Practice guide / Accountancy
Cybersecurity for Bookkeepers & Accountants
Protect the records, payments and client relationships at the heart of your practice.
The context
Bookkeepers and accountants handle some of the most sensitive information in business—tax records, bank details, payroll data, and financial statements. This makes you a prime target for cybercriminals. The threat landscape has evolved dramatically, with AI-powered attacks, sophisticated invoice fraud, and targeted ransomware campaigns now commonplace.
The consequences of a breach extend far beyond immediate financial loss. In 2025, client trust is your most valuable asset—and a single cyber incident can destroy it permanently. This guide provides practical, actionable guidance to protect your practice and your clients.
Critical Statistic: According to ICAEW data, approximately 100 UK accountants report data breaches to the ICO every quarter—and this only captures incidents involving personal data risk. The actual number of attacks is significantly higher. Finance and accounting firms face a 30% higher risk of cyber attack compared to other sectors.
Cybersecurity Considerations For Accountants & Bookkeepers
Source: The Association of Accounting Technicians
The 4-Pronged Protection Plan
A structured approach to cybersecurity delivers the best results. The four-pronged protection plan provides a practical framework:
1 EDUCATE
Security awareness is your first and most effective line of defence. Build a culture where security is everyone’s responsibility.
Staff training
Regular training on phishing recognition, BEC tactics, and social engineering. Include real-world examples from the accounting sector.
Phishing simulations
Regular simulated phishing tests to reinforce training and identify staff who need additional support.
Client education
Inform clients about verification procedures you’ll use—and what to be suspicious of. Warn them about invoice fraud targeting your firm’s identity.
Deepfake awareness
NEW for 2025: Train staff that video and voice calls can now be faked. Establish out-of-band verification for all payment requests.
Reporting culture
Create an environment where staff feel comfortable reporting suspicious activity or near-misses without blame.
2 ASSESS
You cannot protect what you don’t understand. Regular assessment identifies vulnerabilities before attackers exploit them.
Security posture review
Evaluate current technical and administrative controls against threats facing your practice.
Vulnerability scanning
Regular automated scans of systems to identify unpatched software and misconfigurations.
Risk assessment
Identify your most valuable data assets and assess the threats and vulnerabilities associated with each.
Third-party audit
Consider independent penetration testing or security assessment by specialists who can identify gaps you might miss.
Supply chain review
Assess security posture of key software vendors and third-party service providers.
3 OPTIMISE
Maximise the effectiveness of existing controls before investing in new solutions. Many security improvements are free or low-cost.
Enable built-in security
Many accounting platforms and email services have security features (MFA, suspicious login alerts) that aren’t enabled by default.
Review configurations
Audit firewall rules, cloud settings, and software configurations against security best practices.
Free resources
Leverage free tools from NCSC, ICAEW, and AAT before purchasing commercial solutions.
Process improvements
Often the most effective security improvements are procedural—like requiring phone verification for payment changes.
4 IMPLEMENT
Deploy the technical and administrative controls needed to protect your practice:
| Control | Implementation | Priority |
|---|---|---|
| Multi-factor authentication | Mandatory for all systems—email, cloud accounting, banking, file storage. Use authenticator apps or hardware keys, not just SMS. | CRITICAL |
| Email security | Implement DMARC, SPF, and DKIM to prevent email spoofing. Enable advanced threat protection if available. | CRITICAL |
| Data backup | 3-2-1 rule: 3 copies, 2 different media, 1 offsite/offline. Test restoration regularly. Use immutable backups where possible. | CRITICAL |
| Payment verification | Mandatory out-of-band verification (phone call to known number) for any payment over threshold or any bank detail changes. | CRITICAL |
| Access management | Principle of least privilege—staff only access what they need. Remove access immediately when staff leave. | HIGH |
| Password management | Deploy a password manager firm-wide. Consider passkeys for passwordless authentication where supported. | HIGH |
| Endpoint protection | Modern anti-malware on all devices with automatic updates. Enable built-in encryption (BitLocker, FileVault). | HIGH |
| Patch management | Apply security updates within 14 days of release (Cyber Essentials requirement). Enable automatic updates where practical. | HIGH |
| Incident response plan | Document and test your response to a cyber incident. Know who to contact, how to isolate systems, and regulatory notification requirements. | HIGH |
Why Bookkeepers & Accountants Are Prime Targets
The accounting profession sits at the intersection of multiple high-value data types, making it exceptionally attractive to cybercriminals:
What Makes You a Target
Factor / Why It Matters
Concentrated sensitive data
Names, addresses, National Insurance numbers, bank account details, tax records, and business financials—all stored in one place
Gateway to multiple clients
A single breach can expose dozens or hundreds of client businesses, multiplying the attacker’s return on investment
Payment authority
Bookkeepers often have direct access to client bank accounts or payment systems, enabling immediate financial theft
Seasonal pressure
Tax deadlines and year-end periods create time pressure that makes staff more susceptible to social engineering
SME security gaps
Small and medium practices often lack dedicated IT security resources, making them “softer targets” than larger organisations
Trust relationships
Criminals exploit the trusted relationships between accountants and clients to conduct convincing fraud
The Numbers: Cyber Attacks on Accounting Firms
| Metric | Data |
|---|---|
| Attack increase since COVID | 300% increase in cyberattacks on accounting firms (Accounting Today) |
| UK businesses affected annually | 612,000 UK businesses and 61,000 charities experienced cyber breaches in 2024 |
| Average breach cost | £3,550 for businesses; £8,690 for charities (most disruptive breach) |
| Annual cybercrime cost (AU data) | Small practices: ~$46,000 | Medium practices: ~$97,200 | Large practices: ~$71,600 |
| Ransomware as top concern | 45% of organisations cite ransomware as their primary cyber threat |
Sources: ICAEW, Australian Cyber Security Centre, WEF Global Cybersecurity Report 2024
The Evolving Threat Landscape: 2024-2025
The threats facing accountants and bookkeepers have evolved significantly. Understanding these attack methods is essential for effective defence.
