedule.
Each firm should adjust its training program to its operations, risks and applicable requirements.
Security Training Without an Enterprise Security Department
Most small tax practices don’t have:
- a Chief Information Security Officer
- a dedicated security-awareness manager
- a large IT department
- or an employee whose only job is managing cybersecurity training.
Instead, the responsibility may fall to:
- the owner
- an office manager
- a partner
- an administrator
- or an outside IT provider.
And that person is already busy.
Secure Team is being designed around that reality.
The goal is to make employee security awareness easier to run through:
Simple assignments
Choose relevant training without sorting through hundreds of unrelated courses.
Clear completion tracking
See who has and hasn’t completed required lessons.
Tax-specific content
Train employees using situations they actually encounter.
Recurring reminders
Reinforce important behaviors throughout the year.
Straightforward records
Keep organized documentation of employee training activity.
Your firm shouldn’t need an enterprise security department to operate a practical employee-awareness program.
Built for Tax Professionals
Independent Tax Firms
Train employees around taxpayer information, client communication, tax documents and account security.
Enrolled Agent Practices
Provide practical employee awareness training alongside the firm’s broader information-security program.
CPA Firms With Tax Practices
Prepare tax teams for phishing, client-data risks, account compromise and suspicious financial requests.
Seasonal Tax Offices
Onboard temporary employees before peak filing activity and keep completion records organized.
Bookkeeping and Tax Practices
Address the overlap between tax information, payroll, banking data and client communication.
Growing Multi-Office Tax Firms
Create a more consistent employee-awareness program across locations and teams.
Tax-Specific Instead of Generic
A large general-purpose security-awareness platform may need to serve:
- healthcare companies
- manufacturers
- technology companies
- universities
- retailers
- government organizations
- financial institutions
- and hundreds of other types of organizations.
Secure Team is taking a narrower approach.
| Generic Security Awareness Training | Secure Team |
|---|---|
| Large libraries covering many industries. | Tax-office scenarios. |
| Generic phishing examples. | Fake client document training. |
| Administrators decide what content matters. | Tax-season phishing. |
| Employees may see scenarios unrelated to their work. | Seasonal employee onboarding. |
| Complex features designed for larger security teams. | Taxpayer-data handling. |
| Payment and refund fraud. | |
| Account-security training. | |
| Recurring tax-specific awareness. | |
| Simple employee records. |
The goal isn’t to teach tax professionals everything there is to know about cybersecurity. It’s to help them make safer decisions in the situations they actually encounter.
FREE RESOURCE
Is Your Team Ready for Tax Season?
Before filing season gets busy, review whether your employee security basics are in place.
Download the Secure Team Tax-Season Employee Security Checklist.
Free resource. No Secure Team subscription required.
- permanent employees trained
- seasonal employees trained
- MFA enabled where appropriate
- tax-software accounts reviewed
- client portal procedures reviewed
- phishing refresher completed
- taxpayer-data procedures reviewed
- financial changes require verification
- employees know how to report suspicious activity
- training records are organized
Prepare Before the Inbox Gets Busy
That’s when a fraudulent request has the best chance of blending into legitimate work.
Security training is easier to absorb before that workload peaks.
Prepare permanent staff.
Train seasonal staff before they receive broad access.
Refresh important behaviors throughout filing season.
And make sure employees know what to do when something feels wrong.
During Peak Filing Season
- answering clients
- opening documents
- uploading returns
- checking portals
- responding to deadlines
- and moving quickly between accounts.
Frequently Asked Questions
What cybersecurity training should tax preparers receive?
Useful employee training should address the situations tax professionals actually encounter, including phishing, suspicious attachments, account security, passwords and MFA, taxpayer-data handling, impersonation, payment fraud and incident reporting.
Training should also reflect the firm’s own systems, procedures, risks and applicable requirements.
Do tax preparation firms need employee cybersecurity training?
Employee training is an important part of protecting taxpayer information.
Current IRS guidance says tax professionals are required to maintain a Written Information Security Plan and identifies employee training and management as one of the areas the plan should address. IRS
Firms should evaluate their specific legal and regulatory obligations with appropriate professional guidance.
Should seasonal tax employees receive cybersecurity training?
Seasonal employees may receive access to the same sensitive taxpayer information and systems as permanent employees.
FTC guidance for businesses specifically recommends including temporary help and seasonal workers in regular employee security training. Federal Trade Commission
For tax firms, incorporating security awareness into seasonal onboarding can help establish expectations before peak filing activity begins.
When should seasonal tax staff complete security training?
A practical approach is to provide basic training during onboarding and before employees receive significant access to taxpayer information or business systems.
Short refreshers can then reinforce important behaviors during filing season.
The exact program should be tailored to the firm’s operations and risk profile.
What is WISP employee training?
A WISP — Written Information Security Plan — describes how a tax or accounting practice protects customer information.
Current IRS guidance identifies employee training and management as one of the main areas a WISP should address. IRS
Security awareness training is only one part of a complete WISP and broader information-security program.
How often should tax employees receive cybersecurity training?
Security awareness should generally be treated as an ongoing program rather than a one-time onboarding exercise.
The appropriate schedule depends on the firm’s risks, operations and applicable requirements.
Tax firms may find it useful to combine onboarding training, pre-tax-season refreshers and shorter lessons throughout the year.
What phishing attacks commonly target tax professionals?
Tax professionals may encounter suspicious messages involving client documents, shared files, account verification, tax software, email accounts, financial instructions and impersonation.
Training should focus on recognizing unexpected or unusual requests and following the firm’s verification and reporting procedures.
How should a tax firm document employee cybersecurity training?
Training records can include:
employee name
training assigned
topics covered
completion date
refresher history
and outstanding assignments.
Secure Team is being designed to simplify this process.
Does cybersecurity training prevent every phishing attack?
No.
No employee-training program can guarantee that a security incident will never happen.
Training should be one layer of a broader security program that also includes appropriate technical, administrative and physical safeguards.
Does Secure Team replace my IT provider?
No.
Secure Team focuses on employee security awareness and training.
It does not replace:
- MFA
- endpoint security
- backups
- access controls
- firewalls
- secure system configuration
- managed IT services
- cybersecurity consulting
- incident-response services
Employee awareness is one part of protecting a business.
Does Secure Team make my firm compliant?
No product should promise that employee training by itself makes a tax firm compliant.
Secure Team is being designed to help tax firms deliver and document employee cybersecurity awareness training as one part of a broader information-security program.
Firms remain responsible for understanding and meeting their own applicable obligations.
Prepare Your Team Before the Next Suspicious Email Arrives
Your employees handle taxpayer information, financial documents and client requests every day.
During filing season, the volume only increases.
Give permanent and seasonal employees security training designed around the situations tax professionals actually encounter.
Protect taxpayer information. Build better employee security habits. Keep training organized.