It is the second week of January. Your inbox is full of client queries, HMRC reminders and “urgent” requests to update bank details. One of those emails is not from who it claims to be. That is the week most practices are easiest to catch out.
Cyber security for accountants is not about buying more software. It is about closing the few gaps criminals rely on. Weak logins. Unchecked payment changes. Missing backups. Nobody knowing what to do when something goes wrong. This guide covers why practices are targeted and what the ICO and HMRC expect. You also get a 10-point checklist, a cost breakdown and a plan for the first hour of a breach.
Why are accountants a target for cyber criminals?
Because you hold everything a fraudster wants in one place. A typical practice stores names, addresses, National Insurance numbers, UTRs, bank details and payroll records. You also keep passport and utility bill copies from anti-money laundering checks.
Then there is access. Your HMRC agent services account can see and change tax records for every client you act for. Your email is trusted by clients who will happily pay an invoice or share a document if it appears to come from you.
Small firms are not off the radar. The government’s Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses had a breach or attack in the last 12 months. For small businesses the figure was 46%. Criminals favour volume, and small practices often have the weakest defences.
Timing matters too. Deadline season means long hours, rushed approvals and lots of genuine HMRC emails. Phishing that would look odd in July looks normal in January.
What cyber threats do accountancy firms face most?
Most incidents in practices fall into five patterns. Phishing is the most common route in: the same survey found 38% of all UK businesses experienced it in a year.
| Threat | How it looks in a practice | First line of defence |
|---|---|---|
| Phishing | A fake HMRC, Companies House or Microsoft 365 login page sent to a busy junior | Multi-factor authentication (MFA) and short, regular staff training |
| Payment diversion fraud | A “client” or “supplier” email asking you to update bank details before a payment | A call-back rule using a number you already hold, never one in the email |
| Ransomware | Files and practice software locked the week before a filing deadline | Patching within 14 days and backups that cannot be reached from the network |
| Account takeover | Someone logs into your agent services account or mailbox with stolen details | MFA everywhere, unique passwords and alerts on new sign-ins |
| Leaver and supplier risk | A former employee or old software vendor still has access | A written leaver process and a yearly access review |
Notice that none of the first defences is exotic. Most breaches in small firms come down to basics that were never switched on, or were switched on for some people and not others.
What do the ICO, HMRC and ICAEW expect from your practice?
You are a data controller under UK GDPR, so you must protect client data with appropriate security. If a breach is likely to put people at risk, you must report it to the ICO within 72 hours of becoming aware of it. The ICO’s personal data breach guide explains how to judge that.
HMRC is clear as well. The HMRC standard for agents says you should “maintain the security of client information” you hold. It also says you should keep “online access and HMRC account credentials safe from unauthorised use at all times”. Sharing one agent login around the office does not meet that bar.
There is a practical reason to turn on MFA for your agent account too. Since July 2026, HMRC lets agents report suspicious activity through the security console in their agent online account, but only if MFA is active.
Your professional body will expect the same. ICAEW, ACCA and ICAS all publish cyber guidance for members, and insurers increasingly ask about MFA, backups and training before they quote.
Cyber security for accountants: a 10-point checklist
Work through this list with whoever looks after your IT. Most practices of 10 to 30 people can close the gaps in a few weeks.
- Turn on MFA everywhere. Microsoft 365, practice management software, cloud accounting, payroll, banking and your HMRC agent account. No exceptions for partners.
- Give everyone their own logins. No shared accounts for HMRC, software or email. You need to know who did what.
- Patch within 14 days. Laptops, servers, apps, routers and firewalls. Automate it where you can and check it monthly.
- Back up so you can actually restore. Keep at least one copy offline or immutable, include Microsoft 365, and test a restore every quarter.
- Write a payment verification rule. Any change of bank details is confirmed by phone on a number you already hold. Make it a rule, not a suggestion.
- Stop emailing tax returns as attachments. Use a secure client portal or encrypted sharing with expiring links.
- Encrypt every laptop and phone. Turn on BitLocker or FileVault, and make sure you can wipe a lost device remotely.
- Remove admin rights from day-to-day accounts. Staff should not be able to install software. It stops a lot of malware in its tracks.
- Train before deadline season. A 20-minute refresher in December on spotting fake HMRC and bank emails is worth more than an annual lecture.
- Have a one-page incident plan. Who to call, how to isolate a device, how to contact clients, and who decides on reporting to the ICO.
Item 2 links closely to how you handle leavers. Our IT offboarding checklist walks through the 14 steps to remove access properly when someone leaves.
If you score yourself honestly, how many of the 10 are fully done? The survey suggests you are not alone if the answer is low. Only 47% of UK businesses had two-factor authentication in place, and just 25% had a formal incident response plan.
