The short answer: Stop sending tax returns, ID documents and accounts as plain email attachments. Use secure client file sharing instead. In Microsoft 365, that usually means a SharePoint or OneDrive link limited to specific people. Set an expiry, such as seven or 30 days, and grant view-only access unless the person must edit. Ask clients to upload the same way, or through your practice portal. Turn on multi-factor authentication for every staff account. Then write a short practice rule so attachments are the exception, not the habit.
This guide is for small and mid-sized accountancy practices in Meath, Cavan, Westmeath, Louth and Dublin. It covers how to move client files and tax documents by secure client file sharing, rather than by open attachments. It does not cover Revenue phishing emails or secure remote working. Likewise, it leaves aside the choice between an office server and the cloud.
Why email attachments fall short of secure client file sharing
A plain attachment is hard to control once it leaves the mailbox. The wrong address, a forwarded thread or a later mailbox breach can all expose it. There is usually no expiry, and no way to revoke the file. After all, a copy then sits in sent items, inboxes and phone backups.
Revenue’s own security advice is blunt. It says you “should not send personal or confidential information to Revenue by email”. It also notes that email “is sent through public networks”. The Data Protection Commission’s data security guidance is equally clear. Encryption is “an essential security measure” when personal data is “transmitted over a public network”.
The Commission also says a controller must limit access on a “need to know” basis. Therefore, a named, time-limited link fits that duty better than a tax pack sitting in an email. That gap is why practices should switch to secure client file sharing. Treat leftover attachments as a real risk, not a minor inconvenience. Meanwhile, the same mailbox risk sits behind payment redirection fraud.
From our own work
We have seen a compromised email account lead to a misdirected payment. Attachments that linger in a mailbox give an attacker the same opening. Secure client file sharing, with access you can revoke, reduces that leftover trail.
Microsoft 365 options for secure client file sharing
Most practices already use Microsoft 365. SharePoint and OneDrive can issue sharing links that go only to named people. You can also set the link to view-only, and add an expiry date. This is the core of secure client file sharing in day-to-day practice work.
Prefer these settings for outgoing client files:
- Share with specific people only, not “anyone with the link”.
- Use view-only access unless the client must edit the file.
- Set an expiry, such as seven or 30 days, then review what is still open.
- Remove access when the job ends, rather than leaving a live link in an old thread.
Also, send the link in the email, not the file itself. In addition, keep a short record of what you shared, with whom, and when it expires. Depending on your Microsoft 365 licence, you may also have sensitivity labels or extra encryption options. Do not assume every licence includes them. Check with your IT provider before you promise a client a particular label or encryption feature.
Client portals and receiving documents from clients
In particular, outgoing links are only half the job. Clients still send PPS numbers, ID scans and books as ordinary attachments. Ask them to use secure client file sharing for uploads, not a reply-all attachment.
Many practice systems include a client portal, or an upload area, for incoming files. Treat that as a category, not a single product. Check with your software vendor what you already have, and who can see an upload. Then tell clients, in plain words, how you want documents sent.
If you use Microsoft 365, you can also send a client a link that lets them upload to a folder. Limit that link to the named person, with an expiry. Move the file into the client workspace once it arrives, and close the link. A short note in your engagement letter helps. Say how you will share files, and how you will not. That sits beside the wider advice in our guide to IT security for accountancy practices.
A simple practice policy, including MFA
Tools only work if staff use them the same way. Equally, a written rule stops every person inventing their own method. Write a one-page rule for secure client file sharing, and keep it short enough that people will read it. The National Cyber Security Centre’s SME guidance is direct. It says to “Turn on multi-factor authentication”. It also says to enable it “on all systems and services whenever possible, including cloud services, email accounts”. Multi-factor authentication sits beside secure client file sharing. A stolen password should not open every client folder.
A workable practice policy can start with these points:
- Do not email client files as attachments, except as a recorded exception.
- Use specific-people links, with an expiry date, as the default.
- Require multi-factor authentication on every staff Microsoft 365 account.
- Give access only to staff who need the file for the job.
- Review open sharing links each month, and revoke what is finished.
- Report a misdirected share in the same way you would report a misdirected email.
Hypothetical example
A staff member in Navan emails a client’s draft accounts to a similarly named client. The file then sits in both mailboxes, and nobody can pull it back. A named OneDrive link with a seven-day expiry would have helped. In that case, the practice could have removed access as soon as staff spotted the mistake.
How Sweeney Computer Services can help
A managed IT provider can set the defaults in advance. That includes blocking “anyone” links, requiring named people, and setting expiry where the licence allows. It also includes turning on multi-factor authentication for staff. People then use secure client file sharing as the normal path, rather than attaching a file out of habit.
Oliver Sweeney founded the company in 1985. Today we support more than 50 businesses and more than 10 schools from Hurdlestown, Kells, Co. Meath. We help accountancy practices set sharing defaults in Microsoft 365. We also turn on multi-factor authentication and train staff in the new habit. Our managed IT support packages start at Silver €49, Gold €69 and Diamond €89 per user per month, excluding VAT. Microsoft 365 licences are billed separately.
Gold includes email security, phishing awareness training and unlimited on-site call-outs. The helpdesk runs Monday to Friday, 9am to 5:30pm. After-hours emergency support costs extra. Silver includes Microsoft 365 backup. Within our managed packages, device and server backup is scoped in a written proposal. Finally, we can review your current secure client file sharing settings with you. We restore-test backups every two weeks, and records are available on request.
A quick sense-check
Need a hand with secure client file sharing?
Book a short call with Michael Sweeney to review sharing links, MFA and a simple practice rule.
