Connect with us

Accounting

Cybersecurity best practices as 2025 tax season kicks off

Published

on

Every year during tax season, finance professionals handle an influx of sensitive financial and personal information passed along by their clients. Although most CPAs and accountants excel at processing this information, as well as other data related to their field, they’re typically not experts in cybersecurity.

As our technology-driven world grows increasingly complex and evolves more rapidly over time, the more important it becomes for financial institutions to take precautions that safeguard their clients’ sensitive information (and also their own). Bad actors are always working to get a step ahead of protection tech and services, and take advantage of the habits of employees who may not be aware of the latest cyber threats.

The best CPAs and accountants tend to be naturally inquisitive, perhaps to the point of skepticism — and their clients should thank them for it. Because when it comes to finances or cybersecurity, speaking as someone with professional experience in both spaces, those characteristics are superpowers. As cyberattacks become increasingly frequent and sophisticated, financial professionals should be encouraged to maintain a healthy dose of suspicion and lean into hypervigilance. From small accounting operations to large, enterprise-level firms, organizations and their employees must understand and embrace the importance of cybersecurity and its best practices.

Tax season is busy and a potential cybersecurity weakness

It’s critical for financial organizations to observe and maintain cybersecurity best practices, even (and perhaps especially) during tax season. Increased workloads during the busy season may push cybersecurity and network infrastructure down the list of priorities, but bad actors often look for such openings to exploit.

CPAs handle an influx of sensitive financial information and personal information during tax season, which could make them a more attractive target for cybercriminals. Failing to strengthen and maintain cybersecurity technology and protocols could lead to even more chaos and stress during what can already be a nerve-wracking time of year for the industry.

Building client and firm cybersecurity protocols

There is no one-size-fits-all approach to cybersecurity and instituting best-practice protocols, but one of the best methods in the financial services space is to separate cybersecurity into a two-pronged issue: client information and firm information.

Because clients — like CPAs — are rarely cybersecurity experts themselves and, in fact, often operate under the expectation that a financial firm has the proper tools and protocols in place to protect their information, it’s vitally important that nothing be taken for granted on this side.

Key areas of focus for client information

  • Email: Email is inherently insecure for the exchange of sensitive financial documents. Once an email is sent, a firm has little to no control over where it ends up — possibly forwarded, intercepted or left in an insecure inbox. Email is also a primary attack vector for phishing. Clients might accidentally open malicious attachments or click on links in phishing emails disguised as legitimate requests. It can be clunky, too, as some email providers block certain file types that could be necessary for tax preparation, and size limits may prompt clients to use insecure methods, such as unencrypted file-sharing services or breaking files into multiple emails — a significant data security risk.
  • Secure portal: The best antidote to publicly available email is a secure portal. A private, secure portal provides a financial firm with a controlled, encrypted environment for file sharing, minimizing the risk of breaches. Encryption protects data in transit and at rest, and access controls allow a firm to decide who gets access to which files and set permissions (view, download or edit) for further guardrails. Additionally, portals often log activity and provide an audit trail of who has accessed and modified files.
  • Guest Wi-Fi networks: Guest networks are essential for accountants and CPAs in order to protect client data and their own systems. Strong passwords, encryption and network segmentation are crucial components of a secure Wi-Fi network. For extra layers of security, consider hiding your guest network’s SSID (network name), restricting guest network access to internet-only (blocking access printers and file shares) and creating a separate access point, further segregating it from your main network.

Internally, protecting firm information requires a multilayered approach that encompasses technology, policies and ongoing employee training. Strong access controls, encryption and data backups are fundamental security measures, but accounting firms should also partner with cybersecurity experts to create a comprehensive security program that accounts for employee awareness training and builds a strong security culture.

