Why tax documents shouldn’t travel by email
A W-2 or Form 16 carries everything needed to impersonate someone. Email was never designed to protect that. Here is what a safer handover looks like.
A single tax form contains a name, address, employer, income and a government identifier. For an identity thief that is a complete kit. Yet in most practices the default way to receive it is still an email attachment.
What goes wrong with email
- It lives forever, in many places. An attachment sits in the client's sent folder, your inbox, your colleague's inbox after a forward, and every backup of those mailboxes.
- Encryption stops at the server. Messages are usually encrypted between mail servers, but they are stored readable in every mailbox they reach.
- Mistakes are easy. Autocomplete sends a return to the wrong "Priya". A reply-all copies someone who shouldn't have it.
- You can't tell who opened what. If there's ever a question about a leak, there's no record of who viewed a document or when.
Attackers know this. Tax season reliably brings a wave of phishing emails that pretend to be clients sending documents, or preparers asking for them.
What a safer handover looks like
A secure portal changes the default:
- One place per client. Documents go into that client's space, visible only to them and the people working on their return.
- Encrypted where they're stored, not only on the way.
- A sign-in that's hard to steal. Passwords plus a second step, such as an authenticator app, for everyone who can open client files.
- An audit trail. Every upload, view and download is recorded with a time.
- A request list instead of a free-for-all. Clients see exactly which documents are still needed, so fewer files are sent "just in case".
Habits that help today
Even before you change tools:
- Never ask clients to email ID numbers, bank details or full returns.
- Confirm any change of bank details by phone, using a number you already have.
- Remove client files from shared drives once a return is filed, and restrict who can open the folder.
- Turn on two-step sign-in for your email and every system that holds client data.
Your clients trust you with the most sensitive paperwork they own. Treating the handover with the same care as the return itself is part of the service.
This article is general information, not tax advice. Rules change and depend on your circumstances; speak to a qualified professional before acting on it.