Julia Chirkova
The familiar scene unfolds every February: tax professionals, inundated with client work, are confronted with yet another multi-factor authentication (MFA) prompt. The temptation to disable this security layer, even temporarily, to expedite workflows is palpable. However, cybersecurity experts and regulatory bodies are issuing stark warnings: this seemingly innocuous shortcut poses significant risks to client data, firm reputation, and regulatory standing. Disabling MFA is not merely an inconvenience; it’s a direct invitation to cybercriminals and a violation of federal mandates.
The Allure and Danger of Busy Season Expediency
The pressure cooker environment of tax season often drives firms to seek any advantage in efficiency. For a small, six-person firm, the suggestion to disable MFA in tax software to save precious minutes can sound like a pragmatic solution. Imagine a scenario where a preparer, facing a tight deadline, requests the temporary deactivation of MFA. A few weeks later, a password previously compromised on a less secure platform – perhaps a retail website where the preparer reused credentials – surfaces in a stolen credential database. Cyberattackers, armed with this information, could exploit the disabled MFA to gain unauthorized access to the firm’s systems on a Sunday, extract client tax returns, and initiate fraudulent filings, rerouting refunds to their own accounts.
The aftermath of such a breach is devastating. The firm is immediately thrust into a crisis management scenario, facing the daunting tasks of notifying affected clients, reporting the incident to regulatory bodies like the IRS, and grappling with the uncomfortable truth that a fundamental security control was intentionally bypassed. This not only erodes client trust but also incurs significant financial and reputational damage, far outweighing any time saved during the busy season.
MFA: A Non-Negotiable Regulatory Mandate
The Federal Trade Commission (FTC) Safeguards Rule unequivocally classifies tax and accounting firms, irrespective of their size, as financial institutions. This classification brings them under specific data protection obligations. Section 314.4(c)(5) of the rule explicitly mandates the implementation of multi-factor authentication for any individual accessing an information system. The only permissible exception requires a written approval from the firm’s designated Qualified Individual, attesting to an equivalent, robust security control. The IRS, in conjunction with its Security Summit partners, has consistently reinforced this directive, unequivocally stating that MFA is a federal requirement for all tax professionals.
This requirement is not limited to remote access scenarios. It applies equally to staff working within the physical confines of the office. Furthermore, the Safeguards Rule imposes stringent notification obligations: should a security incident result in the exposure of unencrypted information belonging to 500 or more individuals, the firm is legally obligated to notify the FTC within 30 days of discovery. Failure to comply with these regulations can result in substantial penalties and legal repercussions.
Beyond Basic MFA: Understanding Evolving Threats
While activating MFA is a crucial first step, it’s essential to recognize that not all MFA solutions offer the same level of protection. Cybercriminals are continually adapting their tactics to circumvent even standard MFA implementations. Historically, common MFA methods included:
- SMS-based codes: These are vulnerable to SIM-swapping attacks, where an attacker convinces a mobile carrier to transfer a victim’s phone number to a new SIM card, thereby intercepting one-time passcodes.
- Email-based codes: Similar to SMS codes, these can be intercepted if an attacker gains access to the user’s email account, which itself might be protected by weaker security measures.
- Basic push notifications: While more convenient, these can be susceptible to "MFA fatigue" or "prompt bombing" attacks. Attackers flood a user’s device with authentication requests, hoping the user will eventually approve one out of sheer annoyance, granting access without verification.
The Cybersecurity and Infrastructure Security Agency (CISA) champions phishing-resistant MFA methods as the gold standard. These include:
- FIDO2 Security Keys: These are physical hardware tokens that authenticate users through cryptographic challenges, making them highly resistant to phishing.
- Passkeys: These leverage public-key cryptography to authenticate users, offering a more secure and often more convenient alternative to traditional passwords and MFA codes.
For firms currently relying on push notifications, CISA recommends implementing number matching as an interim, yet highly effective, enhancement. This feature requires users to verify a specific number displayed on the login screen within their authenticator app before granting access. This simple step effectively neutralizes blind approval attacks.
Layering Security: The Power of Conditional Access
Conditional access policies represent a sophisticated layer of security that moves beyond a one-size-fits-all approach. Instead of treating every login attempt identically, conditional access allows firms to establish granular rules based on various factors. These rules dictate who can sign in, from what geographical locations, using which devices, and under what circumstances stronger authentication methods are required.
A well-configured conditional access system can significantly reduce the frequency of MFA prompts for trusted users on company-managed devices, directly addressing the user frustration that often leads to requests for MFA deactivation. By dynamically assessing risk, conditional access ensures that security is robust without being overly burdensome for legitimate users.
