October 2026 | IT Support for CPA Firms Salt Lake City | AI Threats | Halloween Cybersecurity
Look at any Salt Lake City neighborhood this Halloween and you'll see countless monsters roaming the streets. Vampires, creatures and ghouls all "wreaking havoc" — which is to say, going to parties and trick-or-treating.
The real monsters targeting CPA firms don't look like this. They don't announce themselves as threats, even jokingly. They dress themselves in the costume of harmless, helpful allies — an IRS notice, a client email, a productivity tool. And with the October 15 deadline just past and your accounting staff finally catching their breath, this is exactly the season they come knocking.
While firms like yours use AI tools to boost security and productivity, cybercriminals are using the same power to disguise obvious threats with polish and poise. The right IT support and a few core security habits mean your preparers don't have to be expert scam-spotters to keep client tax records safe. Garlic around your neck won't help you here — it's all about simple processes and safeguards.
AI Shapeshifters: Sounding Right Isn't Enough Anymore
Video and audio used to be a clear differentiator between someone real and someone trying to scam you. Now, with AI, scammers can take many forms — a realistic voicemail from a longtime client authorizing a change to their refund deposit account, a call that sounds exactly like the managing partner approving a wire, even video convincing enough to pass a quick glance.
Even if you can spot the telltale signs of AI-generated audio today, those wrinkles are getting ironed out quickly. You might not be as good at spotting them as you think — many "AI tells" are already outdated.
Instead of depending on individual detection, focus on what can't be faked: verification procedures for any sensitive action — banking changes, refund deposit updates, portal access grants, e-file authorizations. A call back to the client at the number in your practice management system defeats a deepfake every time. Shapeshifters can fool your ears, but they can't fake a documented verification procedure and multi-factor authentication.
AI Mummies: Old Scams Wrapped in New Cloth
In past years, phishing messages had spelling and grammatical mistakes that made them easy to spot. Typos, generic greetings and overused urgency became the benchmarks your accounting staff was taught to look for.
Those same scams have much better costumes now. The IRS-impersonation email — the oldest trick aimed at tax professionals — arrives with perfect spelling, flawless formatting, a convincing e-Services header and language lifted straight from real IRS correspondence. Fake SafeSend and ShareFile notifications look pixel-perfect. "New client" inquiries read like they were written by a real controller, because in a sense they were.
Like an ancient mummy rising from the tomb, these scams are just as dangerous as they've always been — but wrapped in fresh rags that disguise how monstrous they really are. Train your staff to look for red flags in the requests themselves, not just flaws in the messages. The IRS doesn't email you about your EFIN. Clients don't usually change bank accounts the day before a refund. Don't relax just because a message gets the details right and is spelled properly.
AI Vampires: Never Invite Them In
In vampire myths, innocents are protected by never inviting the vampire inside — the creature cannot enter without direct permission. Unvetted AI tools work the same way.
When staff use AI tools that haven't been approved by the firm — a phenomenon known as shadow IT — there are boundless opportunities to expose client tax records to unvetted programs.
An AI tool can't reach into your tax software and read client files on its own. But nothing stops a well-meaning preparer from pasting a client's K-1 details, a draft return or a spreadsheet full of SSNs into a public chatbot and asking for a summary. For a CPA firm, that's not just risky — it's a direct violation of the safeguards you've committed to under IRS Publication 4557 and the FTC Safeguards Rule, and potentially of the disclosure rules that govern taxpayer information. If you can't answer where that information goes, where it's stored and what the tool's creator can do with it, it's not a tool that should be invited anywhere near client data.
The Best Defense Against AI Monsters? Better Rules
Advancements in AI have made deception cheaper to exploit, faster to implement and more convincing — even to trained eyes. But if your accounting staff internalizes a few small protective habits, even the most sophisticated disguises won't trip them up:
- Verify sensitive requests — banking changes, refund deposits, e-file authorizations — through a second channel at a known number. Always, no exceptions.
- Judge messages by what they ask for, not how polished they look. A perfect-looking IRS email is still not how the IRS contacts you.
- Use only firm-approved AI tools, and never paste client tax records, SSNs or return data into unapproved ones.
- Make reporting suspicious activity fast, easy and blame-free — and document these procedures in your WISP.
Simple rules, consistently followed, beat sophisticated detection skills every time. That's good news, because rules can be written down, trained and audited — exactly what the IRS expects of a tax practice.
Frequently Asked Questions
Do you offer cybersecurity and IT support for CPA firms in Salt Lake City?
Yes. Qual IT provides IT support for CPA firms in Salt Lake City, including managed IT, cybersecurity, employee security awareness training focused on IRS-impersonation and client-spoofing scams, backup and disaster recovery for tax and accounting systems, secure client portal support and IRS data security compliance guidance.
What are AI-powered cyber threats to accounting firms?
They're traditional attacks — phishing, impersonation, fraud — enhanced by AI: deepfake voice calls authorizing banking changes, flawlessly written fake IRS notices and automated targeting of tax professionals. The underlying scams are old; the disguises are dramatically better, and firms holding client SSNs are among the most valuable targets.
How can CPA firms protect against deepfake and AI scams?
Build verification procedures that don't depend on recognizing fakes: call-back verification for any banking or refund change, multi-factor authentication on tax software and portals, an approved-tool policy for AI use documented in your WISP, and staff training focused on request red flags rather than message quality.
Know Where Your Gaps Are Before the Monsters Find Them
Need help protecting your firm against AI monsters coming for your clients' data? We'll discuss how your staff is using AI, how sensitive requests like banking changes are verified, and what protections already surround your tax software and client portals. You'll leave knowing where your biggest gaps are and which threats are seriously spooky this Halloween season — with time to fix them in the post-deadline window, before tax season returns.
We work with Salt Lake City CPA firms to protect client data and keep systems running through tax season. Schedule a free 10-minute discovery call with Qual IT.
