TL;DR: In July 2026, the IRS and its Security Summit partners launched "Protect Your Clients; Protect Yourself" — a five-week national campaign that runs through mid-August targeting tax preparers, CPAs, enrolled agents, and accounting firms. The campaign flags a surge in phishing schemes, impersonation scams, and stolen-credential attacks specifically aimed at professionals holding sensitive client data (PTINs, EFINs, W-2s, K-1s, Schedule C data). For North Carolina, that campaign is the leading indicator for two overlapping SMB risk populations: the tax-pro firms themselves (nearly all SMB by headcount), and the SMB clients whose data those firms hold. This is the shared defense playbook.
Key takeaway: A phishing email that reaches a CPA and lands in the CPA's client-portal or PTIN-adjacent workflow is the fastest known path to a small-business W-2 breach — the CPA's compromise cascades into every client's tax and payroll data at once. NC SMBs cannot defend that supply-chain risk with their own controls alone. The defense requires the SMB to hold their tax pro to the same posture the FTC Safeguards Rule has required of them since 2023.
Need help hardening your tax practice — or vetting your CPA's cyber posture as an SMB client? Contact Preferred Data Corporation — BBB A+ rated, 37+ years of NC IT expertise, on-site within 200 miles of High Point. Call (336) 886-3282.
What Is the IRS "Protect Your Clients; Protect Yourself" 2026 Campaign?
Announced by the IRS Security Summit in July 2026, the campaign is a five-week joint effort between the IRS, state tax administrators, the American Institute of CPAs (AICPA), the National Association of Enrolled Agents (NAEA), and major tax-software vendors (Intuit, Wolters Kluwer, Thomson Reuters). Three components define the initiative.
- Weekly education modules. Each week covers a different attack vector — spear phishing, credential-stuffing, tax-transcript pretexting, EFIN and PTIN theft, and Written Information Security Plan (WISP) documentation.
- A refreshed IRS Publication 4557 companion set. IRS Publication 4557 ("Safeguarding Taxpayer Data") has been the foundation document for tax-pro security since 2018. The 2026 refresh integrates FTC Safeguards Rule updates and NIST Small Business Cybersecurity Corner content.
- Enforcement signaling. The IRS reminded practitioners that PTIN suspension, EFIN revocation, and IRS Criminal Investigation referrals are available responses when a preparer's data-handling failures rise to willful neglect. That posture matters for SMBs whose tax pro is compromised.
Microsoft threat intelligence, cited in the campaign launch materials, reported multiple tax-themed phishing and malware campaigns during the 2026 filing season, including a February campaign that sent fake W-2 documents and malicious QR codes to about 100 organizations in manufacturing, retail, and healthcare — sectors deeply represented in NC's SMB base.
Why Does an IRS Tax-Pro Campaign Matter to Every NC SMB?
Three linkages carry tax-pro risk directly into the NC SMB tenant.
- Every NC SMB owner has a tax pro. LLCs, S-Corps, and partnerships file through paid preparers. Nearly every one of those preparers holds the SMB's payroll register, W-2s, Schedule K-1s, retirement-plan documents, and prior-year returns. If the preparer is breached, the SMB is breached.
- Payroll fraud pathways. A compromised tax-pro credential grants access to payroll-vendor portals (Gusto, ADP, Paychex), W-2 filings, and 1099 recipients — all of which unlock direct-deposit redirection, quarterly-tax fraud, and identity theft against SMB employees.
- Client-portal phishing cascades to the SMB. Once inside a CPA's client-portal, the attacker phishes the SMB from the trusted CPA sender — invoice redirection, wire-payment change requests, and payroll-change requests all present as legitimate CPA communication.
The IRS's 2026 "Dirty Dozen" list highlighted several scams that overlap directly with SMB risk — inflated Employee Retention Credit filings, fake W-2 phishing, and improper self-employment tax credit promotions. Every one of those is amplified when the preparer's own environment is compromised.
