In short: Cyber security training for accountants prepares partners and staff for tax-season phishing, HMRC impersonation, payment diversion and client account takeover, and teaches safe handling of client financial data and identity documents. Short lessons and simulations themed on the tax calendar make it relevant, and records support your professional obligations.
Why accountancy firms are targeted
Accountants are attractive to criminals for several reasons:
- Access to clients' tax, payroll and banking information, and sometimes the ability to make payments for them
- Identity documents collected for anti-money laundering checks
- Agent access to HMRC online services, which criminals can abuse to divert repayments
- Predictable deadlines, which make urgent messages about tax returns and payments believable
- Many small firms with limited IT support
The consequences go beyond the firm itself. A compromised mailbox can be used to send fake invoices to every client, a stolen login to accounting software can expose dozens of businesses at once, and misuse of agent access can divert a client's tax repayment. That is why training needs to cover how criminals use the firm as a route to its clients, not just how they attack the firm.
Partners and practice managers should also be included: they approve payments, hold the most privileged access and are the people criminals most often impersonate. See security awareness training for employees for role-based modules.
Tax-season phishing and HMRC impersonation
Phishing volumes and themes follow the tax calendar. Staff should expect lures around:
- The Self Assessment deadline of 31 January, and the weeks either side
- Fake tax refund or rebate notifications
- Making Tax Digital for Income Tax, which began for its first group of sole traders and landlords in April 2026
- Year-end payroll, P60s and Real Time Information submissions
- Fake 'Government Gateway' or HMRC sign-in pages
Train staff to treat any email or text that offers a refund or asks for personal, login or payment details as suspicious, to sign in only by typing the address or using a saved bookmark, and to report suspicious HMRC messages rather than delete them. GOV.UK asks people to forward suspicious HMRC emails to phishing@hmrc.gov.uk and texts to 60599. General phishing emails can go to the NCSC at report@phishing.gov.uk; see how to report a phishing email.
Payment diversion and client impersonation
Accountants are caught both ways: criminals impersonate the firm to clients, and clients or suppliers to the firm.
| Scenario | Defence to train |
|---|---|
| A 'client' emails new bank details for a repayment or payroll run | Verify by calling a number already on file, never one in the email |
| A 'partner' asks for an urgent, confidential transfer | Dual authorisation and permission to challenge |
| A client receives a fake invoice in the firm's name | Tell clients how you invoice and that your bank details will not change by email |
| A supplier's mailbox is compromised and sends a genuine-looking invoice | Check unexpected changes to amount, account or tone |
Our business email compromise training explains these scenarios and call-back verification in depth. If money is lost, contact your bank immediately and report it to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland (in Scotland, report to Police Scotland).
Protecting client data
Client financial records and identity documents need careful handling:
- Use a secure client portal or encrypted sharing rather than plain email attachments for tax returns and identity documents
- Check recipients before sending; a misdirected email can be a personal data breach under UK GDPR
- Keep AML identity documents only as long as required, and restrict access to them
- Lock screens and protect devices, especially when working at client premises or from home
- Protect access to HMRC agent services and accounting software with MFA
See GDPR training for staff for data protection basics, password and MFA training for account security and safe use of AI at work before anyone pastes client figures into a chatbot. Your professional body's ethics code also expects client confidentiality to be protected.
A tax-calendar training plan
Time the programme so training lands before the busiest phishing periods:
| When | Focus |
|---|---|
| Autumn | HMRC impersonation and fake sign-in pages, ahead of the Self Assessment peak |
| December and January | Short reminders on deadline-themed phishing; a simulation themed on tax refunds |
| Spring | Payroll year-end and payment diversion; supplier and client bank-detail checks |
| Summer | Client data handling, secure sharing, remote and client-site working |
Our security awareness training programme guide shows how to build a full 12-month calendar.
How we help accountancy firms
We choose a platform from the vendors we supply that suits the size of your practice, set up tax-calendar themed simulations and lessons, add policy sign-off and send partners a short quarterly report. For smaller practices, our approach for small businesses keeps the admin very light.
Contact us to plan training for your practice.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Why do accountants need cyber security training?
Because they hold client financial data, identity documents and access to HMRC services, and handle payments. Criminals target them with HMRC impersonation, tax-season phishing and payment diversion, and training is the main defence against messages that get past email filters.
How do I report a phishing email pretending to be HMRC?
GOV.UK asks people to forward suspicious HMRC emails to phishing@hmrc.gov.uk and suspicious texts to 60599. Do not click links or open attachments, and report it internally too so colleagues can be warned.
When is phishing aimed at accountants most common?
Around tax deadlines, particularly the Self Assessment deadline of 31 January, and around payroll year-end. Schedule reminders and simulations in the weeks before these peaks.
What should an accountancy firm do if a client's payment is diverted?
Contact the bank that sent the payment immediately, report it to Report Fraud, preserve the emails, check whether any mailbox was compromised and consider whether a personal data breach needs reporting to the ICO.