October is Cybersecurity Awareness Month. For accounting firms, CPA practices, tax professionals, bookkeepers, payroll providers, and financial service organizations, it is a good time to look closely at what you know, what you assume, and what is actually protecting your firm.
Not all cybersecurity advice is accurate. Some advice has been repeated for so long that it sounds like fact, even when it is outdated or incomplete.
That creates blind spots. Cybercriminals look for those blind spots, especially in firms that handle client financial data, payroll records, tax documents, financial statements, bookkeeping systems, and payment details every day.
In the Greater St. Louis region, we see accounting and financial service teams working with clients across St. Louis, Clayton, Chesterfield, St. Charles, O’Fallon, Belleville, Edwardsville, and the Metro East. Whether you are preparing returns, processing payroll, managing books, or advising business owners, one exposed account or one bad click can create a serious problem.
The good news is that these gaps are usually simple to address once you know where to look. Here are six cybersecurity myths we hear from professional service firms, along with the facts behind them.
Myth 1: We are too small for cybercriminals to care about
There is no accounting firm too small for an opportunistic cybercriminal. It does not matter if you are a solo tax preparer, a small bookkeeping practice, a payroll provider with a few employees, or a larger CPA firm with multiple locations.
If you have client financial data, Social Security numbers, EINs, bank account information, payroll records, or access to tax and bookkeeping systems, you may be a target. Your firm could also provide an entry point into a client, vendor, or financial partner network.
Attackers are not always looking for the biggest firm in St. Louis. They are often looking for the easiest opening.
Fact: Hackers choose targets based on opportunity, not firm size.
Myth 2: Our team will recognize a phishing email
The obvious phishing emails filled with typos and suspicious senders are not the only threat anymore. Many scams are polished, personalized, and designed to look like they came from a client, bank, software vendor, payroll contact, or firm partner.
Artificial intelligence has made it harder to spot a scam by reading the message alone. Your team also needs to look at the behavior behind the request.
Ask whether the supposed sender would:
- Send tax documents through an unusual link
- Change payroll direct deposit instructions by email
- Request copies of financial statements or bank records unexpectedly
- Ask your team to update payment instructions
- Send a new or unusual login link for a bookkeeping or payroll system
If something feels unusual, slow down and verify it through a separate channel. Call the client, employee, or vendor using a known phone number. Do not reply to the message or use the contact information it provides.
That extra step can feel inconvenient during tax season, especially when deadlines are stacked up. But it is much easier than explaining to a client that their financial information or payroll details were sent to the wrong person.
Fact: A convincing email can still be a scam.
Myth 3: MFA fully protects our accounts
Multi-factor authentication is an important layer of protection, and accounting firms should be using it wherever possible. That includes email, tax software, client portals, payroll platforms, bookkeeping systems, cloud storage, banking access, and remote access tools.
But MFA is not invulnerable. Criminals use MFA fatigue attacks to take advantage of employees who receive repeated approval requests.
For example, prompt bombing can flood a phone with login requests. The attacker hopes the employee eventually approves one just to make the notifications stop.
MFA should be supported by strong passwords, managed devices, access controls, security awareness training, and monitoring. Where possible, use phishing resistant authentication methods instead of relying only on approval notifications or text messages.
This matters for firms that work remotely, serve clients across Greater St. Louis, or have seasonal staff helping during tax season. More access points mean more places where a simple approval mistake can turn into a real issue.
Fact: MFA should be part of a broader security strategy.
Myth 4: Our backups have us covered
Ask yourself a practical question. If ransomware locked up your files tomorrow, could your firm restore its data? How long would that take?
For an accounting firm, that question is bigger than general office files. It includes tax workpapers, client documents, scanned source documents, bookkeeping records, payroll files, financial statements, QuickBooks data, practice management systems, and anything your team needs to keep client work moving.
A backup only helps when it is available, protected, and tested. Many firms discover during an incident that backups were incomplete, connected to the network, too old, or impossible to restore quickly.
