The most secure way for a bookkeeper to email client financial information is to keep the numbers out of the email. Statements, payroll registers and anything with a full account number go as a password-protected, encrypted file or through a portal. The password goes by phone or text, outside the email. The email itself stays plain: “September statements are uploaded.” Then protect the mailbox with a security key or an authenticator app, because that one sign-in opens everything else.
Most bookkeepers don’t need a new secure email client to do this. The tools you already have cover nearly all of it, and the rest is a few habits. This page sets out what you actually hold, what your clients expect of you with it, the three ways to move a file, and what each one costs.
What a bookkeeper actually holds
A bookkeeper’s mail carries more bank data than most people’s, and most of it arrives unasked. Here’s what usually turns up, and how each kind should travel.
| What it is | Where it comes from | Why it matters | How it should travel |
|---|---|---|---|
| Bank and card statements | Client forwards, or a bank notice | Full account numbers, every transaction | Locked file or portal |
| A voided check or an ACH form | New vendor or payroll setup | Account and routing numbers together | Portal, or read out on a call |
| Payroll registers | Payroll provider or client | Names, pay and often Social Security numbers | Locked file or portal |
| W-9s from vendors | Vendors, by way of the client | Taxpayer ID numbers | Portal, or a locked file |
| A bank login | A client who means well | Full control of the account | Never by email. Ask for your own user |
| A charge question with the last four digits | You, every month | Very little on its own | Plain email is fine |
The last row is most of your mail, and it’s safe. “The $412.18 charge on 9/14, card ending 4471” tells nobody anything useful. The account number, the routing number and a Social Security number are what a thief wants. Keep those out of the body of any email, yours or theirs.
What your client expects, and what the rules say
Your clients expect two things. Their numbers stay with you. And nothing moves out of their account because of an email you trusted.
The law adds detail, depending on what you do. The FTC Safeguards Rule covers “financial institutions,” and its own examples name one kind of practice directly:
An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity.
That’s from 16 CFR 314.2. If you prepare returns, even a few 1099s, treat yourself as covered. If you only keep books, the rule’s examples don’t name you, and that’s worth a conversation with your own advisor. Many bookkeepers follow it either way, because clients and insurers ask.
For those it covers, the encryption line is short (16 CFR 314.4(c)(3)):
Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.
The same paragraph allows “effective alternative compensating controls” where encryption isn’t feasible, approved by the person who runs your security program. The FTC’s business guidance adds two figures worth knowing:
- Fewer than 5,000 consumers. A firm holding information on fewer than five thousand consumers is exempt from certain provisions, not the whole rule.
- 500 or more. A breach of 500 or more consumers’ unencrypted information has to be reported to the FTC within 30 days of discovery.
Notice the word “unencrypted” in that second line. A locked file that goes astray is a different event from a plain one.
The IRS says the same thing in plainer words. Publication 4557 (Rev. 6-2024) tells tax professionals:
Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email.
The written security plan, engagement-letter wording and what to ask of any software you connect belong to a different page: is it safe to use AI with client financial data.
A secure email client for bookkeepers: three ways to send a file
There are three practical ways to get a statement or a payroll file from one desk to another. Each protects the file. They differ in what the client has to do, and in what’s left in your mail afterward.
| Method | What the client does | What stays in your mailbox | Where it breaks |
|---|---|---|---|
| Password-protected file on a plain email | Opens the attachment, types a password | The locked file, which you can save and find | Password sent in the same thread |
| Encrypted message from your mail provider | Clicks a link, signs in or enters a code | Often only a link to the message | The link can expire. Search can’t see inside |
| Client portal | Signs in and uploads or downloads | A notice that something was posted | One more login for the client |
The locked file
This is the method most small practices use, and it’s free. Excel, Word and most PDF tools can encrypt a file with a password. Your accounting software’s reports export to one of them.
It works with every client’s mail, on every plan. The file in your sent folder stays locked, so a stolen mailbox doesn’t hand over the contents. And you keep a copy you can find next March.
The encrypted message
Your mail provider wraps the whole message. Microsoft 365 calls this Purview Message Encryption. Microsoft says a recipient without Microsoft 365 can “read and reply to encrypted messages on the web through your web browser” (Microsoft Learn). Gmail’s confidential mode looks similar, but it’s an access control rather than encryption. Google says recipients “can still take screenshots or photos of your emails” (Gmail Help).
The catch for a bookkeeper is the record. The message often lives behind a link, so your own search won’t find the figure later. Save the attachment into the client’s folder the day it arrives. What each kind of encrypted message actually protects is in encrypted email, and what an AI assistant cannot read.
