The tax season has always been a critical time for both individuals and businesses, but it has never been quite as fraught with cyber threats as it is these days. The hard shift to digital filing—along with a constantly evolving threat environment—has turned this annual ritual into a prime time for cybercrime.

In 2024 alone, the Internal Revenue Service (IRS) uncovered $9.1 billion in tax fraud cases and received nearly 300,000 reports of identity theft. Whether it’s phishing emails designed to trick filers into disclosing personal details or sophisticated malware operations targeting tax professionals, cyber crooks during this period are disturbingly active. Today, we dive into the scope of these threats, examine their real-world implications, and provide practical steps to help mitigate them.

The landscape of tax season cyber threats

Tax season generally stretches from January to mid-April, when an estimated 165 million Americans and numerous businesses hustle to prepare and file tax returns. About 80 million of those returns are prepared by Certified Public Accountants (CPAs), according to recent industry data. Unfortunately, cybercriminals treat this turn to digital transactions as an annual opportunity and launch tailored attacks that aim to exploit both individuals as well as companies.

Phishing campaigns 

One of the most common attack vectors is phishing—where criminals send bogus emails designed to trick recipients into unsuspectingly providing sensitive personal data. These emails may appear to be from the IRS or reputable tax prep services, complete with official logos or references to “overdue payments.” A 2024 Hornetsecurity report pegged phishing at 39.6% of all email-based attacks, a trend amplified during tax season.

Malware and ransomware 

Tax forms often contain everything a hacker needs for identity theft: Social Security numbers, addresses, and banking details. And once cybercriminals gain access to your system—often via hidden malware in an attachment labeled “tax form” or “software update”—they can install spyware, key loggers, or even launch a full ransomware attack. Faced with a major filing deadline, victims might be more inclined to pay a ransom rather than miss the cut-off for submission.

“Ghost” preparers and fake platforms

Cybercriminals have also found success posing as tax professionals. In such a scenario, an unsuspecting taxpayer hands over a trove of personal information—bank account details, W-2 forms, Social Security numbers—only to see fraudulent returns filed in their name. The IRS warns that these “ghost” preparers usually vanish after submitting false forms and pocketing refunds—with identity theft-related tax fraud costing American taxpayers $5.5 billion in 2023.

Business-focused threats 

For small and midsize businesses, there’s another layer of complexity. Employee data—including Social Security numbers, addresses, and payroll information—often reside on shared drives or distributed networks. A single compromised password can open the door to large-scale identity theft or financial fraud. Given that many businesses rely on internal accounting departments or external consultants, the rate of data exchange grows. Each endpoint—whether an employee’s laptop or a tax preparer’s login credentials—can become a gateway to a breach if not safeguarded properly.

Why credential security matters

Data breaches don’t usually happen because a hacker brute-forces encryption algorithms. More often, criminals follow the path of least resistance, which tends to be simple or stolen passwords. Verizon’s 2024 Data Breach Investigations Report found compromised credentials behind 74% of financial sector attacks. And so tax season, with its sudden surge in data transmissions, provides an even bigger opportunity.

Credential stuffing attacks

Cybercriminals purchase stolen username-password pairs on the dark web and systematically test them on popular platforms. If you’re in the habit of reusing passwords, a single breach on one platform can open up multiple high-value accounts to intrusion—including those used for taxes.

Email account takeover

If hackers gain access to an email account, they can reset passwords on numerous services, intercept 2FA codes (if poorly implemented), or conduct spear-phishing attacks against your contacts. During tax season, access to a CFO’s or finance manager’s inbox is a potential gold mine.

Shared passwords for personal and work accounts

A surprisingly large number of incidents stem from people using the same or slightly modified passwords across multiple sites. If an attacker compromises your personal social media password, they can try variations of that password on your business or tax accounts.

With so many potential vulnerabilities arising from insecure credentials, having a robust and systematic approach to password management is critical. Employing a tool like NordPass helps create, store, and even share unique, complex passwords across a network of trusted employees or family members without the friction that leads to risk-laden “shortcut” practices.

