Every tax season, clients email W-2s, 1099s, bank statements, and copies of driver’s licenses to their preparers. It’s familiar and frictionless, and it’s one of the biggest security exposures a practice has.
What the risk actually is
The problem isn’t one email. It’s where those documents end up:
- In mailboxes forever. Attachments sit in the client’s sent folder and the firm’s inbox for years, often in several staff mailboxes after forwarding.
- On phones. Staff mailboxes sync to phones that can be lost.
- Exposed by one compromised account. A single phished password gives an attacker years of client identity documents, neatly searchable.
- Out of reach of your retention policy. You can delete your copy. You can’t delete the client’s.
Tax professionals are expected to protect this information under the FTC Safeguards Rule and to describe those protections in a written information security plan. Unmanaged email attachments are hard to square with that.
It’s also a workflow problem
Security aside, email is a poor way to run intake. Files arrive with unhelpful names, in several messages, sometimes in the wrong version. Nobody can see at a glance which requests are still open. Preparers spend expensive hours sorting inboxes.
What to do instead
- Use a secure client portal for document exchange, with strong sign-in.
- Request specific documents so clients know exactly what to upload.
- Deliver results through the portal too, so clients have a reason to sign in.
- When clients email anyway, move the file into the portal, reply with a friendly link, and delete the attachment according to your retention policy.
Adoption takes a season or two. Our rollout guide covers how to make it painless.
How Zacello handles it
Zacello gives each client a portal for organizers, requests, messages, and signing. Every upload is versioned and scanned for malware, every account uses two-factor sign-in, and results are released only after approval, in the portal or through a link that expires.
Written by Syntonyl team. This article is general information, not legal, tax, or financial advice.