Email attachments for accountants work best when the email says what the file is before anyone opens it. The correct format is short. The subject names the client, the document and the tax year. The first line says what’s attached and what you need back. The file carries a name you’d recognize in April. Anything with a full Social Security number goes encrypted or through your portal. That’s the sending side, and it takes a minute.
The receiving side is where documents go missing. A W-2 a client emails you lands in a thread. It stays in your mailbox. Then it needs a third home in the client file, where the return gets prepared. Each copy does a different job. Once you know which is which, nothing goes missing, and the form that arrives twice doesn’t catch you out.
The format for sending an attachment
Here’s one email, written out. You’re sending a client the draft of their return to review.
Subject: Okafor 2025 return, draft for your review
Hi Grace,
Your 2025 draft return is attached, protected with the password we agreed by phone. Please check the dependents and the bank details on page 2, and reply by October 10 so we can file before the 15th.
Okafor-2025-1040-draft-2026-10-04.pdf
Each part has a job.
- The subject names the client, the year and the document. It files the thread in your mail and in theirs.
- The first line says what’s attached, so the client knows before opening it.
- The ask is one thing, with one date.
- The file name reads the same in your client file as in their downloads folder.
- The protection matches the content. A draft return carries Social Security numbers.
That last point comes from the IRS. Publication 4557, Safeguarding Taxpayer Data, says:
“Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email.”
So the password never travels in the same email as the file. Agree it by phone, or use one the client already knows. How to encrypt and what a protected file actually guards against is in encrypted messages. What the Safeguards Rule asks of a practice holding this data is in a secure email client for an accountant who holds clients’ tax data.
What legally needs to be in an email signature
For the mail you send clients about their returns, very little. Two federal rules touch a tax practice’s signature. One applies only to marketing, and the other is a paragraph you can now drop.
CAN-SPAM covers commercial email. The FTC’s CAN-SPAM compliance guide lists what a commercial message must carry, including this:
“Your message must include your valid physical postal address.”
That applies when the main purpose of an email is to promote a service, like a newsletter offering bookkeeping packages. Mail about a client’s own return is different. The same guide says a message with only transactional or relationship content “may not contain false or misleading routing information, but is otherwise exempt from most provisions of the CAN-SPAM Act.”
The Circular 230 disclaimer can come off. Many tax signatures still carry a paragraph saying the email isn’t written tax advice. That paragraph came from the old covered-opinion rules. Treasury removed those rules in T.D. 9668, effective June 12, 2014. The preamble said why:
“Because amended Sec. 10.37 does not include the disclosure provisions in the current covered opinion rules, Treasury and the IRS expect that these amendments will eliminate the use of a Circular 230 disclaimer in email and other writings.”
A practical signature for a solo tax practice holds a few lines:
- Your name, and your credential if you hold one.
- The practice name.
- A phone number clients can call to check a request.
- Your postal address, which also covers you if you ever send a newsletter.
- Where clients should upload documents, if you have a portal.
If you hold a CPA license, your state board’s rules on firm names and the title apply wherever you use them, a signature included.
Where email attachments land when a client sends them
Clients don’t send documents the same way twice. Here’s what usually turns up in a tax practice’s inbox, and what each one is filed under before you touch it.
| How it arrives | Where it lands | What it’s known by |
|---|---|---|
| A PDF attached to a new email | Its own thread | The subject the client wrote |
| “Here” on a six-week-old thread | Inside the old thread | The old subject, about something else |
| Forwarded by the bookkeeper or spouse | The forward’s thread | The forwarder’s name, not the client’s |
| A phone photo of a form | A thread, often with no subject | “IMG_4471.jpg” |
| A large file or a shared folder | A link inside the message | Whatever the other service calls it |
| A link to a bank or payroll portal | A link inside the message | Nothing in your mail at all |
The first four are files in your mailbox. The last two sit in someone else’s system, and your mail holds only the way in.
Size alone can turn an attachment into a link. Google’s attachment help page says “For personal Gmail accounts, the limit is 25 MB.” It also says what happens above it:
“If your total attachment size is greater than the limit, Gmail automatically removes the attachment and adds it as a Google Drive link in the email.”