Business Email Compromise (BEC) & Invoice Fraud
Business Email Compromise has become the most financially damaging cyber threat facing accountants. BEC attacks surged by 1,760% year-over-year following the widespread adoption of generative AI tools, growing from just 1% of attacks in 2022 to 18.6% of all attacks today.
BEC Tactic / How It Works
Invoice redirect
Criminals intercept email threads between you and suppliers, then send modified invoices with changed bank details
CEO/CFO fraud
Attackers impersonate senior executives requesting urgent wire transfers or sensitive data
Vendor compromise
Real supplier email accounts are hacked and used to send fraudulent payment requests (up 137% in 2023-24)
Payroll diversion
Criminals request changes to employee direct deposit details, redirecting salaries to their accounts
Real-World Impact: Invoice fraud now affects one in three companies. The FBI’s Internet Crime Complaint Center reports BEC scams have caused over $55 billion in global losses, with UK and Hong Kong frequently serving as intermediary destinations for fraudulent transfers.
AI-Powered Deepfake Fraud
The most alarming development in 2024-2025 is the weaponisation of AI to create convincing deepfake audio and video impersonations of executives and clients.
Case Study – Arup ($25 Million Loss): In February 2024, a finance worker at global engineering firm Arup joined what appeared to be a routine video call with the CFO and other executives. Every person on the call was a deepfake—AI-generated video and audio impersonations. The employee authorised 15 transfers totalling $25 million to fraudulent accounts before the scam was discovered.
| Deepfake Statistic | Data |
|---|---|
| Deepfake attack increase | 3,000% surge in deepfake attacks against businesses (2023) |
| Voice cloning fraud rise | 680% increase in the past year |
| Online deepfakes | Grew from ~500,000 in 2023 to ~8 million in 2025 |
| Q1 2025 losses | AI-generated CEO impersonations exceeded $200 million in losses |
| Executive awareness | 25.9% of executives report experiencing deepfake incidents in past 12 months (Deloitte 2024) |
Ransomware Targeting Accounting Firms
Ransomware attacks on accounting firms are strategically timed to coincide with tax deadlines and year-end periods when the pressure to restore access is highest.
| Ransomware Trend | Impact |
|---|---|
| Double extortion | Attackers encrypt data AND threaten to publish client information unless ransom is paid |
| Ransomware-as-a-Service | RaaS programmes enable less sophisticated criminals to launch attacks, increasing volume |
| Deadline targeting | Attacks timed around April tax deadlines and January Self Assessment submissions |
| Data leak exposure | 95% increase in data leak posts from ransomware operations (2020-2022) |
Real-World Example: In 2024, contractor-focused firms SJD Accountancy, Parasol, and Nixon Williams (all part of Optionis Group) suffered suspected ransomware attacks that prevented thousands of contractors from being paid. Over 400,000 files were reportedly leaked online.
Phishing: Still the #1 Entry Point
Despite its longevity, phishing remains the most common attack vector—and AI has made it far more dangerous.
