Safest Way to Send Tax Documents to Your Accountant

The safest practical way to send tax documents to your accountant is usually the firm's own client portal or a secure upload link it sends you. Otherwise, send an encrypted or password-protected file with the password given by phone or text, or hand over paper in person. Avoid standard email attachments, never type a Social Security number into an email, and confirm any unexpected document request by calling the firm on a number you already have.

General information, not tax or legal advice.

The short answer

• Best: the firm's client portal or a secure, expiring upload link.
• Acceptable fallback: an encrypted email, or a password-protected file with the password sent by a different channel.
• Fine for paper: handing documents over in person.
• Avoid: plain email attachments, SSNs or account numbers typed into the message, and replying to a request you haven't verified.

This guide is for the person sending documents: W-2s, 1099s, prior-year returns, photo IDs, bank and brokerage statements. If you run a firm and are deciding what to offer clients, the reasoning is the same; our secure W-9 collection guide and our post on accounting firm document collection cover the firm side.

Why this matters in a real workflow

A tax file bundles what an identity thief wants: your name, SSN, income and bank details, often in one email thread. FTC breach guidance warns that thieves with names and Social Security numbers can use them to commit tax identity theft (FTC: Data Breach Response).

Tax firms are a known target. In a July 2024 release, the IRS said nearly 200 tax professional data incidents potentially affecting up to 180,000 clients had been reported to IRS Stakeholder Liaisons that spring (IRS, IR-2024-180). Phishing and spoofing was the most-reported crime type by count in the FBI's 2025 Internet Crime Report, with 191,561 complaints; those are self-reported complaints, not a count of all incidents (FBI IC3, 2025 Internet Crime Report).

The fake request is the part clients can control. The IRS's 2026 Dirty Dozen warns that tax professionals and businesses remain targets of "new client" or "document request" emails that deliver malicious links or attachments (IRS Dirty Dozen 2026). It also notes that scammers who hack an email account can find genuine past messages to a tax professional and use them to make a new request look legitimate.

What the rules and IRS guidance say

These rules apply to the firm, not to you, but they explain why firms steer clients toward portals.

• Tax preparers are covered by the FTC Safeguards Rule. The rule names an accountant or tax preparation service that is in the business of completing income tax returns as a financial institution (16 CFR Part 314). The FTC's business guide lists tax preparation firms among 13 examples of financial institutions under the rule (FTC Safeguards Rule guide). Bookkeeping-only firms aren't named, so they should confirm with counsel whether the rule applies to them.
• Paper and digital both count. Customer information means any record, in paper, electronic or other form, containing nonpublic personal information about a customer.
• Encryption and MFA. The Safeguards Rule requires encrypting customer information both in transit over external networks and at rest; if that is infeasible, the firm's Qualified Individual must approve effective compensating controls. It also requires MFA for anyone accessing any information system, unless the Qualified Individual approves an equivalent or stronger control in writing.
• Email only with protection. IRS Publication 4557 tells tax pros to send only password-protected, encrypted documents if they must use email, or to use secure file transfer instead of email (IRS Publication 4557). It also says a legitimate business will never ask you to email personal or sensitive information unless it is through a secured mail service.
• Passwords travel separately. The IRS's sample written information security plan includes a policy that PII won't be emailed unprotected, and that passwords are sent by a different channel than the data (IRS Publication 5708).
• Verify requests. The FTC advises verifying any email that requests sensitive information through a separate channel, and not using the links, phone numbers or websites in the email (FTC: Protecting Personal Information).

Comparing your options

The ratings below are our recommendations, not IRS or FTC rankings.

One note if your accountant also collects a W-9 from you: IRS instructions let requesters accept W-9s electronically, including by fax, so fax counts as an electronic submission there (Instructions for the Requester of Form W-9).

Recommended workflow

Our recommended practice, with the owner of each step.

