As the 2025 tax filing deadline approaches, with business returns due in March or April and individual returns due April 15, it’s important to remain vigilant in the face of a surge in tax-related cybersecurity threats.
Cybercriminals often seek to target individuals and companies around this time of year, deploying scams that try to steal sensitive financial information and personal data. Understanding what these threats look like in 2025 and implementing robust security measures that prevent them are essential to protect your data during this critical period.
Recent Initiatives to Enhance Security
In response to escalating cyber threats, the Internal Revenue Service (IRS) has introduced several measures to bolster taxpayer security:
- Dirty Dozen tax scams for 2025: The IRS annually publishes a list of the “Dirty Dozen” tax scams to alert taxpayers and businesses about prevalent schemes. While this list is not a legal document or a formal listing of agency enforcement priorities, the education provided by it is designed to raise awareness and protect taxpayers and tax preparers alike from common tax scams and schemes.This year’s list includes fake charity donation requests, false fuel tax credit and self-employment tax claims, overstated withholding scams, new client schemes, and other illicit communications. Staying informed about these scams can help businesses recognize and avoid potential threats.
- Updated Written Information Security Plan (WISP): To assist tax professionals in safeguarding client data, the IRS released an updated WISP template. This 28-page document provides guidelines for crafting a comprehensive security plan tailored to tax and accounting practices. It emphasizes the importance of protecting sensitive taxpayer information from identity thieves and counteracting scam attempts that target tax preparers.
Prevalent Tax Season Scams in 2025
Beyond the IRS’s Dirty Dozen list, common themes are arising in 2025 as cybercriminals adapt their tactics. These include many of the following current scams:
- IRS impersonation schemes: Scammers may attempt to pose as IRS officials, contacting businesses to demand immediate payment or personal information under the threat of legal action. The IRS emphasizes that it does not initiate contact via email, text, or social media, and any such digital communication should be treated with suspicion. Use caution with phone communications as well. Scammers use spoofing and robocalls to make it seem like the IRS is calling. If someone calls pretending to be from the service, request a reference number, then hang up and use one of the official IRS numbers to call back and confirm the inquiry is legitimate.
- Phishing emails and fake websites: Fraudsters send emails that appear to be sent by the IRS or popular tax software providers. These messages direct recipients to counterfeit websites designed to steal login credentials and other sensitive data. Businesses should verify the authenticity of any communication before responding or clicking on links. Always type URLs into a web browser manually so that you can verify the site they lead to you is housed on the official IRS.gov domain.
- “Ghost” tax preparers: The vast majority of tax professionals are qualified, licensed, and insured. But many unqualified individuals will advertise tax preparation services around this time of year, appearing in online searches and hooking customers before charging fees without signing the returns they prepare. This common scam tactic leaves businesses vulnerable to inaccuracies and potential fraud.
Other Steps to Protect Your Business
To safeguard your business during tax season, consider the following recommendations. Remember,
- File taxes promptly: Early filing can reduce the window of opportunity for criminals to submit fraudulent returns using your business information. By submitting your tax returns ahead of the deadline, you minimize the risk of identity theft and also stabilize your company’s cash flow, providing a clearer financial picture for strategic planning. “In this day and age, when so many identifies are being stolen online, as individuals the best thing we can do is file our taxes as soon as possible so we don’t give criminals the chance to file fraudulent taxes under false information,” says Emory Simmons, a security expert and owner of the tech firm CMIT Solutions of Metrolina.
- Enroll in the IRS IP PIN program: An Identity Protection Personal Identification Number (IP PIN) adds an extra layer of security to all tax returns, preventing unauthorized filings under your business’s identity. This six-digit code, known only to you and the IRS, ensures that only authorized individuals can file returns on behalf of your business. That can help to safeguard your sensitive financial data and maintain your competitive advantage.
- Educate employees about phishing: Consider working with a trusted IT provider like CMIT Solutions to hold regular training sessions that help employees recognize and report phishing attempts. Awareness and prompt reporting of suspicious communications can prevent data breaches, protecting your business’s confidential information and preserving its reputation in the marketplace. That applies during tax season and all year ‘round.
- Secure digital communications: Your business should only be using encrypted email services and secure file-sharing portals when transmitting tax documents. Sharing sensitive information through these kinds of secure channels prevents unauthorized access, thereby maintaining the integrity of your business data and fostering trust with clients and partners.
- Maintain updated data backups: Regularly back up all tax-related data and store it securely, on-site in your office and remotely in the cloud. Creating current backups helps in the event of a cyber incident—if a breach or attack occurs, your business can quickly recover critical information, minimizing operational disruptions and potential financial losses.
- Verify tax professional credentials: The IRS advises that all consumers verify the credentials of any tax professional and ensure they have a valid Preparer Tax Identification Number (PTIN). Collaborating with certified professionals ensures compliance with tax regulations and also protects your business from fraudulent activities, enhancing financial security and operational efficiency.
- Monitor financial accounts: When you’re waiting for a tax return or monitoring the status of a tax payment, pay close attention to bank statements and credit accounts for unauthorized transactions. Proactive monitoring allows for the early detection of suspicious activities, enabling swift action to prevent potential financial losses and safeguarding your business’s assets.
- Implement multi-factor authentication (MFA): MFA should be in place for all accounts—especially those used to access sensitive financial and tax-related information. This additional security layer makes it more difficult for unauthorized users to gain access to your systems, requiring a unique code alongside a regular password. If you’re not sure about the ins and outs of MFA, a trusted IT provider like CMIT Solutions can provide reliable guidance to keep you safe.
Tax season is always stressful. But if you stay informed about current scams, implement proactive cybersecurity measures, and follow IRS guidelines, your business can navigate the 2025 tax season safely, protecting your financial assets and sensitive taxpayer information.
Looking for trusted advice and tax-season support? CMIT Solutions can help. Contact us today to make sure your tax returns are filed securely and on time.