# Phishing Scams Targeting Bookkeepers and Their Clients

- Author: AutoBankConvert (https://www.autobankconvert.com)
- Published: 2025-06-17
- Updated: 2025-06-17
- Category: Security and trust
- Canonical: https://www.autobankconvert.com/blog/phishing-scams-targeting-bookkeepers

> Phishing scams targeting bookkeepers: fake statement requests, invoice changes and login pages, with the checks that stop each one before money moves.
Phishing scams targeting bookkeepers usually take one of four forms: a fake shared statement or document, a vendor asking to change bank details, a lookalike login page for a bank or accounting tool, or a message posing as a tax agency. Each one is stopped by a check made outside the email, before anyone clicks, signs in or pays.

## Which phishing scams target bookkeepers most?

Bookkeepers are attractive phishing targets because they sit between many businesses and their money. One inbox receives statements, invoices and payment questions from dozens of clients, and one stolen login can open several sets of books. Scammers rarely need technical skill. They need a believable message at a busy moment.

The four common forms are worth naming, because each needs a different defence:

| Scam | What it looks like | The check that stops it |
| --- | --- | --- |
| Shared file lure | "Your client shared March statements with you", with a link to sign in | Open files only from the client's usual channel, never from a link in an unexpected notice |
| Payment redirection | A vendor or client asks to send future payments to a new account | Call a number you already had on file and confirm the change before any payment |
| Fake login page | A page that looks like the bank, QuickBooks, Xero or your email provider | Type the address yourself or use a bookmark, and let the password manager refuse to fill unknown sites |
| Tax agency impersonation | An email or text about a refund, a penalty or a locked account | Sign in to the agency's site directly; never act on the message's links |

The table's examples are the patterns, not a full list. Scammers mix them. A fake vendor email may carry a shared-file link, and a fake login page may follow a fake tax notice. The common thread is pressure plus a link or a request to change where money goes.

Bookkeepers are also targeted indirectly. A scammer who takes over a client's email can send you a real-looking request from a real address. That is why the checks in this post rely on a second channel, not on whether the sender looks familiar.

## Fake bank statement requests and shared file lures

A shared file lure is an email that claims someone has shared a document with you, usually a statement, an invoice or a tax form, and asks you to sign in to view it. For a bookkeeper who receives client statements every month, this is the most natural-looking phishing message there is.

The message usually copies a real file-sharing service's design. The link leads to a page that asks for your email password "to verify your identity". Once entered, the scammer has your mailbox, and with it every client conversation and every password reset link.

Signs that a share notice is fake:

- The client normally uploads to your portal or a shared folder, but this file arrives by a new route.
- The file name is generic, such as "Statement.pdf" or "Documents for review", with no client name.
- The sign-in page asks for your email password, when the file service should already know you.
- The sender's address does not match the client's usual domain, or is a free mail account the client has never used.

A related lure tells you a statement "could not be processed" and asks you to re-upload it to a new site. Real conversion problems are reported inside the tool you already use. If a statement genuinely cannot be read, the post on [why a bank statement gets flagged as unsupported](/blog/unsupported-bank-statement-flagged) explains how to get a clean copy from the bank, without sending it to an unknown service.

The fix is a habit: collect statements through one route per client and treat anything outside that route as unconfirmed. Statement tools that take uploads and forwarded statements help here, because clients learn one way of sending files. AutoBankConvert, for example, takes the statements you upload or forward and does not ask clients to sign in anywhere unless you invite them.

## Vendor invoice changes and payment redirection scams

A payment redirection scam asks a bookkeeper, or a client the bookkeeper pays bills for, to send money to a new bank account. The request looks like it comes from a known vendor, or from the client's owner, and often says the old account is closed or under audit. The money goes to the scammer instead.

This is the core of what the FBI calls business email compromise. The FBI's Internet Crime Complaint Center page on [business email compromise](https://www.ic3.gov/CrimeInfo/BEC) describes scammers who break into or impersonate business email accounts to cause unauthorized transfers. Its first prevention tip is to verify requests to change account details through a secondary channel or two-factor authentication.

For a bookkeeper, that turns into a written rule:

1. No change to a payee's bank details is made from an email alone.
2. The change is confirmed by phone, using a number from your records or the vendor's earlier invoices, never one in the request.
3. A second person approves the first payment to any new or changed account.
4. The confirmation is noted in the vendor record: who called, which number, the date.

Watch for the details that give these requests away. The sender's address may differ by one letter from the real domain. The tone may be more urgent than usual. The request may arrive just before a payment run or a holiday. On a phone, the display name can hide the real address, so check it on a computer before acting.

