CPA Firms Urged to Tighten Protection Against Cybercrime

A fake Friday-afternoon payment request shows how quickly a familiar client relationship can become a security risk. In the example, a criminal impersonated a restaurant client and sought an urgent contractor payment tied to remodeling. The message appeared legitimate except for the sender’s type of phone, and the CPA approved the transfer before checking further.

The guidance says firms need safeguards that employees consistently use. Those measures include training staff to recognize phishing and testing whether they can identify simulated attacks. Remote workers should connect through a virtual private network, while confidential messages sent beyond the firm should use protected email or, preferably, a secure client portal. Antivirus tools, anti-malware protection, prompt software updates and current password guidance also belong in the firm’s security practices.

Outside providers create another exposure. Before sharing client information with a payroll, cloud-storage, tax or portal vendor, firms should review its protections and address security responsibilities in the contract. Insurance coverage also deserves review, including how policies handle ransomware and payments sent improperly. The warning extends beyond email: texts, voicemails and other mobile devices can carry phishing attempts. For firms that move client money, confirming unusual requests through a separate channel can help limit losses and liability.