Does an accountancy firm need Cyber Essentials?
It is not a legal requirement, but it is the clearest way to prove you have the basics in place. Cyber Essentials is the government-backed scheme run by IASME. It checks five controls: firewalls, secure configuration, user access, malware protection and security updates.
The scheme got stricter on 27 April 2026. Under the new “Danzell” question set, missing MFA on any cloud service where it is available is now an automatic fail. So is not applying high-risk and critical updates within 14 days.
For a practice, that is good news. Cyber Essentials now lines up almost exactly with the checklist above. It also answers the question larger clients and insurers keep asking: “How do we know our data is safe with you?”
Awareness is still low. Only 17% of UK businesses had heard of Cyber Essentials when prompted. Holding it can set your firm apart when a client compares two practices. We hold Cyber Essentials ourselves, so we know what the assessment involves from both sides.
What does cyber security for an accountancy practice cost?
Less than most partners expect, because much of it is configuration rather than new products. Here is where the money goes.
| Item | What you pay for | Typical cost driver |
|---|---|---|
| Cyber Essentials certification | IASME assessment fee, plus any help preparing | Number of staff. IASME fees start at around £320 + VAT for 1 to 9 users and £440 + VAT for 10 to 49 (source) |
| Microsoft 365 security features | A licence tier that includes device management and advanced email protection | Per user, per month |
| Backup | Offsite, immutable backup of files, practice software and Microsoft 365 | Amount of data and how far back you keep it |
| Secure client portal | Encrypted document exchange and e-signing | Often bundled with practice software |
| Training | Short online modules and simulated phishing | Per user, per year |
| Managed IT and monitoring | Someone patching, watching alerts and answering the phone | Number of users and devices |
The bigger number is the cost of doing nothing. A week without access to client files in January means missed deadlines, penalty letters and partners working weekends to rebuild records. That is before any ICO involvement or reputational damage.
Want this handled as part of your wider IT? Our IT support for professional services covers patching, backups and Microsoft 365 security in one agreement, backed by a 7-day service desk.
What does a cyber incident look like in a real practice?
Picture a 12-person practice in Chester. It is 22 January. A senior bookkeeper gets an email that looks like a Microsoft 365 password expiry notice. She is busy, so she clicks and enters her details.
Without MFA, the attacker is in her mailbox within minutes. They set up a rule that hides replies, then read a thread about a client’s company sale. Two days later the client gets an email “from the practice” with new bank details for a fee payment. It looks completely genuine because it is sent from the real mailbox.
Now replay it with the checklist in place. MFA blocks the login, so the stolen password is useless. Even if it had worked, the client knows your firm never changes bank details by email. A sign-in alert flags the attempt and IT resets the password the same morning.
Same email. Same busy week. Completely different outcome.
What should you do in the first hour of a breach?
Speed limits the damage. Keep this list next to your incident plan.
- Disconnect the affected device from the network and Wi-Fi. Do not switch it off, as that can destroy evidence.
- Call your IT provider and tell them exactly what happened and when.
- Reset passwords for the affected accounts from a clean device, and sign out all active sessions.
- Check for mailbox rules and forwarding that you did not create.
- Warn clients if there is any chance they will receive fake payment requests.
- Report suspicious HMRC account activity through the agent security console or HMRC’s online form.
- Start a log of what you know and when, so you can decide on ICO reporting within the 72-hour window.
The NCSC’s small business response and recovery guide is a good template if you are writing your plan from scratch.
Cyber security for accountants: FAQs
Is cyber security a legal requirement for accountants?
Yes, in effect. UK GDPR requires appropriate security for personal data, and the HMRC standard for agents requires you to keep client information and HMRC credentials secure. No law names a specific product, but you must be able to show reasonable measures.
Do small accountancy firms need Cyber Essentials?
It is optional, but worth it. It proves the basics to clients and insurers. Since April 2026 it also requires MFA and 14-day patching, two controls that block many common attacks.
How often should accountancy staff have cyber training?
Little and often works best. Aim for short refreshers every quarter, with one timed just before the self assessment rush, plus training for every new starter in their first week.
Does cyber insurance replace good security?
No. Insurance helps with recovery costs, but most insurers now expect MFA, backups and patching before they will cover you. Weak controls can mean higher premiums or a declined claim.
What if our HMRC agent services account is compromised?
Change the password and check MFA straight away, then report it through the security console in your agent account or HMRC’s online form. Check recent changes to client records and tell affected clients.
Want a second pair of eyes on your practice?
If you are not sure how your firm scores against the checklist, we can help. Book a free, no-obligation IT review call and we will spot the gaps and quick wins, with no hard sell. Get in touch through our contact page or call 0330 313 0966.
You can also see how our cyber security services for small business work in practice.