If a payment has already gone out, call the client's bank at once and ask whether it can be recalled. Recalled or returned payments then appear on the next statement as a separate line, and the guide to [reversed transactions on bank statements](/blog/reversed-transactions-on-bank-statements) shows how to record them so the books match what actually happened.

## Fake login pages for bank and accounting software

A fake login page copies the sign-in screen of a bank, an accounting product or an email provider, so that a bookkeeper types a real password into a scammer's form. The page is reached from a link in an email, a text, an ad above search results, or a message that claims a session has expired.

These pages can look exact, down to the logo and colors. The address bar is the part that is hard to fake. A real bank address ends in the bank's own domain. A fake one often adds words, swaps letters, or uses a different ending.

Three habits stop most of these:

- **Use bookmarks for every client portal and your own tools.** Typing a bank's name into a search box and clicking the first result is how many people land on a copy.
- **Let the password manager decide.** A password manager fills a login only on the site where it was saved. If it offers nothing on a page that should be familiar, stop and check the address.
- **Keep a second sign-in step on every account.** A stolen password alone then fails, although some fake pages also ask for the code, so a code typed into a page you reached from a link is still a risk.

If staff work in many client portals in a day, keep a short list of the real address for each one in the client's record. Anyone unsure can compare the address bar against that list in seconds.

## Tax agency impersonation aimed at bookkeepers

Tax agency impersonation is a message that pretends to come from the IRS or a state tax office, about a refund, a balance due, a locked account or new paperwork. It targets bookkeepers because they handle client tax deadlines and are used to receiving tax notices on a client's behalf.

The IRS is clear about how it does and does not contact people. Its page on [reporting phishing](https://www.irs.gov/privacy-disclosure/report-phishing) says it never emails or texts without permission and never sends direct messages through social media. The same page says suspicious emails should be forwarded to phishing@irs.gov and not answered or clicked.

For a practice, that gives a simple test. An unexpected email or text from "the IRS" that asks you to click, sign in, or pay is treated as fake until checked. To check, sign in to the agency's site yourself from a bookmark, or call the number printed on a real notice the client already holds.

Tax season makes these messages harder to spot, because real notices and real deadlines are everywhere. Remind staff in January, and again before each quarterly deadline, that real tax notices for clients usually arrive by mail, and that a link in an email is never the way to deal with one.

## What should a bookkeeper do after clicking a phishing link?

After clicking a phishing link or entering a password on a suspicious page, act within minutes. Change the password for the account you entered, from a device you trust, and sign out all other sessions. Then tell the practice owner, so others can check whether the same message reached them.

A step list for the first hour:

1. Disconnect the device from the network if you downloaded or opened a file.
2. Change the exposed password and any account that shared it. Turn on or reset the second sign-in step.
3. Check the email account for new forwarding rules or filters. Scammers often add a rule that hides replies from clients.
4. Check sent mail for messages you did not write, especially to clients and vendors.
5. Warn clients whose details sat in that mailbox, and tell them not to act on payment changes until you call.
6. Record what happened, with times, for your insurer and your records.

Do not stay quiet out of embarrassment. A phishing click reported in five minutes is a small problem. One found a month later can mean a redirected payment and a client who no longer trusts you. If you carry cover for this, the post on [cyber insurance for bookkeepers](/blog/cyber-insurance-for-bookkeepers) explains what insurers usually expect you to report and when.

Write the steps into your practice's security plan so nobody has to remember them under stress. The guide to a [written information security plan for bookkeepers](/blog/written-information-security-plan-for-bookkeepers) shows where incident steps like these belong.

## Phishing checks that slow down a genuine client request

Phishing checks will sometimes delay a request that turns out to be real, such as a client who really did change banks or a vendor who really did switch accounts. That delay is the cost of the check, and it is small next to a lost payment. Explain the rule to clients in advance so a callback feels routine.

Some edge cases come up often:

- **The client is travelling and cannot take a call.** Agree a fallback in advance, such as confirmation through the accounting software's own messaging, or a second named person at the business.
- **The request is urgent and real.** Urgency is exactly what scammers use, so the rule does not bend. A same-day callback is usually enough.
- **The request comes from the client's own address.** A familiar address proves little if the client's mailbox is compromised. The callback still applies.
- **A vendor refuses to confirm by phone.** That is a warning sign in itself. Hold the change until someone at the vendor confirms through a known number.

Put the rule in your engagement letter or onboarding pack: "We confirm every change of bank details by phone before any payment." Clients who read it once are rarely annoyed later, and some will start applying the same rule to their own vendors. To keep statements flowing through one known route while these checks run, [AutoBankConvert](/get-started) lets you upload or forward each client's statements in batches, so a stray "shared file" email never becomes part of the routine.