Updated Novemberber 2026
Artificial intelligence (AI) is changing the cybersecurity landscape. While AI can help businesses detect suspicious activity and improve efficiency, cybercriminals can also use it to create convincing phishing messages, impersonate trusted contacts, and carry out fraud.
As the IRS and its Security Summit partners continue to warn tax professionals about evolving cyber threats, understanding how AI affects cybersecurity is becoming an important part of protecting a tax practice.
Why Tax Firms Are Prime Targets
Tax firms collect and store information that criminals can use to commit identity theft and tax-related fraud.
A successful cyberattack can expose taxpayer records, compromise account credentials, interrupt business operations, and damage client relationships.
Solo practitioners and small firms can be attractive targets because they hold valuable client information. Simple steps, such as using stronger account security, keeping software updated, and verifying unusual requests, can significantly reduce the risk. .
The IRS’s 2026 Protect Your Clients; Protect Yourself campaign highlights several ongoing threats, including phishing, fraudulent new-client inquiries, and scams involving tax professional credentials.
Cybersecurity Awareness Month offers an opportunity to review these risks and strengthen existing safeguards.
The AI-Enabled Threat Landscape
AI tools are making some cyberattacks more convincing and easier to carry out. Tax professionals should understand how these threats may appear in everyday client communications and business operations.
1. AI-Generated Phishing and Social Engineering
Phishing is still one of the most common ways scammers try to steal client information or account passwords. AI can make these messages look polished and personal, so even a professional-looking email deserves a quick check before you click. .
AI can help scammers create professional-looking messages that imitate communications from clients, tax software providers, financial institutions, or government agencies.
Unlike some traditional phishing messages, AI-generated emails may contain few spelling mistakes or formatting errors. They may also reference publicly available information about a firm or its employees.
For example, a preparer might receive an email from someone claiming to be a prospective client. The message includes a link to tax documents that must be reviewed before an appointment.
However, the link could lead to a fraudulent website designed to steal login credentials or install malicious software.
The IRS continues to warn tax professionals about these types of phishing and new-client schemes.
What Tax Professionals Can Do
- Verify unexpected requests before opening attachments or following links.
- Use established communication channels to confirm a sender’s identity.
- Be cautious of messages requesting passwords, account information, or urgent action.
- Train employees to recognize suspicious communications, even when messages appear professional.
2. AI Voice Cloning and Deepfake Impersonation
AI-generated emails are not the only concern. Criminals can also use AI tools to imitate voices or create realistic audio and video content.
These technologies can make fraudulent requests appear to come from trusted individuals.
For example, a scammer could impersonate a client over the phone and request changes to direct-deposit information. Another could imitate a firm owner and ask an employee to send confidential records.
AI-generated voices can sound convincing, so do not rely on a familiar voice alone. For sensitive requests, pause and connect to a number you already trust. .
Additional checks
- Independently verify requests involving sensitive taxpayer information.
- Contact clients using previously confirmed phone numbers.
- Require additional approval for changes to banking information or account access.
- Establish clear procedures for handling unusual or urgent requests.
3. Advanced Malware and Ransomware
Ransomware is malicious software that can block access to files or systems until a payment is demanded.
Cybercriminals may use AI-assisted tools to improve parts of their attacks, such as identifying potential targets or developing convincing messages that deliver malicious software.
For tax firms, a ransomware attack can disrupt return preparation, prevent access to client records, and expose confidential information.
Paying a ransom does not guarantee that stolen information is recovered or that attackers will delete their copies.
What Tax Professionals Can Do
- Keep operating systems and security software updated.
- Maintain secure backups and test restoration procedures.
- Restrict access to sensitive files based on employee responsibilities.
- Use reputable security software to detect and block malicious activity.
4. Credential Theft and Account Takeovers
Criminals may attempt to obtain passwords through phishing, fraudulent login pages, or previously stolen credentials.
AI can make impersonation attempts more convincing, but basic account security weaknesses remain a major concern.
Compromised credentials may allow unauthorized access to email accounts, client portals, or tax preparation systems.
Criminals may also attempt to misuse a firm’s Electronic Filing Identification Number (EFIN) or other professional credentials.
