technology Archives

Will a Nigerian Prince be Your Next Client?

February 28, 2018 By JAK + CO.

By Todd Koch, CPA, MBT, CFP®

Introduction

Many clients are looking for a new CPA, so receiving email requests for proposals is getting more common. Recently, I received an email request from a Nigerian prince offering me a million dollars to review his tax return. He conveniently attached his return to the email. So, all I needed to do was open his email attachment, and we were in business, right?

Now, while I have not had any phishing emails this obvious before, I have received several similar requests in the last 90 days. These are security threats and are a real danger to our clients’ data. We all have heard the warnings that CPA’s are prime targets for identity thieves. For years, cybersecurity criminals have been infiltrating the IRS to steal taxpayer information, but they’ve realized it is a lot easier to get that information from us.

A reputation, once lost, is gone forever

We have a legal duty under the Gramm-Leach Bliley Act to have a plan to deal with our clients’ private information. But I worry about client security for another reason. I am a CPA.

As a CPA, one of my primary business assets is my reputation, and it’s vital that I protect this. It has taken me too long to earn my reputation, and it only takes one mistake to lose a good name. I do not want to be part of a news story that begins “Security breach at…”

Constant vigilance and rigorous cybersecurity policies can help protect your firm’s data. The AICPA Tax Section has some best practices for keeping client data secure. Below are a few of my practical considerations that you should be doing (if you are not doing them already).

Secure emails

Emails are a leading entry point for security breaches. At our firm, we receive about 2.2 million emails a year. A cloud spam filter stops 90-95% of these emails from reaching our server. This is a good first step.

Get your staff into the mindset of never opening email attachments from new client solicitations. Be sure to create a policy that includes how all new client communications must first be addressed by a phone call to the potential client to determine if this is a new legitimate business proposal.

A cooperative between staff and IT

To reduce the possibility of becoming a victim of data breaches, our IT consultants routinely train and remind our staff to be vigilant. Staff should forward questionable emails to your IT department to evaluate and quarantine.

Also, have your IT department send out phishing emails disguised as real client emails. Test your staff to see if they will take the bait by clicking on an email attachment. This is a great way to assess whether your training is working.

Your trash is someone else’s treasure

There is a goldmine of client data on phones, tablets, or laptops. Staff should let their IT department know before they plan to sell or trade in their electronic devices and equipment. The IT department can then wipe all data from the phone before it changes hands.

Also, lost electronic devices and equipment should be immediately reported to your IT department so they can help mitigate some of the damage. They can reset your accounts and possibly disable your stolen devices so thieves cannot steal your firm’s data.

Get your clients on the bandwagon

Clients need to be aware of the issues of data security. Educate them on the potential risks and get them to embrace your policies for safeguarding their information.

The days of sending PDF attachments via regular email are over. We encourage our clients to use client portals to share their files. A client portal makes it easy to access, manage, and share data securely.

For those clients who do not use secure client portals, we send attachments to them using a secure email service that encrypts our emails in addition to other security measures. This ensures we have private communication channels with our clients.

Also, we are mindful of the packages we mail out. Not only do they have our clients’ names, addresses, birthdates, banking and investment information, but we put all this information in one convenient package with no means to lock or password protect it. Thus, we make it easy for anyone with motive to easily steal that information.

Make it a standard practice for clients to come and pick up their income tax returns. Very few of our clients come and pick up their returns now, but we are encouraging them to pick up their packages or have their returns couriered to them.

Lockdown those assets

Low-tech considerations, although obvious and simple, should not be overlooked. For years now, we have had a shredding company come to the office regularly to get rid of our paper documents securely. They must have a security card to even gain entry to our office.

One thing we implemented this year was asking the vendor who handles our firm’s janitorial duties to come during the work day. It may be a little inconvenient for both parties, but it helps eliminate any potential security concerns that come from documents ending up in the hands of non-staff.

Closing thoughts

A fully secure environment is not possible. As one human can do, another can undo. We need to continue to keep security at the forefront of our everyday life. Otherwise, we may inadvertently allow the Nigerian prince into our doorway.

Cyber Security Update: Be On Guard Against This Latest Threat

November 23, 2016 By JAK + CO.