Real-world repercussions of tax season breaches

Cyber threats may sound abstract until you experience them firsthand, unfortunately. So let’s consider a few scenarios that can easily play out during tax season.

Hijacked refunds

Criminals who gain access to your tax software account can alter returns, inflate refunds, and have the money deposited into their own accounts. Not only are you left without the anticipated refund, but you could be flagged for fraudulent activity by the IRS. Correcting these records requires time-consuming phone calls, paperwork, and sometimes legal counsel.

Identity theft and financial fraud

Tax documents typically hold Social Security numbers, addresses, and full legal names—crucial data for identity thieves. Armed with this information, cyber crooks can open credit lines, apply for loans, and even file additional fraudulent tax returns under your identity. The IRS estimates that scammers committed $5.5 billion in tax fraud in the last year alone, much of it fueled by stolen credentials.

Operational disruption and ransomware

If a ransomware attack locks down your systems during peak filing season, you may be faced with the unenviable choice of paying the ransom or missing the filing deadline. When your business’s entire payroll system is frozen, you stand to lose not only money but also the trust of your employees, clients, and partners.

Legal and regulatory trouble

Businesses are required by law to protect employee data. Should a breach involving W-2 forms occur, state and federal regulators might levy hefty fines, and employees could file lawsuits. For small businesses, these legal battles can negatively impact public reputation or even outright ruin the business financially. 

Tips for protecting credentials and mitigating risk

Given the scale of digital threats, securing your online identity during the tax filing process necessitates proactive strategies. Below are tangible measures for individuals and organizations.

Use strong, unique passwords

Avoid dictionary words, common phrases, or personal references. Never reuse passwords across services, especially for tax prep, payroll systems, and personal email accounts.

Consider adopting a trusted password manager such as NordPass, which can generate intricate passwords and store them securely.

Enable multi-factor authentication (MFA)

Whenever available, activate MFA on all platforms connected to your finances or email. This extra verification layer can help thwart criminals who may have stolen or guessed your password.

Stay wary of suspicious links and attachments

Phishing remains the easiest door into your personal or corporate systems. Even a single click on a malicious link or attachment can deliver spyware or ransomware. So make sure to always check the email sender’s address carefully, and manually visit official IRS or tax software sites by typing in the address rather than clicking a link.

Conduct routine account monitoring

Regularly review bank statements, credit reports, and your IRS tax account. If you see unfamiliar activity, act immediately. If you’re a business, schedule monthly or quarterly audits of software access logs to identify potential anomalies.

Update software and systems

Ensuring your operating system, antivirus, and tax software are current can close known vulnerabilities that criminals might aim to exploit. Encourage employees to run updates as soon as they’re available, rather than postponing them.

Limit access privileges

In a business environment, not every staff member needs access to all financial or payroll details. Adopt the principle of least privilege to shrink your attack surface. 

For additional protection, consider segmenting your network so that critical tax data is walled off from the rest of the organization’s operations.

Verify tax preparers’ credentials

Legitimate preparers must have a Preparer Tax Identification Number (PTIN). A lot of Americans entrust CPAs and other pros to handle their tax returns, so it’s vital to confirm the authenticity of anyone who deals with your finances. “Ghost preparers” who refuse to sign returns or demand unusual payment methods are immediate red flags.

Maintain an incident response plan

Outline the steps you’ll take if a breach does occur: who will you call first? How will you isolate infected systems? For businesses, having a tested response plan can drastically minimize downtime and financial loss in a worst-case scenario.

Security-first culture

Technical defenses cannot fully compensate for employees or household members who lack security awareness. Training and vigilance must become habits. When staffers comprehend the risks of phishing emails—or why weak passwords are a liability—they usually become active participants security-wise.

Tax season, with its tightly packed deadlines and sudden influx of external correspondences, is especially prone to mistakes. Criminals place their bets on hectic schedules and the assumption that nobody reads the fine print in a rush. By fostering an environment where it’s standard practice to confirm suspicious queries or check unplanned attachments, you reduce the chance of inadvertent leaks.

