Cybersecurity training for seasonal tax preparers should happen before a new hire can access tax software, email, or client files. Cover phishing recognition, secure taxpayer-data handling, multi-factor authentication (MFA), unusual-request verification, and the reporting steps in your written information security plan (WISP).
A WISP is a documented plan for protecting customer information. For a seasonal employee working only 10-16 weeks, a short, role-specific session and a mid-season reminder are more useful than a long generic course.
Quick Answer
Train seasonal preparers before issuing system access, then reinforce the essentials during filing season. The training should explain how to spot phishing, protect taxpayer data, use MFA, verify unusual requests, and report suspicious activity immediately. Keep attendance and completion records with your WISP documentation.
Key Takeaway
Give seasonal staff clear rules before they handle returns: use MFA, verify unusual requests outside the original message, follow the WISP, and report suspicious activity without trying to investigate it alone. Training reduces risk, but technical controls and documented procedures still matter.
Why seasonal tax preparers need focused security training
Tax season puts Social Security numbers, bank details, W-2s, and prior-year returns in front of staff who may be new to the firm's systems and normal communication patterns. Deadline pressure can make a convincing message that appears to come from a client, partner, or software provider harder to question.
According to Verizon's 2025 Data Breach Investigations Report, the human element remained involved in 60% of breaches Verizon analyzed. That statistic does not mean a seasonal employee will cause an incident, but it supports training people to pause and verify before sharing data or entering credentials.
Phishing is a deceptive message designed to get a recipient to disclose information, open a malicious link, or take another unsafe action. A preparer should know that a request for a W-2, client data export, bank-change instruction, or login can require an out-of-band verification call to a known number.
What seasonal preparer training should cover
- Recognize phishing emails and fake tax-software or email login pages.
- Verify unexpected requests for W-2s, taxpayer information, payment changes, or credentials by phone or another known contact method.
- Use a unique password and MFA for email, tax software, file-sharing, and other approved systems.
- Handle, store, and share taxpayer data only through the methods approved in the firm's WISP.
- Avoid accessing client files through public or unsecured Wi-Fi unless the firm's approved security measures are in use.
- Report suspicious messages, lost devices, mistaken disclosures, and unexpected account prompts immediately.
Use IRS and FTC guidance to set the training baseline
IRS Publication 4557, Safeguarding Taxpayer Data, tells tax professionals to educate employees about security, including phishing and protecting taxpayer data. The IRS Security Six is a set of recommended protections for tax professionals, including employee awareness of phishing and malware.
The FTC Safeguards Rule requires covered financial institutions to develop, implement, and maintain an information security program. The FTC's Safeguards Rule guidance includes training staff as an administrative safeguard. Most paid tax preparation businesses should review whether the rule applies to them and discuss legal questions with counsel or a compliance advisor.
A signed attendance sheet, learning-management record, or dated acknowledgement does not prove every person will make the right decision under pressure. It does help show that your firm provided the training required by its procedures and gives you a record to review when updating the WISP.
Schedule training around system access
Before day one
Deliver a live or recorded session on phishing, taxpayer-data handling, MFA, and reporting. Review the parts of the WISP that apply to the preparer's role before issuing access.
During the first week
Confirm the preparer can identify the reporting contact and understands how to verify an unusual request. Pairing a new preparer with an experienced employee can give them a clear escalation path.
Mid-season
Send a short reminder before peak deadline pressure. Revisit current phishing examples and the process for reporting a message or account prompt that looks wrong.
Pair training with controls that can catch a mistake
Training helps people make better decisions, but it cannot guarantee that a rushed employee will never click a convincing link. Require MFA on every available account, limit access to the client data each role needs, and make sure devices handling returns receive security monitoring and updates.
Our tax firm access control guide explains how role-based access can reduce unnecessary exposure to taxpayer data. A documented plan also needs to explain training and recordkeeping, which is covered in our IRS WISP requirements guide and FTC Safeguards Rule checklist.
For firms that want managed device protection alongside staff trainingBellator Shield managed EDR provides managed endpoint detection and response for $19 per computer per month. It suits firms that need focused endpoint coverage, while Bellator's protection plans explain the broader Bellator Core option, which includes managed EDR, remote monitoring, and Ransomware Rollback® for $33 per computer per month. These services can reduce risk, but they do not replace staff training or guarantee prevention of an incident.
Book a Free Tax Cybersecurity Assessment
Review whether your seasonal-staff training, access controls, and WISP documentation cover the risks your firm faces this filing season.
Frequently Asked Questions
Yes. Any worker who handles taxpayer data or accesses the systems that hold it should receive role-appropriate security training before access is granted. IRS Publication 4557 recommends educating employees, and covered firms should account for staff training in their Safeguards Rule information security program.
Provide training during onboarding before access to client data, then send a focused refresher during the season. A reminder is especially useful before periods of heavier deadline pressure, when staff may be more likely to act quickly on an unexpected request.
No specific IRS course or vendor is identified in Publication 4557 or the Security Six. Your firm should choose a method that covers the relevant risks, documents completion, and gives staff clear instructions for reporting suspicious activity.
A focused 30-60 minute onboarding session can cover phishing, taxpayer-data handling, MFA, unusual-request verification, and reporting. Follow it with a short scenario discussion or supervised review of the firm's reporting process so the preparer knows what to do in practice.
From requirement to defensible practice
Turn IRS and FTC expectations into a WISP your office can follow
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring Tax security & WISP
Understand what tax professionals need to document, protect, and prepare before an IRS or FTC review.
- Common question: free WISP templateStart with a written information security planUse a practical WISP framework built around the safeguards tax practices need.
- Common question: IRS Publication 4557 requirementsRead the Publication 4557 guideSee how the IRS expects tax professionals to safeguard taxpayer data.
- Common question: IRS WISP requirementsReview the WISP requirementsWork through the required sections and the evidence your practice should retain.
- Common question: FTC Safeguards Rule checklistUse the FTC Safeguards checklistTranslate the rule into a clear list of security and documentation tasks.
- Common question: tax practice incident response planPrepare a tax-office incident planKnow who to contact, what to preserve, and how to respond to a client-data incident.