The portal
A portal takes the file out of email altogether. The client uploads to it, and your mail gets a one-line notice. Many practice management and accounting tools include one. For a client who sends statements every month, it’s usually the calmest route. More on that choice further down.
How much encrypted email costs
Less than most bookkeepers expect, and often nothing. Prices below were checked on October 4, 2026.
| Option | What it costs | What you get |
|---|---|---|
| Password-protected files | Free with Excel, Word or a PDF tool | Encrypted attachments on any email |
| Proton Mail password-protected email | Included on all Proton plans, including Proton Free | End-to-end encrypted email to anyone, with limits |
| Microsoft Purview Message Encryption | Included in Microsoft 365 Business Premium, listed at $32.00 per user per month paid yearly (bundled with Copilot) | Encrypted messages from Outlook to any recipient |
| The same, on a cheaper Microsoft plan | Business Basic is $7.00 per user per month paid yearly, plus an Azure Information Protection Plan 1 add-on | Same feature, two licenses |
| Gmail client-side encryption | Enterprise Plus or Frontline Plus editions only, priced through Google’s sales team | Encryption where your organization holds the key |
Sources: Proton, Microsoft Learn, Microsoft 365 plans, Google Workspace Admin Help.
Two of these come with a catch. Proton’s password-protected emails expire after 28 days at most, and a client who isn’t on Proton can reply to each one five times. Gmail’s strongest option sits on editions a one-person practice rarely buys.
So for most bookkeepers the answer is the free one. Lock the file, and keep the mail you already have.
Where the password lives
A locked file is only as private as its password. The password that arrives in the next email of the same thread protects nothing.
- One passphrase per client, set once. Agree it on the onboarding call. Four plain words are easier to say aloud and harder to guess than a short code.
- Kept in your password manager. File it under the client’s name, next to their bank and software logins.
- Said, or texted, never emailed. If the client forgets it, call them on the number in your records.
- Changed when someone leaves. A new office manager at the client, or a new assistant at yours, means a new passphrase.
- The client uses it too. When they send you a payroll file, it comes locked with the same words.
The same habit covers files that arrive locked. Payroll providers and some banks send password-protected PDFs. Store that password in the same entry, not in a reply.
When the client sends it in the clear
Clients will email you full account numbers. They’ll send a photo of a voided check, or a statement with no password. That’s ordinary, and it isn’t a crisis. The IRS asks you to “caution customers against transmitting sensitive data, like account numbers, via email” (Publication 4557). A kind note does it.
Here’s what to do with the message in front of you:
- Save the file to the client’s folder. Do it now, while you know what it is.
- Reply without the quoted text. Delete the original from your reply so the number doesn’t travel twice.
- Point them to the easier route. “Thanks, got it. Next time, the portal link below is quicker, and it keeps your account number out of email.”
- Delete the message under your retention policy. If your firm keeps mail for a set period, follow it. Either way, don’t leave the account number sitting in a label called “To do.”
A bank login is the one exception. If a client emails you their online banking password, don’t use it. Ask them to change it today and to add you as your own user with view-only access, if their bank offers that. The IC3 advises against “supplying login credentials or personal identifiable information (PII) of any sort via email” (IC3). A shared login also means every change in that account looks like the client made it.
Protecting the mailbox itself
Encryption protects a file on its way. The mailbox protects everything at once: years of statements, every client’s thread, and the reset link for your accounting software. Most of the risk sits here.
- A security key or an authenticator app on every mailbox. The FTC calls a security key “the strongest method of two-factor authentication” and says an authenticator app is safer than a text code because it can’t be taken with a SIM card swap (FTC).
- A unique password, in a password manager. Your email password shouldn’t open anything else.
- Recovery options you control. An old personal address or a phone number you no longer have is a way in for someone else.
- A look at connected apps every quarter. Remove anything you don’t use. What to check before connecting anything new is in what to check before you connect your inbox.
- A call before any bank change. A “please update our bank details” email is how business email compromise starts. The IC3 put exposed losses at about $55.5 billion worldwide between October 2013 and December 2023 (IC3). Call the vendor or the client on a number you already had.
The IRS gives the same instruction for multi-factor sign-in. Use “the most secure option available,” it says, including on “email accounts and storage provider accounts” (Publication 4557). If you run several addresses, including mailboxes your clients gave you, each one needs its own second factor. A mailbox per client covers how to keep those apart.