So a client scanning a thick brokerage statement may send you a link without meaning to. Download it when it comes in. A shared link can be changed or switched off later. The copy you saved stays put.
Three copies, three jobs
Three copies sound like clutter. They answer three different questions.
The thread is the record of what was sent. It shows who sent the file, on what date, and what they wrote above it. “The March figure on page two is wrong, I’ll ask the bank” lives there and nowhere else. When a client says “I sent that in February,” the thread settles it in a minute.
The mailbox keeps the thread findable. Filing a thread out of the inbox keeps it and its attachments. Google says an archived message “no longer appears in your inbox, but you can still find it under the ‘All mail’ label.” One label per client keeps a client’s threads together. That structure is in how to file client email.
The client file is where you work. Your tax software, your document system or your folder per client is where the return gets prepared. Put the working copy there, under a name you chose.
Keep the mail copy after you’ve saved the working copy. It’s the only one that carries the date it arrived and the note that came with it.
Naming the working copy
The client’s file name won’t help you. “Scan_0012.pdf” and “Document (3).pdf” are common ones. Rename it as you save it, in the same order every time:
- Client surname.
- Tax year.
- Form.
- Who issued it.
- The date it arrived.
That gives you names like these:
- Okafor-2025-W2-NorthsideClinic-2026-02-11.pdf
- Okafor-2025-1099DIV-Vanguard-2026-02-19.pdf
- Okafor-2025-1099DIV-Vanguard-CORRECTED-2026-09-30.pdf
The date goes year-month-day so the files sort in the order they came. The arrival date is the one from the email, which is another reason to keep the thread. A client with a family member’s forms gets the family member’s surname in front. Searching your mail for the same document later is finding last spring’s email.
When the same form arrives twice
A second version of a form is ordinary in October. A payroll company issues a corrected W-2. A brokerage sends a corrected 1099. A partnership reissues a K-1. Each one lands in your mail as a new attachment, often with the same file name as the first.
The forms themselves help you tell them apart. A corrected wage statement is a different form. The IRS describes Form W-2c as the way to “Provide corrected Form W-2 … to employees.” A corrected 1099 carries a mark at the top. The IRS General Instructions for Certain Information Returns say:
“Enter an ‘X’ in the ‘CORRECTED’ checkbox only when correcting a form previously filed with the IRS or furnished to the recipient.”
The same instructions allow a date beside that box, which “will help the recipient in the case of multiple corrections.” When there’s a date, use it. When there isn’t, the date the email arrived is your next best guide.
K-1s are looser. The IRS partner’s instructions for Schedule K-1 tell a partner who spots a problem to “notify the partnership and ask for a corrected Schedule K-1.” The reissued one doesn’t always look different at a glance. Read the note that came with it.
A few habits keep the right version in the return:
- Save the new version with CORRECTED in its name and the date it arrived.
- Keep the earlier version, marked as replaced.
- Check the thread for the sender’s note before you assume which one is current.
- If two copies look identical, ask the sender which one stands.
Asking for a missing or corrected form is chasing, and that’s chasing missing documents.
Before you open one
Most attachments are exactly what they say. A few are built to look like a W-2. Publication 4557 describes who sends them:
“The thief may pose as your tax software provider, your data storage provider, the IRS or even a prospective client.”
It also says what the attachment can do. It “may contain computer code called malware,” and keystroke tracking is the common kind. The same publication gives the rule for new names:
“Never open or download attachments from unknown senders, including potential clients; make contact first by phone, for example.”
In practice, a few checks catch most of it.
- A new client you’ve never spoken to. Call the number you found yourself before opening anything.
- A known client, an odd file. A ZIP, a macro-enabled spreadsheet or a “secure document” link they’ve never used before deserves a call.
- Urgency that isn’t theirs. A rushed tone from a client who’s usually relaxed is worth a second look.
- Anything claiming to be the IRS. Publication 4557 says to forward IRS-related phishing to phishing@irs.gov and not to reply.