1. Ask how the firm wants documents (client). Ask whether it has a portal or sends secure upload links, and use that channel for everything.
2. Verify unexpected requests (client). If a request arrives that you weren't expecting, or asks for more than usual, call the firm on a number you already have, not one in the email.
3. Send only what's needed (client). Ask your accountant for a list. The FTC tells businesses to use Social Security numbers only for required and lawful purposes and to keep only what they need, and the same logic applies to what you send.
4. Protect any email fallback (client). Encrypt the file or password-protect it, send the password by text or phone, and write nothing sensitive in the body. The FTC tells businesses to caution employees against emailing Social Security numbers, passwords and account information.
5. Confirm receipt, then clean up (client). Once the firm confirms it has the files, delete sent copies and unprotected downloads you no longer need.
6. Offer a secure channel (firm). Give every client a portal or upload link so no one has to fall back on attachments.

Exception path: if the firm only accepts plain email attachments, ask whether it can take a password-protected file or paper copies instead, and point it to the Pub 4557 guidance above.

Example scenario

Example scenario: Dana owns a made-up two-person landscaping company and uses a small, made-up tax practice, Northfield Tax & Books. In February she receives an email in an old thread with the practice asking her to "re-upload all documents" through a new link. She doesn't click. She calls the practice on the number printed on last year's engagement letter, learns no one sent the request, and tells the firm about the email. The practice then sends her a secure upload link through its usual process, and she uploads her W-2, two 1099s and a bank statement (account number shown here as XXXX).

Common mistakes

• Replying to a document request without checking that it's real.
• Photographing documents and texting them, leaving copies in your phone's photo library and cloud backup.

Checklist

• Asked the firm which secure channel it uses
• Any unexpected request verified by phone on a known number
• Sending only the documents on the firm's list
• No SSNs or account numbers in the email body or subject
• Email fallback encrypted or password-protected; password sent separately
• Receipt confirmed by the firm
• Sent copies and unprotected downloads deleted

How W9Vault supports this workflow

W9Vault is built for the firm side of this exchange. An accountant or bookkeeper can send a client a secure upload link that expires after 7 days. A single-document request can use the type "Other" for any PDF, JPG or PNG, such as a W-2 or a bank statement; files can be up to 20 MB. For requests that ask for several documents at once, the selectable types are W-9, W-8BEN, ACH form, Invoice, Contract and Government ID. Files are encrypted in the client's browser before upload, so the server never receives the plaintext file, and uploaded files are automatically deleted 30 days after upload for completed requests. The firm's dashboard shows whether each request is sent or completed.

W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations. For more on protecting tax and payment forms, see secure tax payment forms. If you only need to send a W-9 and email is your only option, see how to send a W-9 by email.

Frequently Asked Questions

Is it safe to email tax documents to my accountant?

A standard email attachment is usually a poor channel for documents with SSNs and account numbers. If your accountant offers a portal or secure upload link, use it. If email is the only option, send an encrypted or password-protected file and share the password by phone or text.

How do I know a document request from my accountant is real?

Call the firm on a number you already have, such as one from an engagement letter, not a number or link in the email. Scammers can hack email accounts and reuse genuine past messages to make a new request look legitimate.

Do accounting firms have to protect my documents?

Firms that prepare income tax returns are treated as financial institutions under the FTC Safeguards Rule, which requires safeguards such as encryption and multi-factor authentication. Bookkeeping-only firms should confirm with counsel whether the rule applies to them.

Official resources

• IRS Publication 4557, Safeguarding Taxpayer Data
• IRS Publication 5708, Creating a Written Information Security Plan
• IRS Dirty Dozen 2026 (IR-2026-30)
• IRS, IR-2024-180: Tax pros continue to be targeted by identity thieves
• Instructions for the Requester of Form W-9
• 16 CFR Part 314, FTC Safeguards Rule
• FTC Safeguards Rule: What Your Business Needs to Know
• FTC: Protecting Personal Information, A Guide for Business
• FTC: Data Breach Response, A Guide for Business
• FBI IC3, 2025 Internet Crime Report