UpTrajectory Review

CPA Practice Advisor's Jason Bramwell has written a blunt warning aimed squarely at small accounting firms: using one password across your tax software, client portal, and bank account is not a convenience, it is an open door. The piece is short, but the point it makes is one that security researchers have been hammering for years without much traction among small practices. Credential reuse is not a theoretical risk. When a single breach at a third-party service exposes a password, attackers systematically try that same combination across financial platforms, email accounts, and professional tools. For a firm holding sensitive client financial data, the blast radius of one reused password is not just your own account. It is every client whose information sits behind that login.

For a small firm owner or operator, this is not an IT abstraction. It is a client trust issue, a regulatory exposure, and potentially a professional liability problem all at once. The IRS has been explicit with tax professionals about their obligations under the Gramm-Leach-Bliley Act safeguarding rule, which requires a written security plan protecting client data. State boards of accountancy have similarly raised expectations around data protection. If a breach traces back to something as preventable as password reuse, the firm is not just dealing with cleanup costs and notification obligations. It is dealing with the question of whether it took reasonable care, and that question has real consequences for licensure, insurance coverage, and client retention.

What is worth noting here is that Bramwell is not introducing a new threat. Credential stuffing, the automated replay of stolen username-password pairs across multiple sites, has been a documented attack pattern for well over a decade. What makes this piece worth reading is its directness. There is no hedging, no softening the reality that convenience-driven habits are the primary vulnerability at small firms. We agree with that framing completely. Where we would push the conversation further is on the question of why this habit persists. It is not laziness. Small firm operators are managing dozens of tools with no dedicated IT staff, and the friction of password managers or multi-factor authentication rollout feels like a real cost when you are already stretched thin. Acknowledging that reality matters for actually fixing the problem.

The downstream effects of a credential-based breach at a small firm are worth spelling out because they are easy to underestimate. Beyond the immediate incident response, firms face potential IRS penalties, state attorney general notification requirements, and the possibility that professional liability insurers scrutinize whether the firm met its safeguarding obligations before paying out. Clients who learn their data was exposed through a preventable password habit do not typically wait for the formal notification letter before they start looking for a new accountant. For firms that serve small business clients, the reputational damage compounds quickly in tight local and referral networks.

The fix is not complicated, but it does require intention. A reputable password manager eliminates the memory excuse entirely and makes unique, strong passwords practical across every platform. Multi-factor authentication, particularly app-based rather than SMS-based, adds a layer that renders a stolen password largely useless on its own. Firms should also audit which team members have access to what, and whether shared credentials are quietly circulating. The IRS and various state CPA societies publish free cybersecurity resources for tax professionals, and several are genuinely useful starting points rather than box-checking exercises.

Watch for whether the IRS or state boards begin treating password hygiene failures more explicitly as safeguarding violations in enforcement actions, because that would sharpen the incentive considerably. In the meantime, the practical move this week is simple: pick one password manager, enroll every team member, and turn on multi-factor authentication for your tax software, client portal, and banking access before the end of the month. The cost of doing that is an afternoon. The cost of not doing it is the kind of phone call no firm owner wants to make to a client.

“One login for the tax software, the client portal, and the bank is easy to remember. It is also easy to steal.” — CPA Practice Advisor

Takeaway: Deploy a password manager and enable multi-factor authentication on your tax software, client portal, and banking tools this week before a reused password becomes a client data breach.