Website Security for Accountancy Firms in the UK

What Accountancy Firms Hold and Why It Matters

An accountancy firm handles some of the most sensitive financial data in existence. Tax returns contain complete pictures of individual and corporate income, allowances, and liabilities. Payroll processing involves employee salaries, National Insurance numbers, bank account details, and in some cases pension and benefit information. Management accounts, annual accounts, and audit working papers contain detailed financial positions of businesses — information that would be highly valuable to a competitor, a fraudster, or an attacker looking to conduct targeted social engineering.

The regulatory environment for UK accountancy practices is correspondingly demanding. ICAEW members are subject to the ICAEW's Professional Standards requirements, which address data management and client confidentiality. ACCA and CIOT members operate under similar professional obligations. All UK practices are subject to UK GDPR and the Data Protection Act 2018 as data controllers processing client personal data. Practices involved in audit are subject to additional requirements under the FRC's Ethical Standard and related guidance.

The Attack Surface of an Accountancy Firm Website

**Client portal for document exchange** — Many practices offer a client portal through which clients upload payslips, bank statements, and accounting records, and through which the practice returns draft accounts or tax returns for approval. The security of this portal is critical: it sits at the boundary between the client and the practice's systems, and it handles the most sensitive material the practice holds.

**Online enquiry and onboarding forms** — Initial contact forms may collect business turnover, number of employees, current accounting software, and the name of the previous accountant. Even preliminary information collected before a client relationship is established is personal data and must be handled appropriately.

**Online appointment booking** — Where practices offer online booking for initial consultations, these systems collect personal contact data and sometimes information about the client's financial situation or the nature of the service they are seeking.

**Staff access to practice management software** — Web-based practice management platforms, cloud accounting software, and document management systems are accessed by staff through browsers. Weaknesses in authentication — particularly the absence of multi-factor authentication — create risk for the entire client data estate.

**Email security configuration** — Accountancy firms send legally and financially significant communications by email: tax return summaries, payment-on-account reminders, accounts for approval. If DMARC is not at enforcement, your domain can be spoofed by attackers sending fraudulent payment instructions to clients in your name.

Fraud Risks Specific to Accountancy Practices

CEO and finance director fraud

Accountancy practices are impersonated in fraud attacks targeting their business clients. An attacker who has breached the practice's email system — or who spoofs the practice's domain — can send a client an email appearing to come from their accountant, redirecting a VAT payment or a salary run to an attacker-controlled account. The instruction has credibility precisely because it appears to come from the client's trusted financial adviser.

Invoice interception

Attackers who gain access to a practice's email or client portal can intercept payment requests and modify bank account details before they reach the client. This attack requires either access to the practice's communication channels or a man-in-the-middle position — both of which are enabled by weak email security or compromised credentials.

Tax refund fraud

Where a practice submits tax returns on behalf of clients with refunds due, access to the practice's HMRC agent credentials enables an attacker to redirect refunds to accounts they control.

Common Technical Weaknesses

**Absence of multi-factor authentication** — Practice management software, cloud accounting platforms, and email are high-value targets. Credential stuffing attacks using email addresses and passwords from previous breaches are automated and continuous. MFA is the single most effective control.

**Client portal built on an unpatched CMS** — Portals built in WordPress with client area plugins are common and frequently behind on updates. Unpatched CMS installations have known CVEs that are actively exploited by automated scanning tools.

**Weak client authentication on the portal** — Client-facing portals often have lighter authentication than internal systems. Without rate limiting, account lockout, and ideally MFA, client accounts are vulnerable to brute force and credential stuffing.

**Insecure document URLs** — Documents stored in client portals are sometimes served from predictable or guessable URLs. An attacker who can enumerate document IDs may access another client's accounts or tax returns.

**Missing or unenforced DMARC** — A DMARC policy at enforcement (p=reject or p=quarantine) prevents your domain from being used in spoofed emails. Without it, anyone can send an email that appears to come from your practice's domain.

ICAEW and Professional Body Guidance

The ICAEW's guidance on data security for members is clear that practices must implement appropriate technical controls for the personal and financial data they hold. The ICAEW's updated cybersecurity guidance (2023) specifically recommends multi-factor authentication, regular software updates, and staff awareness training as baseline controls.

Practices subject to audit regulation should note that the FRC's inspection reports have increasingly referenced IT controls and data security as areas of focus. An annual security assessment provides documented evidence that technical controls have been reviewed.

Practical First Steps

Enable multi-factor authentication on every platform that holds client data. Review the update status of any CMS or portal software used for client communication. Check DMARC, DKIM, and SPF configuration for your domain. Ensure client portal URLs for document access require authentication — that downloading a tax return requires a valid authenticated session, not just knowledge of the URL.

The [GDPR website security requirements](/blog/gdpr-website-security-requirements-uk) guide covers the technical obligations that apply to all UK practices processing client data. For understanding what a full security assessment actually covers and costs, [penetration test cost UK](/blog/penetration-test-cost-uk) lays out realistic pricing across different engagement types. And if you're weighing whether your practice should hold cyber insurance, [cyber insurance UK requirements](/blog/cyber-insurance-uk-security-requirements) covers what insurers look for and how security assessments affect premiums.

Yrzo AI's automated security assessment covers 54 technical checks for accountancy firm websites and client portals, including authentication controls, document access security, email security configuration, and HTTP headers. Results delivered in minutes at yrzoai.dev.