Of course, tools like NordPass help avoid the pitfalls of shared spreadsheets or stray Post-it notes with login data by providing secure credential storage and encrypted sharing, drastically reducing the friction that leads people to reuse or create weak passwords. 

Beyond tax season: building a resilient foundation

Keeping digital attackers at bay during tax season shouldn’t be a last-minute scramble. It must be part of a larger, year-round approach to cybersecurity. Tax season simply throws these issues into the spotlight because the stakes—and the volume of targeted scams—are higher.

View security as ongoing

While certain threats may peak from January to April, scammers work continuously. Make sure your security protocols— from patch management to employee training—are consistent and not just “tax-time activities.”

Leverage intelligence and reports

The IRS publishes alerts on emerging scams. Likewise, major cybersecurity outlets offer real-time threat briefings. By staying updated on known risks, you can proactively adjust or harden policies.

Invest in infrastructure

For businesses, upgrading legacy systems and implementing advanced threat detection can prevent criminals from exploiting outdated software. For individuals, maintaining secure Wi-Fi networks and establishing personal firewalls can be an impactful step.

Strengthen vendor and partner relationships

If your business deals with external tax preparers or payroll service providers, insist on strong security practices and confirm that they uphold data-protection protocols. Transparent discussions about cybersecurity responsibilities can avert confusion or blame in the event of a breach.

Encourage swift reporting

If something does go wrong—like an employee clicking a suspicious link—delays in reporting can allow malware to spread or cyber crooks to siphon off data unnoticed. Cultivate a culture where immediate reporting, rather than fear of reprimand, is the norm.

Wrapping up

Amid the hustle of calculating deductions, aligning your statements, and meeting deadlines, it’s all too easy to underestimate the value of robust credential security. Yet, in the end, the difference between a secure, worry-free filing and a catastrophic breach often hinges on consistent, disciplined adherence to fundamental security principles. As you gather receipts, consult accountants, or log in to tax software, remember that each login credential is a potential gateway. By making calculated, informed decisions, you maintain control over your security.

Signs that your email could have been hacked

It’s not always immediately obvious that your email has been hacked, but there are signs you can look for that should alert you if something is wrong. Here’s what to watch out for:

Unexpected password change notifications

If you receive a notification or email saying that your password has been changed, and it wasn’t your doing, it’s highly likely that someone has taken over your email account. After all, who else could have done it? If you haven’t shared access to your email with anyone before, this situation should raise a major red flag. Additionally, if you receive messages indicating that someone is trying to change your password, stay alert as clearly someone is targeting your account and attempting to break in.

Login alerts from unknown locations or devices

Another disturbing message you might receive is about a successful login to your email account from an unfamiliar location or device. If you haven’t recently changed your computer or mobile phone, or you’re not on holiday somewhere far from home, this could mean that someone has bypassed your email security and gained access to your account. Treat every such notification very seriously.

Emails you didn’t send appearing in your “Sent” folder

The “Sent” folder in your email account should only contain messages you remember sending to your contacts. If you notice emails you don’t recognize, it could indicate that someone has hacked your account and is using it to send malicious messages that appear to come from you.

Strange or missing emails in your inbox

Having weird, unknown emails in your “Inbox” folder is also a sign of a potential email break-in. The same applies if you cannot find a specific email that you are certain was there before. So, if your inbox contains unfamiliar messages or is missing something, stay vigilant—it may indicate that your email account has been hacked.

Complaints from contacts about receiving spam from you

Have any of your friends told you they got a strange email from you saying you’re in trouble and need money? Or maybe one of your contacts got a message asking for your or their personal information? If you haven’t sent any messages like that, but people are getting them from your email, it could mean someone’s hacked your account and is using it to try and scam the people you know.

Being locked out of your email account

If you can’t log in to your email on any device you usually use, it might mean someone’s hacked your account and changed the password to lock you out. Unless you’ve forgotten your password or made a typo, take this seriously and assume your email’s been hacked.

