Learnings › Digital Office & Data Safety › First lesson
First lesson · Start here · Free
Why small CA firms get targeted
12 min read · Print this lesson
A small CA office looks like a strange target for a fraudster. You are not a bank. But think about what sits in your office today: the PAN, Aadhaar and bank details of hundreds of people, the passwords to their income tax and GST accounts, and their digital signatures in a drawer. For a fraudster, one CA office is a bank of identities.
How it usually happens
These are the common patterns. Names are made up; the stories are typical of what tax offices report.
1. The "refund" mail
In August an article gets a mail: "Refund of Rs. 14,200 approved for your client. Update bank account to receive." The link opens a page that looks exactly like the income tax portal. He types the client's login and OTP. By evening the client's bank account and email on the portal have been changed.
2. The password sheet
A junior leaves on bad terms. Six months later, a client calls: someone has filed a revised return and changed his contact details. The office never changed the passwords in the "client logins" Excel sheet that the junior had on his phone.
3. The missing DSC
On 30 September a partner needs a client's DSC for an audit report. The pouch is empty. Nobody knows who took it last. The filing is late, and the client asks a difficult question: "Who else has used my signature?"
4. The new bank account
A client's email is hacked. The fraudster replies on the same mail thread to your office: "Please pay the TDS refund to our new account." It looks like the client's usual mail. The money goes to the wrong account.
What it costs
- Trust. Clients forgive a late filing. They do not easily forgive their data being misused through your office.
- Time. Days spent with banks, portals, the police and angry clients, often in the busiest month.
- Professional risk. A CA must keep client information confidential. Under the Chartered Accountants Act, disclosing information from an engagement without the client's consent is professional misconduct, and the ICAI Code of Ethics says confidentiality covers how you collect, store, use and destroy client information, not only what you say.
- The law. The Digital Personal Data Protection Act, 2023 requires anyone who handles personal data to protect it with reasonable safeguards and to report breaches. Most of these duties start in 2027. Lesson 10 explains it in plain words.
The good news
Almost all of these stories are stopped by a few simple habits, not expensive software:
| Story | What stops it | Lesson |
|---|---|---|
| Refund mail | Never log in from a link; check the sender; never share an OTP | 4 |
| Password sheet | Password manager + leaver checklist | 2, 9 |
| Missing DSC | DSC register, locker, PIN kept separately | 3 |
| New bank account | "New bank account? Call first." | 4 |
| Lost laptop / ransomware | Screen lock, encryption, tested offline backup | 5, 7 |
How this course works
- 13 short lessons, 10 to 18 minutes each. Read one a day.
- Every lesson ends with a "Do this today" box: two or three small tasks for your office.
- Made for partners and staff. Lessons 4, 5 and 8 are worth showing to every person in the office.
- By the end you will have a password manager, a DSC register, a tested backup, joiner and leaver checklists, and a one-page data safety policy signed by your team.
Do this today (5 minutes)
- Answer honestly: is there an Excel sheet or notebook of client passwords in your office? Who can open it?
- Count the client DSCs in your office. Do you know where each one is right now?
- Ask your team: "Has anyone received a mail about a tax refund or GST suspension this month?" Look at one together and check the sender address.
Sources (checked 18 Oct 2026)
- Chartered Accountants Act, 1949, Second Schedule, Part I, clause (1).
- ICAI Code of Ethics, 13th edition (in force from 1 April 2026), Subsection 114, Confidentiality: icai.org
- Digital Personal Data Protection Act, 2023 (Act 22 of 2023): meity.gov.in (PDF)
Make your office safe: unlock the other 12 lessons
Passwords, DSCs, phishing, backups, staff access and the DPDP Act, with checklists, a DSC register and a ready policy you can fill in. Rs. 999 + GST, one time · or the Office Subscription Plan at Rs. 1,499 / year for every course, for you and your staff.