Key takeaway: SMB cybersecurity policy that stops at the SMB's own perimeter is 2019-era policy. In 2026, the SMB's tax pro, payroll vendor, benefits broker, banking portal, and legal counsel are all inside the SMB's cyber attack surface. If any one of them is running the IRS's "posture we're worried about," the SMB inherits the risk without being consulted.
What Attack Chains Are the IRS and Security Summit Flagging in Summer 2026?
The IRS campaign highlights four attack chains that consistently appear in tax-pro breach case files.
- "New client" spear phishing. Attackers email a firm with a fake new-client request, an attached "engagement letter" or "prior return," and a link that leads to a credential-harvest page or a malware-loader archive. The firm's most junior receptionist or intake staffer is the target — they receive email from strangers all day.
- PTIN and EFIN pretexting. Attackers call, email, or fax the firm impersonating IRS e-Services, seeking to "verify" the firm's PTIN or EFIN credentials. Once obtained, the credentials are used to submit fraudulent returns or sold to identity-theft rings.
- Client-portal takeover. Firms with weak client-portal MFA (SMS or none) see credential-stuffing attacks against reused-password accounts. Once inside, the attacker reads returns, changes deposit destinations, and phishes the client from a trusted sender.
- Ransomware via remote-management tool abuse. Small firms using AnyDesk, TeamViewer, or Screen Connect for client support are targeted by ransomware operators (Qilin, RansomHub, Akira) via password spray or leaked-credential replay against those tools.
Post-compromise, the typical dwell time from firm-network entry to client-data exfiltration is 3-14 days for ransomware operators and hours-to-days for financially motivated tax-fraud actors.
What Are the Immediate Actions for NC Tax Firms and Their SMB Clients?
Emergency hardening runs in three parallel workstreams over 60 days.
Workstream 1: Tax-firm posture (all firms).
- Publish or refresh a Written Information Security Plan (WISP) per IRS Publication 4557 and the FTC Safeguards Rule. This is a legal requirement for paid preparers, not a best practice.
- Enforce phishing-resistant MFA on tax software (Drake, ProSeries, UltraTax, Lacerte, ATX, TaxAct Professional), client portals, e-Services accounts, and email.
- Encrypt all client data at rest and in transit. Audit any USB drives or shared-drive folders for unencrypted returns.
- Deploy EDR/MDR on every workstation and server. Signature-only AV is not compliant with the FTC Safeguards Rule's "reasonable security measures" standard.
- Segment the tax-preparation network from general office Wi-Fi and BYOD.
Workstream 2: SMB client posture (every NC SMB with a tax pro).
- Ask your CPA for their WISP. A firm that cannot produce one on request is behind IRS/FTC baseline.
- Confirm which portal the CPA uses, whether it enforces MFA, and whether the CPA has ever had a security incident notify obligation triggered.
- Require the CPA to notify the SMB within 30 days of any material security event affecting the SMB's data — align with FTC Safeguards timing.
- Route any bank-detail change request through a voice-verified callback to a known CPA number, not through email or portal chat.
Workstream 3: Incident-response readiness (both sides).
- Preserve backups of prior-year returns, K-1s, and payroll journals independent of the CPA — a firm compromise should not become an SMB records-loss event.
- Pre-negotiate an incident-response engagement letter with an NC-based MSP or DFIR firm so the response is on retainer, not on-demand at 2 AM.
Explore Preferred Data's cybersecurity services
Tax-Firm Posture Comparison: What Does an IRS/FTC-Ready Firm Look Like?