Keeping suspicious mail away from anything that reads it, AI included, is in keeping suspicious mail away from AI.
When attachments should become uploads
Email carries most client documents well enough, provided the file is protected when it needs to be. A portal earns its place when a few things are true at once:
- Clients regularly send full Social Security numbers, bank details or IDs.
- You send finished returns or forms to sign several times a week.
- Files often pass 25 MB.
- You can’t remember which version you sent.
When you switch, mail keeps arriving beside the portal. Clients reply to the portal’s notice. They send “I’ve uploaded everything” as an email. That message is worth keeping with the client’s other mail, since it records when they said they sent it. Which documents belong in the portal, and which stay in email, is set out in when the portal does the job better. What a client should put in the email itself is the client’s side, a page you can forward.
How Point gathers what clients send
Point gives every file from your mail a second home, without asking you to build one.
The files gather in one list. Point’s Documents list collects the files that matter from your mail as they arrive. Each one is named and dated. There are no folders to set up. The W-2 from the payroll company and the 1099 the client forwarded sit one line apart, whoever sent them.
Each file keeps its thread. One click opens a file’s card. You see a preview, the kind of file, its size and the thread it came in on. One more click opens that thread, so the note above the attachment is right there. Come back, and the list is where you left it.
You can ask a file a question. “What’s the federal withholding on Grace’s corrected W-2?” comes back as an answer, with a link to the file it was read from. You check the source and move on. More on that is in getting the answer out of an attachment.
One search covers all of it. Command-K searches your mail, tasks, calendar and files together. Type a client’s name and the email, the task and the file appear side by side. That’s one box that searches everything.
Hostile mail waits at the door. A message built to manipulate whatever reads it is held in quarantine, unread and unprocessed. You review it in a read-only view. Release is your call.
The working copy still goes in your client file, and that step stays yours. Point keeps every document findable from the mail side, tied to the message that explains it. You can see what else Point does on the benefits page, or start from the home page.
Whether software should read client documents at all has its own place in is AI safe with client financial data.
When the list adds little
If every client already uploads to a portal, your mail holds notices more than files. The Documents list will be short, and your portal is the better place to look. The same goes if you save each attachment to the client file the moment it lands and never look back at the mail. Your habit already covers it.
The list helps most where documents arrive the untidy way. They come attached to old threads, forwarded by someone else, or named “IMG_4471.” That’s most solo practices in October.
Common questions
What is the correct email format for sending an attachment?
Put the client, the tax year and the document in the subject. Say in the first line what’s attached and what you need back, with a date. Give the file a name that says the same thing. If the file carries a Social Security number or bank details, password-protect and encrypt it, and send the password another way.
What legally needs to be in an email signature?
For ordinary client mail, very little. CAN-SPAM requires a valid physical postal address in commercial email, like a marketing newsletter, and exempts mail about a client’s existing engagement from most of its rules. The Circular 230 disclaimer hasn’t been needed since June 12, 2014.
Where do email attachments go after I archive the message?
They stay with the message. Google says an archived message leaves the inbox and can still be found under All Mail. The attachment is there too, and under any label you gave the thread.
Should I save client documents from email into my tax software or leave them in email?
Both. Save a working copy in the client file where you prepare the return. Leave the email as it is, because it records who sent the document, when, and what they wrote with it.
How do I tell a corrected 1099 from the original?
A corrected 1099 has an X in the “CORRECTED” box at the top. The IRS lets the issuer put a date next to that box, which helps when there’s more than one correction. A corrected W-2 is a separate form, the W-2c.
Why did a client’s attachment arrive as a Google Drive link?
Gmail limits attachments on personal accounts to 25 MB. Above that, Google says the file goes into Drive and the email carries a link to it. Download the file when it arrives, since the link can be changed later.
Does Point save attachments into my client folders?
No. Point gathers files from your mail into its own Documents list, each tied to the thread it came in on. Saving the working copy into your client file stays your step.
Can Point read documents a client uploaded to my portal?
Not the documents themselves. Point works from your mail, so it holds the email saying the upload happened. The files stay in the portal.