In short
- ✓Accountancy practices hold what criminals want most: client bank details, payroll, tax and ID records.
- ✓HMRC-themed phishing tends to peak around deadlines such as 31 January.
- ✓Making Tax Digital for Income Tax, mandatory from April 2026 for qualifying incomes over £50,000, moves more client records into cloud software.
Why accountants and bookkeepers are targeted
A small practice can hold the financial records of hundreds of clients, usually across email, a client portal and cloud accounting software such as Xero, QuickBooks or Sage. One stolen login can expose all of it, and criminals know that accountants are trusted when they send invoices or request payments.
Making Tax Digital for Income Tax starts in April 2026 for sole traders and landlords with qualifying income over £50,000, falling to £30,000 in 2027 and £20,000 in 2028. As more clients move onto digital records, the security of your practice's cloud accounts matters even more.
The main risks
- Phishing that imitates HMRC, Companies House or software providers, especially around filing deadlines.
- Compromised practice logins giving access to every client in your cloud accounting software.
- Payroll diversion fraud: fake requests to change an employee's or client's bank details before a pay run.
- Hacked email accounts used to send fake invoices or fee requests to your clients.
- Ransomware during busy season, when downtime hurts most.
- Personal data breaches involving client financial and ID data, which may need reporting to the ICO within 72 hours.
How I help accountants and bookkeepers
- Microsoft 365 & Google Workspace SecurityLock down email and file sharing, with multi-factor authentication and alerts for suspicious sign-ins.
- Staff Cyber Awareness TrainingTraining timed before deadline season so staff spot HMRC-themed phishing and payroll change scams.
- Email Security & Phishing ProtectionStop criminals spoofing your practice's domain to send fake invoices to clients.
- Cyber Essentials Certification SupportShow clients and insurers your practice meets a recognised standard.
- Ransomware Protection & Backup ResilienceTested backups so a ransomware attack in January doesn't stop you filing.
Cyber security checklist for accountants and bookkeepers
- Turn on multi-factor authentication for email, cloud accounting software, payroll and HMRC online services.
- Give every member of staff their own login, and remove leavers' access on their last day.
- Review which third-party apps are connected to your accounting software and remove ones you don't use.
- Verify any bank detail change for payroll or payments by phone, using a number you already hold.
- Use a secure client portal for documents rather than email attachments.
- Set up SPF, DKIM and DMARC on your domain.
- Train staff before the January deadline, when HMRC-themed phishing is most common.
- Keep tested backups of client data that ransomware can't reach.
Questions
Do accountancy practices need Cyber Essentials?
It isn't required for every practice, but it's increasingly asked for by clients and insurers, and professional bodies encourage members to protect client information. It covers the controls that stop most common attacks.
How do I secure Xero, QuickBooks or Sage for my practice?
Turn on multi-factor authentication for every user, give each person their own login, remove leavers promptly, limit admin rights and review connected apps regularly.