How to check if your email has been hacked

To verify if your email account has been compromised, you’ll want to keep an eye out for the signs we’ve mentioned earlier and also do a little digging on your own.

First off, review your login activity. Most email providers, like Google, Yahoo, and Microsoft Outlook, allow you to check your account’s login history, including the IP address, device, location, date, and time of your recent logins. If anything looks unfamiliar, that’s a red flag.

Next, check for any strange, unexpected activity in your email inbox and the “Sent” folder. Go over the messages from the past few days/weeks and see if there are any phishing emails sent from your account or password reset emails you didn’t request. If something feels off, make sure to secure any accounts that might be affected.

Also, it’s a good idea to see if anyone outside your trusted circle has been granted permissions linked to your email, or if your account has been used to sign in to any services you don’t recognize.

Lastly, you can use online tools, like the Data Breach Scanner from NordPass, to check if your account has been exposed. Simply enter your email address, and the tool will scan the dark web for any mentions to determine if it is at risk.

What to do if you suspect your email has been hacked

If you suspect your email has been hacked, you might be wondering, “What do I do now?” Fortunately, you’re not left helpless—you can take steps to regain access to your account. Here are some things you should do:

• Change your email password right away to prevent unauthorized access. TIP: Use NordPass’ online Password Generator to create a new, strong password in no time.

• Enable two-factor authentication (2FA), so that logging in to your email requires more than just a password.

• Use the “Log out of all devices and sessions” option to ensure anyone who’s gained access is immediately logged out.

• If you can’t access your account, report the issue to your email provider right away. They’ll help you restore access and block any outsiders from using your account.

If you need more information, we have another article titled “What to do if a scammer has your email address,” which provides detailed instructions on how to proceed when an unauthorized party has taken control of your email account.

How to prevent your email from being hacked

There’s no single technique you can use to protect your email from being hijacked, but combining a few methods can significantly boost your email security. First, how safe your email is depends largely on your online activities and how you share sensitive information. If you’re careful about where and with whom you share your email address, you’re off to a good start.

For an extra layer of protection, a password manager like NordPass can be a game-changer. Not only can it keep all your passwords—including your email password—safe in an encrypted vault, but it can also generate strong passwords on the spot. If your email password is weak or outdated, NordPass will notify you. Plus, with the Data Breach Scanner feature, you’ll get an alert if your email is compromised in a data breach. NordPass also includes Email Masking, which lets you use a fake email address when signing up for services or newsletters, protecting your real email from exposure.

So, if you want to enhance your email security and feel more confident online, NordPass is the way to go. Try the free 14-day trial and see how it can improve your online experience.

What is two-factor authentication (2FA)?

Two-factor authentication (2FA) is a security procedure that adds an extra layer of security to your logins. Rather than relying on a single piece of authentication data—such as a password —2FA requires two separate factors to confirm that you are who you claim to be. It’s a process that can significantly reduce the risk of unauthorized access, even if bad actors are able to get their hands on your username and password. The factors fall into 3 broad categories:

1. Knowledge: Something only you know, such as a password, PIN, or an answer to a secret question.

2. Possession: Something only you have, like your smartphone, a secure USB drive, etc.

3. Inherence (biometric): Something you are—typically a fingerprint, facial recognition, or an iris scan.

Here’s how 2FA works in practice: say you’re trying to access an online dashboard that contains sensitive data. First, you enter your username and password (in 2FA, referred to as the knowledge factor). Then, you receive a push notification on your smart device (in 2FA, referred to as the possession factor), which you must tap to confirm your identity. Without both factors, access is denied.

Note that 2FA is a subset of a broader category known as multi-factor authentication (MFA). If you want to have a better understanding of MFA in general, check out our dedicated post on What is multi-factor authentication.

Advantages of 2FA

Improved security

By requiring two different factor types, 2FA drastically reduces the odds of a successful breach. Even if a hacker manages to guess or steal your password, they would still need your physical device or biometric data.