Key areas of focus for firm information

  • Device security: All company devices and storage media, including hard drives and USB drives, should be encrypted to prevent data loss and theft. Install robust endpoint security software (antivirus, anti-malware and intrusion detection) on all company devices that access firm networks and client data. Implement mobile device management solutions to secure company-issued mobile devices and enforce security policies.
  • Data security: Firms should use data loss prevention tools to prevent sensitive data from leaving the network without authorization. Secure file-sharing platforms and encrypted email for internal and external communication protect sensitive data. Meanwhile, a comprehensive data backup and recovery plan helps ensure business continuity in the case of adverse events such as a ransomware attack or even a natural disaster.
  • Employee training and awareness: In addition to new employee training, regular security awareness training for all employees should be conducted to educate a firm’s workforce about cybersecurity threats, company security policies and best practices (including recognizing phishing emails and following strong password habits). Run simulated phishing attacks to test employee awareness and reinforce their training, and develop and regularly practice an incident response plan so that, if all else fails, employees know how to react in case of a security incident. This can significantly mitigate lost time, revenue and reputational impact in the event of a cyber attack.
  • Physical security: Implement physical security measures to protect office space and equipment, including old-school and analog methods. That may include security cameras, visitor logs and physical locks that limit access to control systems. Be sure to shred and securely dispose of sensitive documents to prevent data breaches.

Cyber attacks, no matter the time of year, can have significant financial and reputational costs. Organizations that lack the time or resources to bolster or sustain their cybersecurity and network infrastructures — again, especially during the upcoming busy season — should consider partnering with external cybersecurity specialists to ensure their clients’ personal information and network security stay protected. As always, better safe — and secure — than sorry.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Accounting

KPMG report encourages AI for sustainability

Published

on

A KPMG report says that AI, despite its large energy burden, can still be a positive tool for corporate sustainability efforts. 

The report, “AI for the Chief Sustainability Officer: Understanding the Intersection of AI and Sustainability,” notes there are many ways entities can use AI to reduce their environmental impact and advance their sustainability goals. 

AI-driven analytics, for example, can help a company gain deeper insights into their carbon footprint as well as identify inefficiencies for target emission reduction measures. It could also be used to optimize energy and water consumption in buildings and industrial processes, as well as supply chain logistics, via analysis of real-time use patterns. The report also explains that AI can be used for sustainability reporting, which often draws on many different data sources, both financial and nonfinancial. KPMG noted that AI can be an innovation tool that can assist in designing sustainable products and services, as well as forecast extreme weather events and analyze historical and real-time market data to predict future trends. 

KPMG noted that it is using AI for these purposes itself. For clients, the firm uses AI to identify its most impactful decarbonization pathways for target reduction, offers AI-guided solutions to accelerate reporting and compliance with sustainability standards, provide optimized AI tools that can reduce manual efforts within the sustainability data management and reporting process, as well as offer ongoing guidance on emerging AI technologies. 

And for itself, the firm said it is actively working to integrate AI and sustainability into its larger environmental strategy. It is currently exploring the development of AI tools that will help enhance its sustainability professionals’ efficiency and accuracy. Beyond that, it’s also working with international teams to assess the impact of their own AI use, especially on data centers they own, as well as within the context of Scope 2 emissions. KPMG is working with its key technology partners to understand the impact of AI use outside its direct control. The firm sees sustainability as a core component of its trusted AI framework. 

Despite these measures, there is the matter of AI being highly energy intensive. For instance, in Google’s most recent environment report, it revealed that its emissions have increased 13% from last year and 48% from their 2019 target, which the tech company mainly attributed to a rise in data center energy consumption and supply chain emissions, which it said was at least partially due to AI. The company conceded that as it further integrates AI into its products, reducing emissions may be challenging due to increasing energy demands from the greater intensity of AI computing, and the emissions associated with the expected increases in its technical infrastructure investment. For example, another estimate says that one query to ChatGPT uses approximately as much electricity as lighting one lightbulb for about 20 minutes. The KPMG report acknowledged this can be a challenge but is hopeful that technological advances can address the issue. 

“The computational power required for AI can lead to significant resource use and an increase in emissions, potentially offsetting sustainability gains,” said the report. “However, recent advancements in energy-efficient AI technologies and renewable infrastructure are promising in reducing energy consumption, carbon emissions and water usage. As the AI landscape continues to rapidly evolve in cost and energy efficiencies, companies may focus on emissions from owned data centers and cloud computing providers, in order to create a clear path to decarbonize.” 

