Session overview
This session explores emerging cyber threats, scams and the growing use of artificial intelligence (AI) in tax practice. Learn about common cyber risks, practical steps to strengthen security and protect client information, and ways to prepare for and respond to cyber incidents.
In partnership with the Tax Practitioners Board (TPB), the session also covers the responsible use of AI, including protecting client data, checking AI-generated information and meeting your professional obligations.
Webinar recording
Watch the recording at a time that suits you and claim continuing professional educationExternal Link. Attendance certificates are not issued for viewing webinar recordings.
Media: ATO open forum - Cyber Security and AI
https://tv.ato.gov.au/media/bi9or7ofbdni7fExternal Link (Duration: 1:26)
Key insights from tax practitioner questions
Missed the forum? Here’s what was asked:
- Using AI while maintaining professional responsibility
- Understanding how software providers use and protect client data
- Managing cyber security when using external providers
- Protecting your practice from scams and cyber threats
- Preparing for and responding to a cyber incident
Using AI while maintaining professional responsibility
Tax practitioners remain responsible for advice supported by AI
AI can support research and other tasks, but registered tax practitioners remain responsible for the professional judgements and decisions they make. Tax practitioners should review and verify AI-generated information against authoritative sources before relying on it.
It is also important to maintain appropriate records showing how AI-generated information was assessed and verified. Working papers should demonstrate the process followed, including the sources checked and how the practitioner reached their final position.
Inappropriate use of AI may raise professional conduct issues
Registered tax practitioners have obligations under the Code of Professional ConductExternal Link, including obligations relating to honesty and integrity. Where a tax practitioner becomes aware of conduct that may constitute a significant breach of the Code, they should consider whether the breach reporting requirementsExternal Link apply.
Understanding how software providers use and protect client data
Know how your software providers are using AI
AI functionality is increasingly being incorporated into accounting and practice management software, including how client information may be accessed, stored or used.
Before using AI-enabled products, tax practitioners should understand how the provider handles their information and client data. This can include considering:
- how AI is incorporated into the product
- whether client or user data is used to train AI models
- what controls are available to limit or disable AI functionality
- how information is stored and protected
- whether third-party providers or subprocessors have access to the data.
It is also recommended that tax practitioners speak directly with their software provider about the security and due diligence processes they use when engaging third parties.
Guidance for digital service providers is evolving
As technology and AI-enabled services continue to develop, the role of digital service providers is changing.
The TPB advised that it is reviewing its guidance relating to digital service providers and their obligations under the Tax Agent Services Act 2009 (TASA). This work will help clarify when digital service providers may need to be registered and meet other obligations under TASA.
Managing cyber security when using external providers
Outsourcing IT does not outsource your professional responsibilities
Using specialist providers can help practices manage cyber security risks, but tax practitioners still need to understand how their information and client data is being managed and protected.
Tax practitioners should maintain an active relationship with their provider and make sure the provider understands the practice's obligations. This includes knowing where information is stored, how it is secured and when client information is shared with another party.
Third-party and supply chain risks are increasing
As practices increasingly rely on cloud platforms, software providers, managed service providers and other third parties, there are more potential points through which systems or information could be compromised.
Tax practitioners should consider third-party and supply chain risks as part of their broader cyber security arrangements, including asking software and service providers about the security controls they apply to their own suppliers and subprocessors.
Protecting your practice from scams and cyber threats
Stop and check before acting
A simple but effective way to protect against scams is to stop and take a moment to check a request before acting, particularly where a request involves money or sensitive information.
Scammers often create a sense of urgency to encourage people to act without carefully checking a request. Taking the time to verify a request through a trusted and independent channel can help interrupt this process.
If you're contacted unexpectedly, don't rely solely on contact details supplied in the message. Instead, verify the request using contact information from a known source. For more information on ATO scams, visit Verify or report an ATO scam.
Compromised email accounts can be used to exploit trusted relationships
Scammers can use a compromised tax practitioner's email account to:
- redirect refunds or payments
- steal client information for scams or identity crime
- impersonate the tax practitioner
- target clients or other contacts
- launch further attacks.
A key risk is that communications sent from a tax practitioner's genuine account can appear legitimate because clients already trust the practitioner and their email address.
Use recognised cyber security guidance
Tax practitioners should take steps to strengthen their cyber security practices and protect the sensitive information they hold.
Simple but effective measures include:
- enabling multi-factor authentication
- using strong passphrases
- keeping software up to date
- adopting secure digital identity solutions where available.
Having a plan in place to respond to a cyber incident can also help minimise the impacts on clients and business operations.
Tax practitioners are encouraged to visit the Australian Cyber Security Centre's Small Business HubExternal Link for further guidance, threat reports and alerts, and tools and resources, aimed to help businesses improve their cyber security.
Preparing for and responding to a cyber incident
Practise your cyber incident response
One of the strongest practical takeaways from the discussion was the importance of preparing for a cyber incident before it happens.
Just as workplaces practise emergency evacuations, practices should consider testing how they would respond to a cyber-attack or data breach. This includes knowing:
- who needs to be contacted
- what immediate steps should be taken
- where response procedures and contact details are kept
- what staff are expected to do
- how the practice will continue operating if systems are unavailable.
Regularly testing your response plan can help identify gaps and make it easier to act quickly if an incident occurs.
Reporting scams helps prevent further harm
What happens after a scam is reported to the ATO?
Scam reports help build intelligence about ATO impersonation scams and the methods being used. This information can support preventative and disruption activities, including protective measures on accounts, action against malicious websites and scam warnings to the community.
It’s important to report a scam, even if you didn’t respond or lose money.
If you have been affected by cybercrime, you can report it to the Australian Cyber Security CentreExternal Link.