AI-generated phishing
40% of BEC lures are now AI-generated, with perfect grammar and hyper-personalised content
Smishing (SMS phishing)
Text messages impersonating HMRC, banks, or clients with malicious links
Vishing (voice phishing)
Phone calls from “HMRC investigators” or “bank fraud teams” requesting immediate action
Spear phishing
Targeted attacks using information scraped from LinkedIn and company websites
Key Vulnerability Areas
Understanding where your practice is most vulnerable enables targeted protection:
| Vulnerability | Risk | Priority |
|---|---|---|
| Staff awareness gaps | Human error is the leading cause of reported data breaches. Staff unaware of current threats cannot defend against them. | CRITICAL |
| Cloud accounting security | Misconfigurations in cloud platforms like Xero, QuickBooks, or Sage create vulnerabilities. Direct attacks on cloud services are rising. | CRITICAL |
| Remote/hybrid working | Home networks, personal devices, and public Wi-Fi create attack vectors. 43% of employees use personal devices for work without IT approval. | HIGH |
| IT provider assumptions | 90% of SME professional services firms incorrectly assume their IT provider includes comprehensive security. Most basic IT support does not. | HIGH |
| Third-party/vendor risk | Software vendors, cloud providers, and outsourced services can become entry points if compromised. | MEDIUM |
| Client security posture | Clients with poor security habits can expose your systems through shared documents, compromised emails, or infected files. | MEDIUM |
| Budget constraints | Economic pressures lead to reduced security investment precisely when threats are increasing. | MEDIUM |
Regulatory & Compliance Considerations
UK GDPR & Data Protection Act 2018
As custodians of sensitive personal and financial data, accountants have significant legal obligations:
Breach notification
Must report breaches posing risk to individuals to ICO within 72 hours. Updated May 2025: “report early, update later”.
Individual notification
Must notify affected individuals without undue delay if breach poses high risk to their rights and freedoms.
Security measures
Required to implement “appropriate technical and organisational measures” to protect personal data.
Accountability
Must document security decisions and be able to demonstrate compliance.
Processor responsibility
Data processors (including accountants acting on client instructions) can now be held directly responsible for breaches.
Note: The Data (Use and Access) Act came into law on 19 June 2025, which may affect breach reporting requirements. Check ICO guidance for the latest updates.
UK Failure to Prevent Fraud Act (September 2025)
The Economic Crime and Corporate Transparency Act introduces a new offence for failure to prevent fraud. This places greater obligations on organisations to have reasonable fraud prevention procedures in place—including cybersecurity controls that prevent staff from being deceived into facilitating fraud.
Cyber Insurance: Essential Considerations
Cyber insurance provides a safety net but is not a substitute for security controls. Key considerations for accountancy practices:
Coverage gaps
Standard policies often exclude BEC/social engineering losses. Check that invoice fraud and payment diversion are covered.
Sub-limits
BEC coverage may have sub-limits as low as £100,000—far below potential losses from a major incident.
Duty of care requirements
Insurers increasingly require evidence of reasonable security controls. Claims may be denied if you lack documented security measures like a WISP (Written Information Security Plan).
Premium benefits
Cyber Essentials certification often qualifies for lower premiums due to demonstrated risk reduction.
Incident response
Many policies include access to incident response services—know how to access these before you need them.
Key Statistic: Organisations with Cyber Essentials certification are 92% less likely to make a claim on their cyber insurance. In 2024-2025, over 53,000 Cyber Essentials certificates were awarded in the UK.
Quick-Start Security Checklist
Immediate actions every accountancy practice should take:
✓ / Action
☐
Enable MFA on all email accounts, cloud accounting software, and banking platforms
☐
Implement mandatory verification procedure for any payment changes (phone call to known number)
☐
Configure automated backups with offline/immutable copy; test restoration quarterly
☐
Deploy firm-wide password manager; eliminate password reuse
☐
Enable automatic software updates on all devices
☐
Conduct phishing awareness training for all staff; schedule regular refreshers
☐
Brief staff on deepfake risks—video and voice calls can now be faked
☐
Document an incident response plan; know ICO notification requirements
☐
Review cyber insurance coverage for BEC/invoice fraud exclusions
☐
Consider Cyber Essentials certification as a baseline security standard
☐
Inform clients of your security procedures and warn them about invoice fraud
Key Resources
Resource / Description
NCSC Small Business Guide
Cyber Essentials Scheme
ICAEW Cyber Security Hub
ICO Breach Reporting
Action Fraud
actionfraud.police.uk (report cybercrime)
AAT Cyber Security Resources
Conclusion: Security as a Business Imperative
Cybersecurity is no longer optional for bookkeepers and accountants—it’s a fundamental business requirement. The threats are real, sophisticated, and specifically targeted at the financial services sector.
The good news: Most attacks exploit basic security gaps that are straightforward to address. Implementing MFA, training staff to recognise phishing, establishing payment verification procedures, and maintaining good backups will protect you against the vast majority of threats.
Key principles to remember:
- Trust but verify: In the age of deepfakes and BEC, always verify unusual requests through a separate channel—never trust email or video calls alone for payment authorisation.
- Defence in depth: No single control provides complete protection. Layer your defences so that failure of one control doesn’t result in breach.
- People are key: Staff awareness is your most effective security investment. A well-trained team will catch threats that bypass technical controls.
- Plan for incidents: Assume a breach will happen eventually. Having a tested response plan minimises damage and ensures regulatory compliance.
- Client trust is everything: Your reputation depends on protecting client data. A single breach can end relationships built over years.
Ready to assess your security posture? Contact us for a cost-effective assessment to identify gaps in your practice’s cybersecurity defences.