Tegan Keele, KPMG US climate data and tech leader, who co-authored the report, said in an email that while AI does consume a lot of energy, it’s not the whole story when it comes to emissions. 

“While companies should be mindful of AI’s energy footprint, focusing on AI computing alone won’t move the needle on emissions. We need to look holistically at overall Scope 2 consumption and value chain impacts,” said Keele. 

Maura Hodge, KPMG US’s sustainability leader and another of the report’s authors, added that KPMG’s own efforts to help clients reduce their carbon footprint, in turn, can be useful in creating a net environmental benefit for AI solutions. 

“This is why at KPMG, we’re actively working to maximize AI’s immense potential to help drive decarbonization, while simultaneously mitigating the impacts of its energy and water consumption. It’s about finding a way to strike the balance, where AI ultimately delivers net positive environmental impact,” said Hodge. “We recommend that companies work closely with their technology partners to understand the full impact of their AI usage and development, especially for operations outside their direct control.”

Continue Reading

Accounting

Cloud backup strategies are critical for accountants

Published

on

For over a decade, I’ve been shouting from the rooftops that accounting firms need to get into the cloud. And guess what? We’re finally here. OK, maybe it took a global pandemic to force some firms to catch up, but hey, we made it. But now, in 2025, it’s time to ask ourselves — is the cloud really as safe as you think it is?

Sure, moving to the cloud brought you efficiency, flexibility and scalability. But the cloud isn’t some magical fortress that protects your data from every possible threat. If you’re not thinking about cloud backups, your firm is vulnerable. Here’s why cloud backups are critical today.

Too many firms assume their cloud providers have everything under control when it comes to data protection. However, Vijay Krishna, CEO of SysCloud, calls cloud security a shared responsibility.  

“Cloud providers ensure infrastructure security, but the data itself is the firm’s responsibility,” Krishna said.

p199mvaab11ih6njivan1otp1fo3b.jpg

And that means trouble. Accidental deletions, ransomware attacks, and even disgruntled employees with lingering access can all lead to catastrophic data loss. And guess what? Your cloud provider isn’t going to swoop in and fix it for you.

It’s easy to fall into the “I’m in the cloud, so I’m good” trap, but the truth is, your firm still owns the responsibility of safeguarding client data. Whether your files live on your hard drive or in someone else’s data center, they’re still your problem.

And firms are learning this lesson the hard way. Krishna shared that even companies with solid cloud strategies deal with data restoration requests all the time — from accidental deletions to integrations gone wrong. It happens more than you’d think.

The real problem is everyday mishaps

When we think about data loss, we imagine worst-case scenarios like servers crashing, ransomware attacks and total wipeouts. But Donny Shimamoto, managing director of IntrapriseTechKnowlogies, says that’s not where firms should be focusing.

“It’s not just about disaster recovery anymore. Firms need to think about incremental data loss like an employee accidentally overwriting records or an automation script flooding systems with bad data,” said Shimamoto. “These smaller incidents can cause significant operational disruptions.”

We’re always worried about big disasters, but in reality, it’s the small, everyday mistakes that cost firms the most time and money. Losing even a few hours of work can be a major disruption, especially during tax season. Imagine scrambling to recreate critical data right before a deadline. Ouch!

Without a solid cloud backup solution, your team could waste hours, over even days, trying to fix what went wrong, and no one has time for that.

How data retention is evolving

If compliance wasn’t already a big deal, it’s about to get even bigger. Regulatory bodies are tightening their grip, and firms need to get serious about data retention. In addition to retention requirements, there are cybersecurity laws and data privacy regulations like IRS guidelines, GDPR and state-specific mandates. 

“Several states now offer safe harbor provisions for firms that can demonstrate compliance with cybersecurity frameworks like NIST,” Shimamoto said. 

So as long as your backup processes are documented and aligned with the right frameworks, you could be in a much stronger position when regulators come knocking.