Review your backup schedule, retention periods, access controls, and recovery process. Test the process regularly so you know what will happen before there is a crisis.
Business continuity is not just about having a copy of the data. It is about knowing how your firm will keep serving clients, meeting payroll deadlines, and filing returns if your normal systems are unavailable.
Fact: Having backups is not the same as being able to recover.
Myth 5: Cybersecurity is only IT responsibility
Your IT team or technology provider does a lot to protect your systems. They cannot control every click, password, file transfer, portal invitation, payroll change, or payment request made by employees.
Cybersecurity decisions happen throughout your firm. A single bad click can open the door to malware, stolen credentials, fraudulent payroll changes, or unauthorized access to client financial data.
Security awareness training helps employees recognize unusual requests and know when to ask for help. The goal is not to make every accountant, bookkeeper, or payroll specialist a technical expert. The goal is to help people make safer decisions during a busy workday.
This is especially important during tax season, when the pace is faster, inboxes are full, and clients are sending sensitive information from all directions.
Fact: Training employees to make good decisions strengthens your cybersecurity.
Myth 6: We know what to do if something happens
Imagine it is Tuesday morning in March and several employees suddenly cannot access their files. A payroll run is due that afternoon. A business client is waiting on financial statements. Several returns are nearly ready to file.
That is when many firms discover they have not answered a few basic questions.
- Should employees shut down their computers?
- Who contacts IT or your technology provider?
- What happens if email and phone systems are unavailable?
- When should your insurance company be involved?
- Who communicates with clients, banks, software vendors, and payroll contacts?
- How will employees receive updates?
- Which systems must be restored first?
- Who determines whether client financial data may have been exposed?
Do not rely on memory during an incident. Create a written incident response plan, assign responsibilities, and test the plan with your team. Your response process should also include backup communication methods and a clear escalation path.
For accounting and financial service organizations, incident response should connect directly to business continuity. If tax software, bookkeeping systems, payroll platforms, or document storage are unavailable, your team should already know the next step.
Fact: Your recovery plan should not debut during an incident.
Cybersecurity awareness starts with the facts
Cybersecurity Awareness Month is a good reminder to check the assumptions guiding your decisions.
Myths are comfortable. They can make you feel protected without requiring you to look closely at the details. But many cybersecurity gaps come from believing everything is handled when it is not.
For accounting firms, CPA practices, tax professionals, bookkeepers, payroll providers, and financial service organizations in St. Louis and the surrounding region, those details matter. Client financial data, payroll records, financial statements, and tax documents carry real responsibility.
At Tigerhawk Technologies, we help local businesses separate real protection from false confidence. That starts with understanding your accounts, devices, backups, policies, cybersecurity risks, and response plans.
If any of these myths sound familiar, take a closer look at where your firm stands. Schedule a discovery call and let us help you identify the practical steps that can reduce your risk.
Questions St. Louis accounting teams ask next
Do St. Louis CPA firms really need separate cybersecurity planning for tax season?
Yes. During tax season, CPA firms and tax professionals are moving more client financial data, W-2s, 1099s, bank details, and financial statements than usual. That heavier workflow creates more opportunity for phishing, credential theft, and rushed decisions. A seasonal security review helps confirm access controls, backups, portal security, and incident response before deadlines create pressure.
Should bookkeepers and payroll providers in Greater St. Louis use client portals instead of email?
In most cases, yes. Email is convenient, but it is not ideal for payroll records, tax documents, bank statements, or bookkeeping exports. A secure client portal with MFA, permission controls, and audit history is usually safer. The important part is making the process simple enough that clients in St. Louis, St. Charles, or the Metro East will actually use it.
How fast should an accounting firm be able to restore bookkeeping systems after ransomware?
The answer should come from your recovery objectives, not guesswork. For many accounting firms, being without bookkeeping systems, tax software, document storage, or payroll access for even a day can disrupt client work. Test restores, document priorities, and decide what must come back first so business continuity plans match real filing and payroll deadlines.