Coming closer to compliance

In many industries, such as finance, healthcare, or e-commerce, data protection standards and regulations either recommend or mandate 2FA.

Limitations of 2FA

Device reliance

In most instances, the second factor is tied to a mobile device. If a user loses or can’t access their phone or tablet, they might have to face major delays and stay locked out.

Potential cost or complexity

Rolling out 2FA for large companies might require purchasing physical keys or training employees to use authenticators, which could temporarily add complexity to their daily process.

Examples of 2FA

Password and a hardware security key

You type in your password, then insert a dedicated device like a YubiKey to finalize the login. Because the key is a physical object, attackers can’t replicate or hack it remotely.

Fingerprint and a passcode

The authentication process can be set up in such a way that when you unlock a smartphone app, you can scan your fingerprint (biometric factor) and also enter a short passcode (knowledge factor).

Facial recognition and a device push

Some 2FA systems are set up to scan your face and then send a push notification to your phone for final approval. This approach covers inherence (your face) and possession (your phone).

Password and an authenticator app

After entering a password (knowledge factor), you open an authenticator app (like Google Authenticator or an enterprise app). The code changes every 30 seconds, making it hard for potential attackers to guess.

In some instances, businesses might be inclined to explore even more advanced options, such as passwordless authentication. If you’re interested in moving beyond password-based authentication altogether, check out our piece on What is passwordless authentication.

What is two-step verification (2SV)?

Two-step verification (2SV)—much like 2FA—also requires two consecutive steps to verify your identity, yet it doesn’t necessarily demand two different factor “categories.” With 2SV, you might be asked to enter your password first, and then answer a personal question—in this instance, both factors would fall under the knowledge category. In other cases, you might be asked to enter your username and password, and then asked to enter a code that is sent to your email. While it’s an additional layer beyond a single password, the factors remain purely knowledge-based.

Advantages of 2SV

Ease of implementation

Because 2SV often uses common tools like SMS or email verification, it’s relatively straightforward for businesses to roll it out. Users are also accustomed to receiving codes via these channels.

Better than a single password

Even if you reuse your password across multiple sites (which is a risky habit), you’ll still need a second step to access your account. This layered approach is more secure than password-only logins.

Limitations of 2SV

Same-factor vulnerability

If both steps rely on knowledge factors (like a password plus a security question), hackers who know enough personal details could potentially break through both. The same can apply to SMS-based verification, which can be susceptible to SIM-swapping attacks.

Reliance on external channels

If the code is sent via email, and your email is compromised, that second step isn’t much of a barrier. Similarly, SMS codes can sometimes be intercepted or delayed.

Examples of 2SV

Username and password, followed by an email link

After entering your primary credentials, the system emails you a one-time link to confirm it’s really you. If your email account is well-protected, this is an extra hurdle for attackers.

Password and a security question

You log in with your usual password, then answer something like, “What was the name of your first pet?” Keep in mind these security questions can be a weak link if the answers are easy to guess or found via social media.

Password and an SMS code

You enter your password, then receive a numerical code on your phone. Once entered, the system grants access. While helpful, text-based codes are vulnerable to phone porting or SIM-swap attacks.

What is the difference between 2FA and 2SV?

At first glance, 2FA and 2SV can look and feel very similar. In fact, many people use the terms interchangeably. However, there’s a subtle but critical difference between the two:

• 2FA mandates two distinct factor categories (e.g., something you know and something you have). For instance, a password (knowledge) and a security key (possession).

• 2SV only requires two steps, and they could both be from the same category, such as a password followed by a security question or code.

From a practical standpoint, 2FA is usually deemed to be more secure than 2SV because it’s tougher to compromise two different types of factors. For example, bad actors can’t steal your fingerprint as easily as they can crack a simple password. However, 2SV is still significantly more secure than just relying on a single factor.