Krishna mentioned the NIST 3-2-1 rule that recommends keeping three copies of your data, stored on two different types of media, with at least one copy kept offline. The last part gets to air-gapped storage and it’s what keeps that data safe from hackers, ransomware and rogue employees. That backup is untouched and ready to restore if ever needed.

Compliance isn’t just another box to check. It’s a strategy for survival. Firms that can prove they have their data under control are the ones that will avoid regulatory fines and protect their reputations. 

Leveraging backup for insights

Cloud backups aren’t just about recovering lost files anymore. They can actually help your firm work smarter. Krishna explains how advanced platforms offer anomaly detection, tracking unusual spikes in data deletions or changes.

“By monitoring trends and patterns, firms can catch potential threats before they escalate,” he said. “It’s about shifting from reactive to proactive data management.”

This is a big deal. Imagine getting alerts before a major data issue arises or spotting trends in employee activity that could indicate a problem before it gets out of hand.

As firms embrace automation and AI, the ability to proactively monitor data changes could be the key to staying ahead of the competition. Being reactive isn’t enough. You have to take control of your data before it takes control of you.

If your firm needs to step up its cloud backup game, don’t panic. Here are a few practical steps you can take today:

  • Audit your backup strategy. Do you have a reliable backup solution? Make sure it covers both full-system and incremental data recovery.
  • Own your data security. Understand that cloud providers won’t save you. Your firm must take an active role in protecting client data.
  • Stay alert. Use backup tools that detect anomalies, unauthorized access, or unusual activity to stay proactive.
  • Get compliant. Align your firm with regulatory standards like NIST and take advantage of safe harbor provisions.
  • Educate your team. Data protection isn’t just for IT. Everyone in the firm needs to know how to safeguard client information.

It’s not just about having the right technology; it’s about having the right mindset.
Stop thinking of backups as an afterthought and start treating them as an essential part of your data strategy. It’s a whole new era of accounting, and being able to thrive is dependent on embracing secure, proactive cloud strategies.

Because in 2025, it’s not about “if” you should back up your cloud data, it’s about whether you can afford not to.

Continue Reading

Accounting

Tax Fraud Blotter: Reached their limit

Published

on

Fell a little short; oh brother; only one hitch; and other highlights of recent tax cases.

Tacoma, Washington: The second of two Nigerian men residing in Canada who defrauded U.S. pandemic aid programs has been sentenced to 54 months in prison for wire fraud and aggravated ID theft.

Fatiu Ismaila Lawal was extradited from Canada last July and pleaded guilty in September. Lawal and co-defendant Sakiru Olanrewaju Ambali used the stolen IDs of thousands of workers to submit more than 1,700 claims for pandemic unemployment benefits to more than 25 states. The claims sought some $25 million, but the conspirators obtained some $2.7 million, primarily from pandemic unemployment benefits.

Lawal admitted that he submitted claims for $1,345,472. He submitted at least 790 unemployment claims using the stolen IDs of 790 workers and established four internet domain names that were used for fraud.

Between 2018 and November 2022, Lawal used stolen personal information to submit 3,000 income tax returns for $7.5 million in refunds. The IRS detected the fraud and paid just $30,000. The two conspirators tried to use the stolen American IDs for Economic Injury Disaster Loans, submitting some 38 applications. The Small Business Administration paid only $2,500.

Lawal and Ambali had the proceeds of their fraud sent to cash cards or to “money mules” who transferred the funds according to instructions given by the conspirators. They also allegedly used stolen IDs to open bank accounts and have the money deposited directly into those accounts.

Lawal, who received a substantial portion of the scam’s proceeds, was ordered to pay $1,345,472 in restitution. Ambali was sentenced to 42 months in prison last  March.

Houston: Clothing business owner Philip Ogbeide has admitted making fraudulent and false statements on his federal returns.

Ogbeide signed false U.S. individual income tax 1040s from 2018 through 2022 to receive inflated, undeserved refunds. His returns included false entries claiming fraudulent itemized deductions and undeserved credits. He also omitted income from his clothing business and from the proceeds of a fraud scheme.

He admitted that because of the false deductions and unreported income, he owes the U.S. Treasury $166,929.