A week of bank data at one desk
Here’s an ordinary week for a bookkeeper with a dozen clients, and what each item needed.
| Day | What arrived | What happened |
|---|---|---|
| Mon | Hollis Dental emails a photo of a voided check for a new payroll account | Saved to the client folder. Reply without the photo. Portal link for next time |
| Tue | You send Marlow Roofing their August payroll register | Exported as a locked PDF. Passphrase already agreed in May |
| Wed | Greenleaf Cafe’s owner emails their bank password “so you don’t have to ask” | Not used. Called the owner, who changed it and added you as a view-only user |
| Wed | A produce vendor writes to Greenleaf with “new bank details” | Called the vendor on the number in last year’s invoice. The vendor knew nothing about it |
| Thu | Riverside Florist’s payroll provider sends a password-protected PDF | Password filed in the client’s password manager entry |
| Fri | You ask Hollis about “$1,180.00 on 9/22, card ending 4471” | Plain email. Nothing in it a thief can use |
Four of six items took under a minute. The two on Wednesday took a phone call each, and those were the two that mattered. If a charge question like Friday’s turns into a search, explaining a charge covers it.
How Point handles a thread with bank data in it
Point reads your mail through the connection you set up with Google or Microsoft. So it sees what your mailbox holds. A locked PDF stays locked to Point until you open it, the same as it does to anyone else.
Here’s what that looks like on a week like the one above.
- A lock for the message you need to seal. Point’s composer can lock a single message end to end. It stays between you and the recipient, and Point can’t read it. A locked message shows a lock where a summary would be, so Point won’t pull a date or a task out of it.
- The plain line around it still works. “Payroll register for August is attached, passphrase as agreed” can be sorted, summarized and turned into a follow-up. That’s why it helps to keep the message plain and lock the file.
- The fake bank change is held at the door. Point sets risky or malicious messages aside before they reach you. Mail from senders it doesn’t recognize isn’t read into anything, so a stranger can’t instruct your inbox.
- You choose how far it goes. Each kind of action sits on a dial from suggest-only to fully handled, and review is the default (setting how much your inbox does on its own).
Where your mail goes when Point reads it is set out in where your mail goes when AI reads it. Everything else Point does is on the benefits page.
When a portal is the better home
A portal fits better than email when the same sensitive file moves every month. Statements, payroll registers and vendor W-9s all qualify. The client learns one habit, and the files never enter anyone’s mailbox.
It’s also the better choice when you have staff. A portal shows who uploaded what and when, which a set of locked attachments doesn’t. Keep email for the conversation around the file: the question, the reminder and the “got it, thanks.” When a statement simply hasn’t come, chasing it is the missing statement.
Common questions
What is the most secure way for bookkeepers to email client financial information?
Don’t put the numbers in the email. Send statements and payroll files as password-protected, encrypted attachments, or through a client portal. Share the password on a call or by text, and keep it out of the thread. Keep the email itself plain, and protect your mailbox with a security key or an authenticator app. The IRS’s Publication 4557 gives tax professionals the same advice: send only password-protected and encrypted documents by email, or use a secure file transfer instead.
How much does encrypted email cost?
Often nothing. Password-protected files are free with Excel, Word and most PDF tools. Proton includes password-protected email on all its plans, including the free one, though those messages expire within 28 days. Microsoft includes Purview Message Encryption in Microsoft 365 Business Premium, listed at $32.00 per user per month paid yearly when checked on October 4, 2026. Gmail’s client-side encryption is limited to Enterprise Plus and a few other top editions.
What email should I use for my bank account?
Use an address you control for the long run, with a security key or authenticator app on it. For a bookkeeping practice, that’s your firm address or a role alias on it, such as alerts@ at your own domain. Avoid an old personal address you rarely check. For a client’s bank account, the bank’s notices should go to the client’s own address. Ask to be added as your own user rather than sharing their login.
What is the most hacked email service?
There’s no reliable public ranking. The biggest providers see the most attacks because they hold the most accounts. What decides whether your mailbox is taken is its own protection. That means a unique password, a security key or authenticator app, and recovery options you control. For a bookkeeper, the costly attack is usually a fake bank-change request, so verify every one by phone.
Is Gmail or Outlook secure enough for client financial information?
For the conversation, yes, with two-factor sign-in turned on. For the documents, lock the file or use a portal. Gmail’s confidential mode limits forwarding and downloading, but Google notes recipients can still take screenshots or photos. Outlook’s Purview Message Encryption needs Business Premium or an add-on. A locked attachment works the same on both.
Can a client email me their bank statement?
They can, and many will. Save the file to their folder, reply without quoting it, and point them to a portal or a locked file for next time. Never accept a bank login by email. Ask the client to change it and add you as your own user.