The bar has moved. What was voluntary in 2019 is legally required in 2026. NC SMBs vetting their CPA should measure against the ready-column posture.
| Control | 2019 Voluntary Baseline | 2026 IRS/FTC-Ready Baseline |
|---|---|---|
| Written Information Security Plan | Optional | Required (Pub 4557 + FTC Safeguards) |
| Multi-factor authentication | Recommended, SMS OK | Required, phishing-resistant preferred |
| Endpoint protection | Signature AV | EDR/MDR with 24/7 monitoring |
| Data encryption | Sometimes | At-rest and in-transit, all client data |
| Backup strategy | On-site drives | Immutable, off-site, tested quarterly |
| Vendor management | Ad-hoc | Documented, MSA-clause-based |
| Incident response | Reactive | Retainer + tabletop-exercised annually |
| Cyber-insurance coverage | Optional add-on | Standard, with WISP-linked underwriting |
| Client breach notification | Informal | 30-day formal per Safeguards Rule |
For NC SMBs, the vetting exercise is short: ask your CPA which column they are in. If the firm cannot answer, or answers with a 2019-column posture on any row, they are a Section 5, IRS Circular 230, and FTC Safeguards Rule risk to your business.
Explore Preferred Data's managed IT services
How Does Preferred Data Help NC Tax Firms and Their SMB Clients?
Preferred Data Corporation delivers WISP authoring, FTC Safeguards Rule compliance, and 24/7 SOC monitoring for NC CPAs, tax preparers, enrolled agents, and their SMB clients. With 37+ years of NC IT expertise, an average client retention of 20+ years, and an on-site radius of 200 miles from High Point, we can bring your firm — or your CPA's firm — to the 2026 ready posture this quarter.
- WISP authoring and refresh. IRS Publication 4557-compliant WISP tailored to your firm size, tax-software stack, and client mix.
- FTC Safeguards Rule readiness. Documented risk assessment, incident-response plan, vendor management program, and board-level reporting.
- Managed cybersecurity for accounting practices. 24/7 SOC, EDR/MDR, immutable backup, MFA rollout, and cyber-insurance renewal support.
- SMB client-portal vetting. For SMBs vetting their CPA, we run a documented vendor-risk review with a written report suitable for E&O and cyber-insurance underwriting.
Ready to close the tax-pro exposure gap before the summer campaign ends? Call (336) 886-3282 or contact our team.
Frequently Asked Questions
Is a WISP legally required for a small tax practice?
Yes. IRS Publication 4557 and the FTC Safeguards Rule both apply to paid tax preparers regardless of firm size. The IRS has publicly indicated that a firm without a WISP is out of compliance with Circular 230 professional-responsibility standards, and the FTC has enforced Safeguards Rule requirements against firms without a documented plan.
What if our CPA outsources IT to a "computer guy" who is not an MSP?
That is a red flag. IRS Publication 4557 and the FTC Safeguards Rule assume the firm has a documented service provider relationship with clear responsibility allocation. A break-fix relationship with an unbonded, uninsured individual is not defensible as "reasonable security measures" under Section 5 of the FTC Act.
Should NC SMBs move to a new CPA if the current one has a weak security posture?
Escalate before you exit. Bring the CPA the vetting checklist, ask for a 90-day remediation plan, and offer to introduce them to an NC MSP if they lack one. Many small CPAs are willing to harden — they simply have not been asked. If the 90-day check-in shows no movement, then plan the transition.
Do we need to add cyber-insurance disclosure to our client engagement letters?
Best practice in 2026 is yes. A short paragraph disclosing the firm's WISP, the fact that MFA is enforced, and the firm's cyber-insurance carrier reassures institutional clients and preempts questions from the client's own cyber-insurance underwriter.
How long does WISP authoring typically take?
For a solo practitioner or a 2-3 person firm, a good WISP takes 40-60 hours the first time (interviews, drafting, review, sign-off). For firms up to 25 preparers, plan 80-160 hours. Annual refresh takes 8-24 hours. Preferred Data delivers first-time WISP authoring in 30-45 days from kickoff.
How fast can Preferred Data audit our accounting firm's security posture?
For an active NC tax firm inside our 200-mile service radius, the posture assessment against IRS Publication 4557 and the FTC Safeguards Rule takes 2-3 weeks and produces a written remediation plan with prioritized fixes. Call (336) 886-3282 to schedule.