Security awareness training for accountants is a monthly programme that rehearses the three scams aimed squarely at accounting work: payment redirection on client invoices, fake client instructions, and credential phishing aimed at the tax agent and ATO portals your firm depends on. This guide covers what the programme looks like in 2026, why accountants are targeted more than most professions, and a six-step rollout that produces audit-ready evidence.
TL;DR
- Accountants sit at the crossroads of two attack surfaces: your own systems and every client's payment details — one phishing email can redirect a client's money, not just yours.
- Payment redirection (business email compromise) is one of the top business cybercrime categories in Australia: 15% of business reports to the ASD in FY2024-25, and ACCC's Scamwatch has warned specifically that scammers target firms handling payments.
- The average self-reported cybercrime cost for an Australian small business hit $56,600 in FY2024-25 (ASD Annual Cyber Threat Report 2024-25).
- A monthly cadence of 10-15 minute training plus a monthly simulation is the default; a click triggers same-week coaching, never punishment.
- Per-learner reporting turns the programme into the evidence TPB, insurers and enterprise clients increasingly ask for.
Why accountants are a prime target
An accounting practice concentrates everything fraud wants: access to client funds instructions, tax file numbers, bank details, superannuation records and login details for the ATO, ASIC and tax agent portals. Unlike a generic business, a successful attack on your inbox rarely stops at your money — it moves through you to clients, which is why attackers are willing to craft targeted lures for the profession.
The national numbers put a price on the risk. The ASD received more than 84,700 cybercrime reports in FY2024-25 — roughly one every six minutes — and business email compromise fraud with financial loss made up 15% of business reports, with email compromise without loss the single largest category at 19%. The ACCC's Scamwatch has run dedicated warnings on payment redirection scams, noting they hit "real estate, construction, law, recruitment" and other payment-handling professions, and that scammers deliberately target "new or junior employees, or even volunteers" — exactly the profile of a first-year accountant clearing a partner's inbox.
There is also a regulatory layer. If your practice is covered by the Privacy Act 1988, a breach of client personal information triggers the OAIC's Notifiable Data Breaches scheme — notification of affected individuals and the regulator when serious harm is likely. A documented training programme is the difference between reporting a breach with evidence and explaining its absence to the regulator and your PI insurer.
The three attacks your firm will actually face
1. Payment redirection on client invoices
A "client" emails updated bank details days before a refund or disbursement, or a supplier's invoice thread arrives with swapped account numbers. The tell is always the same: a payment-detail change that arrives by email. The control is a firm-wide rule — no bank-detail change is ever actioned without phone verification on a number already on file.
2. Fake client instructions and executive impersonation
A message that appears to come from a partner, sometimes on "leave" and hard to reach, asks for an urgent confidential transfer or a client detail to be released. Urgency plus authority plus secrecy is the signature; genuine partners do not need payments kept from finance. We cover the full attack pattern in what is business email compromise.
3. Credential phishing for the portals
Fake myGovID, ATO agent portal and Xero login pages are built to capture the credentials that unlock dozens of clients at once. Any MFA code or push approval you did not trigger means someone already holds your password — treat it as an active compromise, not a glitch. If a real click happens, the recovery steps are in what to do after clicking a phishing link.
What the training programme looks like
Accountants do not need generic cyber content — they need scenarios drawn from the ledger. A programme that fits the profession has five parts:
- Monthly micro-lessons on the scenarios above: invoice fraud, client-detail changes, portal credential phishing, fake MFA prompts, and tax-time scam waves.
- Monthly phishing simulations that include the lures accountants actually receive — payment redirection, fake client briefs, portal login pages. Cyber Aware's phishing simulations auto-enrol anyone who clicks into a short lesson on that exact tactic the same week.
- A written verification procedure trained alongside the content: bank-detail changes verified by phone, two-person approval above a threshold, no secrecy requests honoured.
- One-click reporting in Outlook or Gmail, and a promise of no consequences for a reported click — the reporting rate climbing is the earliest sign the culture is working.
- Per-learner reporting — Cyber Aware's human risk reporting rolls clicks, reports, quiz results and overdue courses into one score per person, so the partners' review sees who is improving and who is repeating, not just an office average.
Rolling it out in six steps
- Baseline the practice. Run a security gap assessment first so the training budget lands where the weakness actually is — in most firms the human layer scores lowest, but get the number.
- Load everyone. Sync staff from Microsoft 365 or Google Workspace so new starters enrol automatically; part-time and contract bookkeepers are the teams most often missed.
- Assign the first lesson this week — payment redirection. It is the highest-frequency, highest-cost scenario for the profession.
- Schedule monthly training and simulations on the same cadence; Cyber Aware's training pairs the lesson calendar with the simulation schedule by default.
- Add tax-time intensity. Front-load the portal-credential module before the July and October peaks, when fake ATO and myGovID lures surge.
- Review monthly, in five minutes: click rate, report rate, repeat clickers, overdue completions. The trend is the verdict.
What it costs — and what it protects
Per-seat platforms for a small practice run a few dollars per user per month. Against the ASD's $56,600 average small-business loss per incident — and a single redirected client payment that can exceed that figure on its own — the arithmetic is not close. How platforms compare on automation, reporting and framework evidence is covered in the 2026 MSP buyer's guide.
FAQ
Why do accountants need phishing-specific training rather than general cyber training? Because the lures are profession-specific: payment redirection, fake client instructions and portal credential pages. Generic content teaches none of the three attacks that actually reach an accounting inbox.
Should bookkeepers and admin staff be included? Everyone who touches payments or client details — including contractors and juniors. Scamwatch's own warning is that scammers target staff least familiar with the firm's payment processes.
Will simulations annoy clients if staff forward them? Simulations stay internal and are clearly labelled for IT; nobody should be forwarding any suspicious email in any case — reporting internally is the habit the programme builds, per our guide to how to report a phishing email.
How does this help with PI insurance and TPB obligations? Insurers and professional bodies increasingly ask for evidence of security controls. Exportable per-learner reports showing monthly training, simulations and improving click rates are exactly the artefact they want to see.
Is annual training enough for a small practice? No. Recognition decays within weeks of a single session; monthly short sessions with monthly simulations is the cadence that measurably cuts clicks.
One last thing
The control that saves an accounting practice the most money is not software — it is one sentence everyone knows by heart: no bank-detail change is ever actioned without a phone call to a number already on file. The training programme exists to make that sentence a reflex under deadline pressure.