CPA & Tax Composite/dramatized

Look what happened to this tax office, so it doesn't happen to yours

By FraudMeNot Team

Disclosure: This post contains no affiliate links. Some links on FraudMeNot may be affiliate links; if you buy through them, FraudMeNot may earn a commission at no extra cost to you. No product can guarantee you won't be scammed. Details.

Label: Composite/dramatized. "Composite story based on common real-world patterns. Names, places and numbers are invented." (Patterns from IRS / Security Summit warnings; not based on any single real firm.)

General education only, not legal, financial, tax or security advice. No guarantee. Consult a qualified professional. Stories may be dramatized or composite; see each label.

The story (composite)

It's the middle of filing season at a three-person tax office. An email comes in from a "new client": polite, a little rushed, with a "prior-year return" attached and a request to take a look before an appointment. The preparer clicks. Nothing seems to happen.

Over the next few weeks, the office's software logins are quietly captured. Later, someone files returns using client data, and the office finds out when clients' real returns get rejected.

What the IRS says is real

• The IRS and Security Summit list "new client" schemes as a form of spear phishing: fraudsters pose as prospective clients and send malicious links or attachments disguised as tax documents. (Sources 1, 2)
• They also warn about phishing aimed at preparers' EFIN, PTIN, and CAF numbers, and about clone phishing, where a copy of a real email carries a malicious link. (Sources 1, 2)
• Tax pros need a Written Information Security Plan (WISP). (Source 3, IRS summer series list, IR-2026-92)

The moment it could have been stopped

The attachment from someone who wasn't a client yet.

Tips (general)

1. Run every new-client intake through a secure portal, not email attachments.
2. Be suspicious of urgency, duplicate emails with a "new" link, and misspelled domains (Source 2).
3. Use multi-factor authentication on tax software and email.
4. Per the IRS, forward suspicious spear-phishing emails as attachments to phishing@irs.gov with the subject "Spearphishing," and report to TIGTA. If you suspect a breach, contact your IRS Stakeholder Liaison quickly. (Sources 1, 4)
5. Keep your WISP current and train staff on it.

Sources

1. IRS, IR-2026-81 (July 7, 2026), "IRS, Security Summit launch summer series..." https://www.irs.gov/newsroom/irs-security-summit-launch-summer-series-to-help-tax-pros-protect-clients-from-identity-theft
2. IRS, IR-2026-85 (Aug. 4, 2026), "Security Summit warns tax pros to watch out for phishing emails..." https://www.irs.gov/newsroom/security-summit-warns-tax-pros-to-watch-out-for-phishing-emails-and-other-attacks
3. IRS, "Protect your clients; protect yourself" (index of 2026 releases). https://www.irs.gov/tax-professionals/protect-your-clients-protect-yourself
4. IRS, "Report fake IRS, Treasury or tax-related emails." https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages

Disclaimer. FraudMeNot content, including the Close Call Report, is general educational and awareness material only. It is not legal, financial, tax, compliance, or cybersecurity advice, and it is not a security service or assessment. Nothing here creates a professional or advisory relationship. Content is provided "as is" without warranties; it may contain errors or become outdated, and no step described can guarantee prevention of fraud or loss. Consult a qualified attorney, accountant, financial professional, or security provider about your specific situation. If you've been scammed, contact your bank immediately and report it at reportfraud.ftc.gov and ic3.gov.

Story labels. Stories may be dramatized or composite; see each label. Each story carries one label: Real, reported: nothing added or dramatized (based on public records, linked), Real, reported (based on public sources, linked; details may be dramatized), Composite/dramatized (based on common patterns; names, places and numbers are invented, and any resemblance to real persons or firms is coincidental), or Hypothetical. People named in reported cases who haven't been convicted are presumed innocent; allegations are only allegations.

AI disclosure. Narration is AI-generated (text-to-speech). Scripts are researched and reviewed by a person. Some visuals may be AI-generated or stock.

Affiliate/sponsor note. We may earn commissions or sponsorship fees; see disclosures in each item.

Affiliate/sponsor disclosure for this item: none (no affiliate links or sponsors).