IRS Issues Warning on Data Security

The Internal Revenue Service (IRS) is urging business owners and tax preparers to protect their companies from cybercriminals and scams.

The government agency has said businesses should shore up their cybersecurity plans after reports of "financial and identity theft related schemes" that could easily compromise the safety of a business, its finances and employees. The IRS warns that criminals often go after a business's most valuable data: credit card and payment information, business and employee identities, and tax and financial information.

Read more: Best Tax Software for Small Businesses

If a business suffers a cybersecurity incident, it can have serious ramifications, and not just reputationally. Stolen information can be used for a variety of crimes, including identity theft, fraudulent tax returns, and identity theft. And once it's too late, these can be timely and costly issues to resolve.

One of the more recent scams impacting U.S. businesses is the "new client" spearphishing scam. In such a case, a cybercriminal will pretend to be a prospective client, requesting they respond to their emails. When the owner complies, the criminal then sends a malicious attachment or website address that can "compromise the victim's computer systems and allows the attacker to access sensitive customer and financial information."

The IRS advises two key areas that businesses should review their protections of business files and devices, and wireless networks.

Read more: How to Find a Small Business Accountant

Protect business files and devices:

• Upgrade software, including applications, web browsers, and computer operating systems. Configure automatic updates.
• Back up important files offline, on an external hard drive or in the cloud storage system. Also make sure paper files are stored safely.
• Use passwords for all electronic devices, and never leave these devices unattended in public places.
• Encrypt devices and other media that contain sensitive personal information. This includes laptops, tablets, smartphones, removable drives, backup tapes and cloud storage solutions.
• Use multi-factor authentication, particularly for parts of your network that contain sensitive information.

Protect the business wireless network:

• Secure your business router by changing the default name and password, turn off remote management and log out as the administrator once the router is set up.
• Make sure the router offers WPA2 or WPA3 encryption and that the encryption setting is turned on. Encryption means any information sent over the network cannot be read by outsiders.

"Each year, the IRS sees thousands of attempts trying to attack small business owners and other taxpayers. Those who are victimized by these schemes can see serious financial consequences," said IRS Commissioner Danny Werfel.

"Cybercriminals are relentless, and anyone can be a target. The best way business owners and individuals can protect themselves is to stay well informed on the latest scams, continuously protect their computers and smart phones and install data security at home and in the business to protect sensitive information."