Practical Strategies for Fortifying Firm Security
Proactive security measures are paramount for tax and accounting firms. Here are actionable steps that firm owners and IT professionals can implement:
- Conduct a Comprehensive Security Audit: Regularly assess your firm’s current security posture. Identify vulnerabilities, review access controls, and evaluate the effectiveness of existing security tools. This audit should include a thorough examination of all software used, especially tax preparation software and client portals.
- Prioritize Phishing-Resistant MFA: For critical systems and accounts, migrate to phishing-resistant MFA solutions like FIDO2 security keys or passkeys. Invest in training for staff on how to use these new methods effectively and securely.
- Implement Number Matching for Push Notifications: If your firm currently uses push notification-based MFA, immediately enable the number matching feature. This is a critical defense against MFA fatigue attacks.
- Deploy Conditional Access Policies: Configure conditional access to enforce context-aware security. This includes restricting access based on location, device compliance, and user risk level. Aim to minimize friction for trusted access while increasing security scrutiny for potentially risky sign-ins.
- Develop and Maintain a Written Information Security Program (WISP): This document should clearly outline your firm’s security policies, procedures, and controls, including detailed requirements for MFA implementation and maintenance. The WISP serves as a roadmap for your security efforts and a crucial document for demonstrating compliance.
- Regularly Train Employees on Cybersecurity Best Practices: Conduct ongoing training on recognizing phishing attempts, safe password management, and the importance of MFA. Human error remains a significant factor in data breaches, making continuous education vital.
- Establish a Robust Incident Response Plan: Develop a clear plan outlining steps to take in the event of a security breach. This plan should include procedures for containment, eradication, recovery, and post-incident analysis, as well as clear communication protocols for notifying clients and regulatory bodies.
- Secure Client Portals and Data Transmission: Ensure that any portal used for client document exchange is secured with strong authentication and encryption. Regularly review the security features of third-party vendor solutions that handle client data.
Addressing Client Concerns with Confidence
Clients are increasingly aware of data security risks and are actively inquiring about the measures firms take to protect their sensitive information. Being prepared with clear, concise answers builds trust and demonstrates a commitment to safeguarding their data.
Client Question: "Is my tax information safe if someone at your firm gets phished?"
Firm Response: "Our security protocols are designed to prevent a single compromised password from jeopardizing your data. Every account that accesses client information requires a secondary verification step, and our most sensitive systems utilize advanced phishing-resistant authentication methods. Therefore, a stolen password alone would not grant unauthorized access."
Client Question: "Why do I need a code to upload documents to your portal?"
Firm Response: "Federal regulations, such as the FTC Safeguards Rule, mandate that we protect your financial information with robust security measures. The code serves as an additional layer of verification, ensuring that even if a password were somehow compromised, it would not be sufficient to access your sensitive files."
Client Question: "Do you have a written security plan?"
Firm Response: "Yes, we maintain a comprehensive Written Information Security Program (WISP). This document details our policies and procedures for protecting client data, including the mandatory use of multi-factor authentication across all critical systems."
Client Question: "What happens if your firm experiences a breach?"
Firm Response: "We have a well-defined incident response plan in place. This plan guides us through the necessary steps of investigating any potential breach, promptly notifying affected clients, and fulfilling all required reporting obligations to regulatory agencies like the IRS and the FTC."
The Unwavering Imperative of Multi-Factor Authentication
The allure of bypassing MFA prompts during the demanding tax season is understandable, but the consequences of succumbing to this temptation are dire. For tax and accounting firms, choosing to disable MFA is not a path to convenience; it is a direct route to regulatory non-compliance and an open invitation for cybercriminals to exploit vulnerabilities. By embracing advanced MFA solutions like number matching and phishing-resistant methods, and by implementing intelligent conditional access policies, firms can achieve significantly stronger data protection with minimal friction for their teams. This proactive approach not only fortifies their security posture but also reinforces client trust and ensures adherence to critical federal regulations.
About the Author:
Scott Carr, owner of Farmhouse Networking in Grants Pass, Oregon, is a veteran Network & Computer Systems Architect with over 30 years of IT experience. For over a decade, he’s led his team in delivering proactive, secure, and fully managed IT services to more than 80 businesses—including accounting and finance firms that rely on data security, compliance, and efficiency. Scott’s hands-on, jargon-free approach ensures every client understands their technology and gains confidence in their systems. His firm is known for fast, responsive support—most issues are resolved within 15 minutes—and deep expertise in cybersecurity, network design, and IT compliance. Learn more about how Farmhouse Networking supports the accounting industry at https://www.farmhousenetworking.com/finance-it-support/.