What Tax Professionals Can Do
- Use unique passwords or passphrases for every account.
- Use multifactor authentication (MFA).
- Avoid sharing login credentials between employees.
- Monitor accounts and EFIN activity for suspicious changes.
A Cybersecurity Defense Strategy for 2026
Protecting taxpayer information involves more than installing security software, but the work can be handled in manageable steps.
Tax firms should combine technical safeguards, employee training, documented procedures, and regular security reviews.
The IRS and its Security Summit partners continue to recommend several foundational protections.
1. Follow the IRS Security Six
The IRS Security Six gives small tax practices a practical place to begin. Use the six safeguards to check the basics now, then add protections that fit your firm’s size, systems, and risks.
These safeguards include:
- Antivirus Software: Use reputable security software and keep it updated to help detect malicious programs.
- Firewall Protection: Use firewalls to help prevent unauthorized network access.
- Multifactor Authentication: Require additional identity verification to protect accounts from unauthorized access.
- Data Backups: Maintain secure backups of important records and regularly test recovery procedures.
- Drive Encryption: Encrypt devices and storage systems containing sensitive taxpayer information.
- Virtual Private Networks: Use secure remote connections when accessing firm systems outside the office.
These measures help protect against both traditional cyberattacks and AI-assisted threats.
Important: Under the Federal Trade Commission’s Safeguards Rule, tax preparation firms must implement MFA for access to customer information unless a Qualified Individual approves an equivalent secure access control in writing. The IRS reinforced this requirement in September 2026.
2. Create and Maintain a Written Information Security Plan
Tax professionals engaged in practice before the IRS must maintain a Written Information Security Plan (WISP) that addresses how their firms protect client information.
A WISP should reflect the size and complexity of the practice, the sensitivity of the customer information it maintains, and the risks it faces. .
The plan should address:
- Potential security threats and vulnerabilities
- Employee responsibilities and training
- Procedures for protecting taxpayer information
- Access controls and data security measures
- Incident response and reporting procedures
- Regular reviews and updates
As AI-assisted fraud evolves, firms should consider whether their plans adequately address voice impersonation, fraudulent client communications, and verification of sensitive requests.
The IRS provides Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice, to help tax professionals develop and maintain their security plans.
3. Train Employees to Recognize AI-Assisted Scams
Employees play an important role in protecting taxpayer information.
Even strong technical safeguards may not prevent every phishing attempt or fraudulent request.
AI-generated messages can be especially difficult to identify because they may appear professional, personalized, and familiar.
Regular security training should help employees recognize:
- Unexpected requests for sensitive taxpayer information
- Suspicious links and attachments
- Fraudulent new-client inquiries
- Attempts to impersonate clients or coworkers
- Requests to bypass established security procedures
Consider conducting periodic phishing exercises and reviewing real-world scam examples with staff.
Encourage employees to report suspicious activity promptly.
4. Monitor Systems and Account Activity
Monitoring can help firms identify suspicious activity before it leads to a larger security incident.
Security tools may detect unusual login attempts, unexpected file transfers, or unauthorized changes to account settings.
Some security platforms use AI and machine learning to identify patterns that could indicate malicious activity.
Tax professionals should work with qualified technology providers to determine which monitoring tools are appropriate for their practices.
5. Prepare an Incident Response Plan
Even firms with strong security measures should prepare for the possibility of a cyberattack.
An incident response plan establishes what employees should do when they suspect taxpayer information has been compromised.
A plan should include procedures to:
- Identify and contain suspicious activity.
- Isolate affected systems when appropriate.
- Preserve records and evidence.
- Contact qualified cybersecurity professionals.
- Notify affected parties and government agencies when required.
- Restore systems and review safeguards.
Tax professionals who discover a data theft incident should promptly contact their local IRS Stakeholder Liaison.
Additional reporting requirements may apply under federal and state law.
For example, the FTC Safeguards Rule requires covered financial institutions to notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information involving at least 500 consumers has been acquired without authorization. Customer information is treated as unencrypted for this purpose if an unauthorized person accessed the encryption key.
Reviewing these procedures before an incident occurs can help firms respond more effectively.
Using AI Responsibly in Your Tax Practice
AI is not only a cybersecurity threat. It can also help tax professionals improve efficiency and support certain business operations.
