Microsoft's threat intelligence team published research this spring on phishing campaigns built specifically around tax work. One of them reached more than 29,000 people across 10,000 organizations in a single nine-hour window, and the recipients weren't random — Microsoft found the campaign was aimed at accountants and tax preparers.
The lure was boring on purpose: a note claiming suspicious returns had been filed under the firm's e-filing number, with a button to view a transcript. The page it led to was a look-alike of a document portal accountants actually use. What downloaded was remote access software.
That's the headline risk. The quieter one is what leaves your firm every day during extension season — a return, a K-1, a client's Social Security number, attached to an ordinary email and sent off to somebody's Gmail.
Plain email is a postcard. Anyone who handles it along the way can read it.
If your firm is on Microsoft 365 Business Premium, E3 or E5, you already own the fix. Purview Message Encryption adds an Encrypt button in Outlook, and your client on Gmail opens the message with a one-time passcode — no account, nothing to install. Your admin can also make it automatic for anything sensitive heading outside the firm.
It's an afternoon of setup. Worth doing before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email