Scott Alldridge: The Cybersecurity Lesson Every CPA Firm Can Learn From Its Own Client Data

Every CPA firm, regardless of size, holds something more valuable than most owners stop to consider: a single, organized file containing a client’s Social Security number, income history, bank account and routing numbers, dependents’ names, and often a complete picture of their net worth. To a cybercriminal, that isn’t simply a tax file. It’s a concentrated collection of financial and identity information that can potentially be exploited in multiple ways.

That concentration of value is a big part of why accounting firms have climbed steadily up the target list in recent years. Scott Alldridge, Founder, President & CEO of IP Services and Co-Founder & President of IT Process Institute (ITPI), shares that phishing and social engineering are the entry point in roughly seven out of every ten incidents. Not sophisticated code-breaking, a convincing email, a spoofed vendor invoice, or a phone call from someone claiming to be IT support who just needs a password reset.

The pattern hits CPA firms differently than it hits many other small businesses because of how the risk is concentrated. A retail shop that gets breached may lose transaction data for customers who happened to shop there. A CPA firm, by contrast, may hold sensitive financial and personal information for hundreds or thousands of clients in one environment. A single compromise can therefore create consequences that extend far beyond one affected account.

The financial consequences of seemingly routine email requests can be enormous. The FBI reported $55.5 billion in exposed losses from business email compromise between October 2013 and December 2023, across more than 305,000 domestic and international incidents. For a CPA firm, that makes a seemingly ordinary request to change banking information, redirect a refund, or send sensitive documents to a new email address anything but routine.

The exposure isn’t necessarily proportional to the size of the firm. It can be proportional to the amount and concentration of sensitive information held on behalf of its clients.

Why CPA Firms Become More Vulnerable When Tax Season Accelerates

Filing season makes this sharper. During tax season, a firm’s inbox, e-file system, and client portal are holding more sensitive data, more actively, than at many other points in the year, while staff are often working under tighter deadlines.

That combination of volume, urgency, and sensitive information can create opportunities for social engineering. An email disguised as a client sending “updated documents,” or a notice that appears to come from the IRS, may be more difficult to scrutinize when employees are processing large numbers of requests under time pressure.

For CPA firms, the challenge is therefore not simply keeping malicious messages out. It is making sure employees know what to do when a legitimate-looking request reaches them.

When Cyber Insurance Meets the Reality of a Firm’s Security Controls

One number worth sitting with: cyber insurance claims were denied 43% of the time in 2025. Firms understandably assume the policy is their safety net if something goes wrong.

According to Scott Alldridge, denials don’t necessarily happen because a firm provided inaccurate information on its application. They can also result from gaps between the security controls a firm believes it has in place and what can actually be verified. A tool may be installed, for example, without anyone confirming that it remains properly configured and effective months later.

It’s the gap between “we bought protection” and “we can prove protection was working on the day it mattered,” and insurers increasingly ask for the second one, not the first.

For CPA firms, that distinction matters because insurance coverage and cybersecurity practices are increasingly connected. Documented procedures, employee training, access controls, and verification processes can all become important parts of demonstrating how a firm manages cyber risk.

The Weak Point May Be the Person Following the Process

Alldridge emphasizes that effective cybersecurity depends not only on technology, but also on the processes employees follow when handling unusual or sensitive requests.

When MGM Resorts suffered its now widely reported breach, the failure wasn’t a missing firewall; it was a single phone call to a help desk, where an employee reset a credential without following identity verification protocol. One unverified request, handled under normal-seeming pressure, opened the door to a loss that ultimately ran past $100 million once settlements were included.

The lesson for CPA firms is straightforward: a technical defense can be undermined when a routine process allows the wrong person to gain access.

For a CPA firm, the equivalent moment is easy to picture: a message that looks exactly like it’s from a client, asking to redirect a refund, update banking details on file, or resend a return to a “new” email address.

Spam filters, updated software, and multi-factor authentication matter, and they should be current. But firms also need clear rules for what employees must verify before making a sensitive change.

What a Suspicious Request Looks Like Inside a CPA Firm

A simple verification procedure can prevent an otherwise convincing request from becoming a serious incident.

If a client requests a change to payment information, for example, employees should not rely solely on the email or phone number included in the request. An independent communication channel can provide a separate layer of confirmation before the change is made.

The same principle can apply to requests involving tax documents, account credentials, client portals, refunds, and other sensitive information.

The goal isn’t to make every process unnecessarily complicated. It’s to identify the handful of actions that carry significant risk and establish verification requirements before those situations occur.

A few clear rules can protect an entire client list

None of this requires an enterprise security budget. It requires a short list of decisions made in advance, before an urgent-sounding request forces a fast one:

• Verify any request to change payment, banking, or contact details through an independent channel.
• Establish clear procedures for who does what in the first hour after something looks wrong.
• Regularly confirm that security tools are properly configured and still working as intended.
• Document security procedures and employee responsibilities so they are clear before tax-season pressure begins.
• Have an honest conversation with the firm’s cyber insurance provider about what documentation would actually be required if a claim were filed.

The takeaway for CPA firm owners is straightforward: cybersecurity isn’t only about what technology a firm buys. It’s also about what people are required to do before they act.

The tools protect the perimeter. The process protects the client list.

Firms that write down how they verify a request and hold the line on it even when someone is in a hurry are better positioned to turn a suspicious request into a stopped transaction rather than a breach affecting clients across the firm.