By Dave Bell, Cyber Solutions, LLC (a division of JAK)

You don’t have to be a news junkie to know cyber security is a hot topic these days. From major Internet outages to sophisticated phishing scams, cyber threats have become a fact of life.

The ransomware industry hit $1 billion this year, buoyed by highly talented criminals who will do anything to extort money from unsuspecting citizens. Although the general public has become wise to certain schemes, the bad guys haven’t slowed down. New tactics seem to arise daily, such as this one that tries to convince would-be victims to pick up the phone.

Here’s what you should know:

In the last few years, online service providers like Google, Yahoo and Facebook have begun sending emails to their users in the event of a possible security risk, such as a log-on to your account from an unknown computer.

In the past, hackers have tried to emulate these emails and trick you into logging into their fraudulent website, which results in a compromised username and password. Now, however, they send fake security emails with an 800 number and claim you must call immediately to resolve the purported breach.

If you do call, two things may happen:

1) You’re immediately connected with a real Internet criminal, usually with a foreign accent, who tries to scam you. This person claims there is a problem with your computer, “fixes” it, and then asks for your credit card information.

2) You are sent to voicemail and kept there until you hang up. But while you wait on the line, your phone number is put in a queue, giving the bad guys a way to call you and attempt the above-mentioned scam.

The moral of the story: TBYC (or TBYD)

Remember, if you get an email that either promises something too good to be true or urges you to prevent a negative consequence, Think Before You Click—or in this case, Think Before You Dial.

Here’s an even better option: Never use a phone number from an email you received. If you decide to call any vendor, go to their website and call the number listed there.

As always, stay safe out there. If you’re concerned about this or other threats, give us a call—we’re here to answer any questions you may have.

Learn more about Cyber Solutions.

8 Technology-Related Questions That Could Reduce Your Tax Bill and Increase Efficiency

November 9, 2016 By JAK + CO.

By Andy Knutson, CPA

Trying to keep pace with changes in technology can feel like running on a treadmill—you can never stay ahead! But like a good treadmill workout, it’s a worthy effort. Improving your business’s IT infrastructure can lead to improved efficiencies, security, and even employee morale. And it just so happens that year-end is a great time to evaluate your technology needs.

That’s because computer hardware and software is eligible for accelerated tax depreciation, just like a bulldozer or other piece of equipment would be. Under Sec. 179, for instance, the purchase of qualifying equipment could qualify for a deduction of up to $500,000 in the first year of ownership. There’s the 50 percent bonus depreciation break to consider, too.

So before Dec. 31 inches any closer, ask yourself the following technology-related questions:

Do you need to replace any desktops or laptops?

A slow or outdated computer can cause a lot of frustration, not to mention unnecessary costs.

Is it time to add a server or replace an old one?

As you add staff to your team, consider the efficiencies a new server could bring.

What’s the status of your printer or scanner?

If your office is like ours, the printer has required more maintenance than most of the vehicles in the parking lot. Sometimes an upgrade is the only solution. Also, keep in mind that adding a scanner to your office could decrease your printer’s usage and subsequent need for repairs.

Is your battery backup, firewall, etc., meeting your needs?

These highly important items should be thoroughly evaluated. Unfortunately, they are often neglected by growing companies.

Have you outgrown your current accounting software?

Most companies start with QuickBooks, which is great, but as you grow you may require industry-specific software. There are countless options; your CPA can help you weigh the pros and cons of each. Implementing new software at the start of the year is usually preferable, but don’t rush your decision solely for this reason.

Are add-ons available for your current software?

Adding the equipment, inventory, or time-entry module you have been thinking about could help you prepare for next year’s growth.

Security! Is your anti-virus software up to date?

If nothing else, talk to your IT professional to ensure you are protected from cyber crime.

Do you know where your backups are?

Take a close look at your current backup solution, and make sure you have an on- and off-site copy. If you don’t have a backup solution, be thankful you haven’t lost anything yet, and get one implemented right away!

Investing in new technology now instead of putting it off until next year could be the right move for your business. But don’t wait—Dec. 31 will be here before we know it. If you’d like to get started with evaluating your IT needs, give us a call today.