Staff security training

About 15 minutes: six short lessons and a 10-question quiz. It runs only in your browser: your name and answers are not sent anywhere. At the end you can print a completion record and save it as a file for your binder.

Course version 1.0 (4 Nov 2026). General security awareness for small tax offices; not legal advice. Your office's own written security plan (WISP) comes first where it says something different.

1. Why this matters

Tax offices hold exactly what criminals want: names, Social Security numbers, bank details and prior-year returns. Stolen data is used to file fake returns and steal refunds. The FTC Safeguards Rule (16 CFR 314.4(e)) expects every office to give its staff security awareness training, and Form W-12 asks preparers whether they are aware that a written information security plan is required by law. Most break-ins start with one person clicking, typing a password, or letting someone in. That is why this training is for everyone in the office, not only the IT person.

2. Phishing: emails, texts and calls that are not what they seem

• "New client" emails. The IRS warns that criminals pose as new clients. Some send a link or attachment right away; others first ask "are you taking new clients?" and send the harmful file after you reply. Their emails can come from real, stolen accounts.
• Check the sender another way. Before opening an unexpected attachment or link, call the person on a phone number you already know is correct, not one written in the message.
• The IRS does not start contact by email, text or social media to ask for personal or financial information. Treat such messages as fake. Suspicious IRS-themed emails can be reported to phishing@irs.gov.
• Warning signs: urgency ("today", "account locked"), a request for passwords, codes or payment, an unexpected attachment, a link whose address does not match the company.

3. Passwords and the second sign-in step

• Use a long, different password for each account: email, tax software and client portal. A password manager makes this easy.
• Turn on multi-factor authentication (a code or app approval after the password) wherever it is offered, especially email and tax software.
• Never share a password or a sign-in code, not with a caller, a colleague or "IT support". If you approved a sign-in you did not start, tell the person in charge at once.

4. Your computer

• Lock the screen when you leave your desk: press Windows + L.
• Do not turn off antivirus or updates, and do not install software the office has not approved.
• Never let an unknown caller connect to your computer. Scammers pretend to be support staff and ask you to install remote-access software. Hang up and tell the person in charge.
• Do not use personal USB drives or personal email accounts for office work.

5. Handling client information

• Send and receive client documents only through the office's client portal or encrypted email, not as plain email attachments.
• Only open the client records you need for your work.
• Paper with client information goes in a locked place while in use and is shredded when no longer needed.
• Do not discuss client details where others can hear, and do not leave them on screen for visitors to see.

6. If something goes wrong

• Tell the person in charge of security right away if you clicked something suspicious, typed a password into a strange page, lost a device, or see odd account activity. Speed matters more than blame.
• Do not try to fix it quietly, and do not delete the message: it may be needed.
• For data theft, the IRS asks tax professionals to contact their IRS Stakeholder Liaison quickly ("Speed is critical"). The person in charge follows the office's incident steps in its WISP.

Quiz

Answer all 10 questions. You need 8 correct answers to complete the training. You can try again as often as you like.