Cybersecurity for Accountants: Securing Email Accounts Against Evolving Threats

Attackers are exploiting old protocols to hack into Email accounts and impersonate accountants

Email inboxes are on the front line for accounting firms, and we’ve all seen suspicious emails disguised as trusted contacts , convincing us to click harmful links or attachments, often triggering ransomware or malware incidents.

In one recent case, a Far North Queensland firm unknowingly sent infected emails, causing damage to three clients and triggering a reportable breach. Incidents like this highlight why cybersecurity for accountants, especially email security — is absolutely vital.

The Hidden Risk: Legacy Mailbox Protocols

Even with strong cybersecurity controls like multi-factor authentication (MFA) and secure login integrations, legacy email protocols like SMTP, POP, and IMAP remain a backdoor for attackers.

These older protocols:

• Allow email accounts to be accessed from multiple devices

• Do not support multi-factor authentication

• Are often left enabled by default in Office 365, exposing firms unnecessarily

This is often done to accommodate scan-to-email functions or older mobile access, but these conveniences can dramatically weaken your firm’s cybersecurity posture.

How Cybercriminals Exploit This Weakness

Attackers use techniques like password spraying to exploit these legacy protocols. Here’s how it works:

• Instead of brute-forcing passwords (many passwords for one user), hackers use one weak password across multiple usernames.

• These attacks don’t trigger account lockouts, appearing as isolated failed logins.

They also harvest staff emails from websites, particularly from “Meet the Team” pages — combining this with other public information to fuel their attacks.

What Accountants Should Do: Best Practices

1. Disable Legacy Protocols

Modern Office 365 and Outlook connections no longer require SMTP/POP/IMAP. Disable these in your mail admin console immediately.

Here’s our guide to disabling these protocols.

2. Remove Personal Email Addresses from Public Websites

Replace direct staff emails with:

• A Contact Us form

• A generic shared mailbox (e.g., info@yourfirm.com)

This prevents your firm’s personal email addresses from being scraped by attackers.

3. Regularly Review Email Security Policies

Perform a cybersecurity audit focusing on:

• Legacy protocol status

• MFA settings

• Password policies

• Account monitoring and access controls