AI-powered security tools may help detect unusual account activity, identify malicious software, and flag suspicious communications.
However, firms should carefully evaluate how AI applications collect, store, and use information.
Before adopting an AI tool, consider:
- Whether the tool protects confidential taxpayer information
- How the provider stores and processes submitted data
- Whether information may be used to train AI models
- Who can access information entered into the system
- Whether the tool complies with applicable privacy and security requirements
Avoid entering confidential taxpayer information into unapproved public AI tools.
Tax professionals should also verify AI-generated information before relying on it for tax research, return preparation, or client communications.
In June 2026, the IRS Office of Professional Responsibility published introductory guidance on responsible AI use in federal tax practice. The guidance emphasizes that existing professional responsibilities, including due diligence and confidentiality obligations, continue to apply when practitioners use AI.
AI can support professional work, but it does not replace a tax professional’s judgment or responsibility to protect client information.
Make Cybersecurity a Year-Round Priority
Cybersecurity Awareness Month is an opportunity for tax professionals to review existing safeguards and prepare for emerging threats.
As AI makes phishing and impersonation attempts more convincing, firms should focus on consistent security practices, employee awareness, and clear verification procedures.
Start by reviewing your WISP, confirming that MFA is properly implemented, and discussing AI-assisted scams with employees.
Taking these steps before the next filing season can help reduce security risks and protect sensitive taxpayer information.
A few consistent security habits can go a long way. They help protect client information, keep your practice running, and reinforce the trust your clients place in you.
What does AI mean for your firm’s next steps? Explore our article on AI and IRS guidelines to learn what tax professionals should consider as they put AI to work.
Disclaimer: This article is for informational purposes only and does not constitute legal or financial advice.
Frequently Asked Questions About AI and Cybersecurity for Tax Professionals
How is AI changing cybersecurity risks for tax firms?
AI can help cybercriminals create convincing phishing emails, impersonate clients or coworkers, and make fraudulent requests appear legitimate. Polished writing and a familiar voice are no longer reliable signs of authenticity. Tax professionals should independently verify unexpected requests, especially those involving taxpayer records, banking details, or account access.
How can tax professionals recognize AI-generated phishing scams?
Focus on the request rather than spelling or grammar. Warning signs include unexpected attachments, unfamiliar sender addresses, urgent demands, and requests to bypass established procedures. Before opening documents or sharing information, confirm the request through a previously verified phone number or another trusted communication channel.
What cybersecurity safeguards should tax firms prioritize?
Start with the IRS Security Six: antivirus software, firewalls, multifactor authentication, secure backups, drive encryption, and virtual private networks for secure remote access. Pair these safeguards with employee training, software updates, account monitoring, and tested recovery procedures. Together, these practices help address both traditional cyberattacks and AI-assisted threats.
What should a tax firm’s Written Information Security Plan address as AI use grows?
A Written Information Security Plan (WISP) should address risks to taxpayer information, employee responsibilities, access controls, security training, and incident response procedures. As AI use grows, review how the plan addresses impersonation scams, verification of sensitive requests, and employees’ use of AI tools. Update the plan as your firm’s systems, operations, and risks change.
Can tax professionals use AI tools without compromising client confidentiality?
Using AI responsibly starts with evaluating the tool and the information you intend to share. Review how the provider stores and processes data, who can access it, and whether submissions may be used to train AI models. Avoid entering confidential taxpayer information into unapproved public AI tools, and verify AI-generated work before relying on it for research, return preparation, or client communications.
Sources and Editorial References
Primary Source
| Source | Document and Relevant Section |
| IRS | IR-2026-85, August 4, 2026 — Phishing and emerging attacks. |
| IRS | IR-2026-92, August 18, 2026 — WISP requirements and incident reporting. |
| IRS | IR-2026-106, September 4, 2026 — MFA and account security. |
| IRS | IR-2026-111, September 16, 2026 — Current scams, warning signs, and data theft reporting. |
| IRS | Office of Professional Responsibility, Issue 2026-19 — Responsible AI use and professional obligations. |
| FTC | Safeguards Rule, 16 CFR § 314.4 — Security program, MFA, and notification requirements. |