It’s also worth noting that the concept of 2SV vs. 2FA often comes up when discussing advanced authentication flows for businesses. Large organizations might experiment with mixing and matching steps—for instance, a password, plus a biometric scan, plus a push notification, which is effectively a form of multi-factor authentication (MFA). If you’re ready to explore the entire landscape, you might also want to see how passkeys fit into this conversation by checking out our article What is a passkey.

Why is it essential to use more than one security method to protect your account?

Cyber threats have evolved to the point where a single password—even a strong, complex one—can be bypassed through phishing scams, data breaches, or sophisticated hacking tools. And that’s exactly why adding additional security layers has become an indispensable practice for businesses that take security seriously. Even if one layer is breached or bypassed, others remain intact, ensuring robust protection.

Human error compounds these issues, as people tend to reuse passwords, are quick to click on dubious links, and are quite often easily duped by clever social engineering techniques. Having multiple authentication checkpoints means that a single oversight won’t necessarily compromise the entire system. Along with mitigating these risks, layered security builds consumer trust, showcasing your commitment to safeguarding personal information—a key differentiator in an era where privacy is a paramount concern.

Finally, many industry regulations and legal frameworks also require or strongly recommend the use of extra security measures. For remote teams spread across various locations and devices, these additional layers act as a safety net, catching suspicious login attempts before they can turn into full-blown breaches.

How to password-protect a Word document on Windows

Since Word is part of the Microsoft Office suite and works seamlessly with Windows, adding password protection to a Word document is just as simple as password-protecting an Excel sheet, a PDF or ZIP file, or even an entire folder. Here’s how you can do it:

1. Open the Word document you want to password-protect.

2. Click on “File” in the top-left corner.

3. Select “Info,” then click on “Protect Document.”

4. A drop-down will appear—choose “Encrypt with Password.”

5. A new window will pop up. Type in your password, click “OK,” then re-enter the password to confirm.

How to password-protect a Word document on Mac

To password-protect a Word document on a Mac, you need the Microsoft Office suite installed on your Mac device. Once you have it, you can add password protection to your Word document by following these steps:

1. Open the Word document you want to protect with a password.

2. Click “Tools” in the menu bar and select “Passwords.”

3. A “Password Protect” window will pop up. In the “Security” section, under “Set a password to open this document,” just type in the password you want to use for your document.

4. When prompted, re-enter the password to confirm it, then click OK.

How to remove/change a password in a Word document

If you need to remove or change the password on a Word document, there’s a super easy way to do it. Just open the document and enter the password to unlock it. Then, go through the same steps you’d take to add a password to the document, the only difference being that, when it asks for the current password, you simply delete all characters and click “OK.”

Changing the password follows the same process. You’ll still go through the steps for adding a password, but when prompted, just enter a new one and confirm it. Then, click “OK” to save the change.

Alternatives to password-protecting a Word document

Adding password protection is a solid first step in securing your Word document, but it might not be enough. When you set a password, the document is protected with 128-bit AES encryption, which is pretty reliable. But there are stronger options available, like 256-bit AES or xChaCha20 encryption, which can help keep even the most determined hackers out.

And don’t forget—how you store and share your Word documents matters too. So, if you want to take things a step further, consider storing your files in an encrypted space that only you can access. Tools like NordPass and NordLocker can help with that, allowing you to securely store your documents in an encrypted vault and share them safely with people you trust.

What if I forget my password to a Word document?

We’ve got some bad news—if you ever forget or lose the password to one of your Word documents, unfortunately, you won’t be able to recover it. Password protection in Microsoft Word is designed to prevent any overrides, making sure your documents stay safe and sound. That means your only option is to type in the correct password.

But there’s a way to avoid this problem altogether—using a tool like NordPass.

NordPass securely stores all your passwords, passkeys, credit card details, and other sensitive info in a cloud vault protected by XChaCha20 encryption. It also syncs across all your devices, so you can access your passwords whenever you need them. And if you find coming up with strong passwords a challenge, NordPass can generate them for you on the spot and save them automatically in your vault. Plus, it can help you identify any weak, reused, or compromised passwords to keep your online accounts and data safe.

Sounds good? Then make sure to give NordPass a try!