Tax professionals should watch out for 'new client' data breach scheme

The Oregon Department of Revenue (DOR) and the IRS are asking tax professionals to watch out for a new round of filing season-related email schemes where cybercriminals pose as potential clients. Previously, a surge in these seasonal “new client” scams where identity thieves target accounting groups and tax preparation firms with fake emails has been noted.

This year, the IRS is already receiving information about new client scams. With the 2024 tax season quickly approaching, fraudsters are impersonating real taxpayers seeking help with their taxes, using emails to try obtaining sensitive information or gain access to tax professionals’ client data.
DOR and the IRS warn that the new client email scam’s goal is to steal sensitive personal information that will allow fraudsters to prepare authentic looking tax returns to collect a refund – or use it to commit other types of fraud.

Last year, DOR processed reports of 16 breaches at small, medium, and large firms.

Oregon law requires tax professionals to notify DOR within five days if they discover a data security breach or have reason to believe that a breach has occurred. The tax professional must provide DOR the name, address, and tax ID number of the consumer whose personal identification has been compromised.

More information about what tax professionals should do in the event of a data breach is available on the DOR website.

Tax practitioners with other tax or customer account questions are encouraged to contact a dedicated practitioner specialist by email at prac.revenue@dor.oregon.gov, or by phone at 503-947-3541.