Sentencing is April 15. Ogbeide faces up to three years in prison and a $250,000 fine.

Washington, D.C.: A federal court has issued a permanent injunction barring tax preparer Chris Elmer, of Sacramento, California, from preparing federal returns for others after Oct. 14, 2010.

The permanent injunction also bars Elmer’s tax prep company, Associated Tax Planners Inc., and its principals (Elmer’s sons and son-in-law) from promoting a variety of improper tax schemes; it also requires Elmer to divest himself of his interest in Associated. Elmer and the co-defendants consented to the entry of the injunction.

The government’s complaint alleged that Associated repeatedly claimed false or inflated business deductions, many of which were allegedly claimed as business expenses of sham partnerships. The complaint also alleged that in many instances the defendants claimed purported partnership business losses on clients’ individual returns regardless of whether the customers had a partnership or other business.

The government asserted that the defendants often did not file a corresponding partnership return when their customers reported partnership losses on their individual returns or fabricated IRS tax ID numbers for the partnerships.       

The terms of the order also require that any of the remaining defendants (other than Chris Elmer) who wish to continue to prepare returns for others must pass the IRS’s Enrolled Agent’s exam within three years. The injunction also provides for appointment of a neutral monitor to evaluate whether Associated is abiding by terms of the injunction.       

Hands-in-jail-Blotter

LaPorte, Indiana: Raymond Calvin Smith and Bruce Milik Smith, brothers, have been sentenced after pleading guilty to federal felony charges.

Raymond Smith was sentenced to 70 months in prison and two years of supervised release. Bruce Smith was sentenced to 39 months in prison and two years of supervised release. 

From about January to December 2021, the Smiths operated a scheme using Indiana mobile sports wagering applications. Using such personal information of victims as bank account numbers and passwords, they set up dozens of accounts in victims’ names on at least eight different wagering applications and funneled money from victims’ bank accounts to themselves.

The Smiths stole a total of $723,832.64 and unsuccessfully attempted to steal an additional $930,782. Both brothers pleaded guilty to the mail fraud; Raymond Smith also pleaded guilty to evading taxes on the proceeds he received in 2021.

The two brothers were ordered to pay $723,832.64 in restitution to the victims of their offense, and Raymond Smith was ordered to pay $162,928.62 in restitution to the IRS.

Montgomery, Alabama: Tax preparer Cynthia Lee Price, 50, of Cape Coral, Florida, has been sentenced to two years in prison for filing false returns, according to published reports.

News outlets said Price, who worked at No Limit Tax Pro in Montgomery, admitted to preparing fraudulent returns for herself and others from 2017 to 2022, resulting in illegal refunds. Price also reportedly falsified her 2021 return and inflated a client’s charitable contributions to increase the refund.

The total loss to the IRS reportedly exceeded $532,000.

After her prison sentence, Price will be on supervised release for a year and will pay a $15,000 fine along with restitution to the IRS, news outlets added.

Boston: Richard Cooper, of Billerica, Massachusetts, owner of a local paving company, has been sentenced to six months in prison for a multiyear income tax evasion scheme.

From 2017 to 2020, in addition to depositing customer payments into bank accounts in the name of his company, Rick Cooper Paving, Cooper also cashed more than $5.1 million in customer checks. When Cooper had his taxes prepared, he did not tell his preparer about the checks he was cashing, resulting in his returns underreporting the business’ gross receipts by millions. Cooper kept more than $1.1 million that he should have paid in federal and state income taxes.

Cooper, who pleaded guilty in October, was also sentenced to two years of supervised release and ordered to pay $989,819 in restitution to the IRS.

Gardner, Kansas: Business owner Marvin Vail has been sentenced to 17 months in prison for failing to forward more than $1 million in employment tax collections to the IRS.

As owner and operator of Marvin’s Tow Service, Vail failed to pay employment taxes for at least 23 calendar quarters from 2012 to 2017. IRS agents interviewed the office administrator for the company and were told Vail wouldn’t allow the administrator to pay the owed federal taxes.

Vail was also ordered to pay $1,512,283 in restitution to the IRS.

Continue Reading

Trending