Login
iscover
Find out why redacting TFNs and attaching ATO Documents to emails is no longer secure enough to protect your clients.
Review your ATO Document delivery security now
20 June 2023
•
4 minute read
Review your ATO Document delivery security now. Why Redacting is no longer acceptable.
I find most firms only take security seriously when they have already had a breach. I have written this article to help you review your security before a breach happens.
Secure delivery of ATO documents is crucial for accounting firms to protect the confidentiality and integrity of sensitive client information. Here's why accounting firms should avoid sending ATO documents as email attachments and why two-factor authentication (2FA) email is important, as well as why redacting the Tax File Number (TFN) does not fully protect the rest of the important information on ATO documents:
Dangers of Email Attachments:
- Data Breaches: Email attachments are susceptible to interception or unauthorized access during transit, potentially resulting in data breaches. Hackers or malicious actors can exploit vulnerabilities in email systems to gain access to attachments, compromising the sensitive information contained within.
- Phishing Attacks: Email attachments can be used as a vector for phishing attacks. Attackers may disguise malicious attachments as legitimate ATO documents, tricking recipients into opening them and unknowingly installing malware or providing sensitive information.
- Loss or Deletion: Email attachments can be lost, deleted, or accidentally forwarded to unintended recipients. This poses a risk of data loss and potential legal and financial implications for both the accounting firm and their clients.
Importance of Two-Factor Authentication (2FA):
- Enhanced Account Security: Two-factor authentication adds an extra layer of security by requiring users to provide a second form of verification, such as a unique code sent to their mobile device, in addition to their normal email password. Even if an attacker manages to obtain account credentials, they will still need the second factor to gain access, reducing the likelihood of unauthorized access.
- Mitigating Password-related Risks: 2FA helps mitigate the risks associated with weak passwords, password reuse, or password-based attacks like brute-forcing or credential stuffing. Even if a password is compromised, the second factor provides an additional safeguard against unauthorized access.
Ineffectiveness of Redacting the TFN:
- Limited Protection: While redacting the Tax File Number (TFN) is a common practice, it alone does not provide comprehensive protection for the rest of the important information on ATO documents. Other sensitive details, such as names, addresses, income amounts, and financial transactions, remain exposed and can be used for identity theft or fraudulent activities.
- Data Aggregation: Attackers can combine information from various sources, including ATO documents and other publicly available data, to piece together a more complete profile of individuals. Even if the TFN is redacted, the aggregation of other personal details can still pose a significant risk to privacy and security.
- Contextual Information: Redacted documents may still contain contextual information or references that, when combined with external information, can help identify individuals or deduce sensitive information. This makes it crucial to protect the entire document rather than relying solely on TFN redaction.
In conclusion, accounting firms should prioritize secure delivery methods for ATO documents, avoiding email attachments due to their inherent risks. Implementing two-factor authentication enhances account security, reducing the likelihood of unauthorized access. While redacting the TFN is a common practice, it does not provide sufficient protection for the remaining important information on ATO documents. Accounting firms should adopt comprehensive security measures to safeguard the entirety of sensitive client information.
Foot note: If you would like a complementary private security audit of your ATO Document delivery please feel free to reach out and book a Zoom session on our website.
You are not authorised to post comments.
Comments will undergo moderation before they get published.