Cybersecurity for Accounting Firms: Surviving Tax Season

Mid-March at a 12-person accounting firm in Pointe-Claire. Three seasonal preparers have just started, and the pile of T4s and RL-1s grows every day. An email arrives in the name of the Canada Revenue Agency: to keep your EFILE account active, you must accept the new conditions by Friday. The button leads to a flawless sign-in page.

This isn't a made-up scenario. The CRA has issued an alert about exactly this kind of message, aimed at tax preparation service providers. To a fraudster, an accounting firm is a prime target: it holds the social insurance numbers, income details, banking information and government access of hundreds of clients, and it works under pressure for weeks on end.

The good news is that the measures that actually protect a firm are well known, and most can be in place before February. Here's what your professional rules require, what changes during tax season, and where to start.

What your professional order requires, and what Law 25 adds

Quebec's Code of ethics of chartered professional accountants (CQLR, c. C-48.1, r. 6.1) was replaced in 2024. Several provisions bear directly on information security.

The key word is "reasonable." The Code doesn't spell out technical controls, but CPA Québec publishes an IT best-practices guide built as a self-assessment (in French). Its questions are concrete: is access protected by multi-factor authentication? Are laptop drives encrypted? Is a departing employee's access removed? Are backups encrypted? If you answer "no" to several of them, you know where to begin.

Law 25 applies to every firm, CPA or not, so a bookkeeper or a tax preparation shop is covered too. Our Law 25 checklist walks through the obligations. For how they apply to your situation, check with your legal advisor. Practising outside Quebec? Your provincial CPA body has its own rules, but the CRA scams below hit firms everywhere.

Why tax season changes everything

For most of the year, a 12-person firm handles a predictable flow of documents. From February to April, everything speeds up. In 2026, Revenu Québec started accepting electronically filed returns on February 23, and by early April it reported that more than 94% of the returns received so far had been filed electronically. Nearly everything runs through your systems.

Three factors drive the risk up:

• Volume. Hundreds of clients send slips, statements and receipts, often by email, sometimes as phone photos.
• Temporary staff. Seasonal preparers get access within hours, sometimes on shared accounts, and keep it after they leave.
• Urgency. A message demanding action "by Friday" works better when everyone is rushing.

Fraudsters know the tax calendar as well as you do.

The scams aimed at firms and their clients

Here are the most common scenarios, drawn from alerts by the CRA, Revenu Québec and the Canadian Anti-Fraud Centre.

The last one is the sneakiest: the email sometimes comes from the client's real mailbox, which has been hacked. It's the same playbook as vendor banking change fraud, and the only reliable defence is a callback to a known number.

Remind clients of the basics, too. The CRA states that it doesn't send refunds by e-transfer or text, and doesn't demand payment in gift cards or cryptocurrency. A short paragraph in your January newsletter can save you a lot of phone calls.

The checklist to finish before February

Our team uses this list as a starting point with accounting firms:

• Multi-factor authentication on email, tax software, the client portal and remote access. It's already mandatory for CRA accounts; see our guide to choosing the right method.
• One named account per person, seasonal staff included, with an end date for access set on day one.
• A secure portal or file share for tax documents; never a social insurance number in the body of an email.
• Full-disk encryption on every laptop.
• Tested backups, including an offline or immutable copy, following the 3-2-1-1-0 rule.
• Workstation and tax software updates applied before the season starts.
• Confidentiality agreements signed by employees, seasonal staff and outside consultants.
• A contract with your cloud provider covering confidentiality, data location and incident notification.
• A written phone-verification procedure for any change in banking details, on the client side and the supplier side.
• An up-to-date confidentiality incident register, minor incidents included.

None of this requires an in-house IT department. Most of these settings can be configured in a few days with your current provider.

When an incident hits mid-season

An employee typed their password into a fake page? Work through these steps in order:

1. Reset the password, end active sessions and check the mailbox for automatic forwarding rules.
2. Determine which client files that account could reach.
3. Assess the risk of serious injury. Social insurance numbers and tax data are sensitive: if the risk is serious, Law 25 requires you to promptly notify the Commission d'accès à l'information and the affected clients.
4. Record the incident in your register, whether or not you report it.
5. Report fraudulent messages to the Canadian Anti-Fraud Centre and, if they impersonate Revenu Québec, to Revenu Québec.

Let your insurer know quickly as well: your policy may set a notice deadline.

Our team can assess your firm's security posture before next season, from email configuration to payment procedures, as part of a cybersecurity audit. If your office is in Greater Montréal, one of our experts can also meet you on-site.