Email attachments for CPA firms, and the version everybody works from

Is it safe for a CPA firm to send tax documents by email? Not as a plain attachment. A return, a W-2 or anything carrying a Social Security number goes through your portal or as an encrypted file. That’s what the IRS asks of tax professionals in Publication 4557. Ordinary email is fine for the message about the document: “Your return is ready in the portal.”

That’s the rule for one message. A firm has a second problem, and it’s the one this page is about. Five people touch a client’s documents between January and April. Each forward makes another copy in another mailbox. By March, two of them are working from different versions of the same K-1. Nobody did anything wrong. The mail just made copies faster than anyone could keep track of them.

So this page covers both. What leaves the firm, and how. Then how a firm keeps one version in play.

Is it safe for a CPA firm to send tax documents by email?

Safe enough for the conversation, and not safe for the document. The IRS says it directly in Publication 4557 (Rev. 6-2024):

Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email.

The same publication asks you to “Encrypt all sensitive files/emails, especially those with the taxpayer’s personally identifiable information.” So the IRS doesn’t forbid email. It asks that the file inside it be locked.

Behind the IRS guidance sits a federal rule. IRS.gov states that “Federal Trade Commission regulations require professional tax preparers to create and enact security plans to protect client data.” The regulation is the FTC Safeguards Rule. Its encryption line, 16 CFR 314.4(c)(3), reads:

Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.

For a firm, that turns a habit into a policy. Every person who sends files needs the same answer to “how does this go out?” The full set of rules a partner should know, including MFA and the smaller-firm exemptions, is in what the rules ask of the attachments.

What never goes out as a plain attachment

Sort by what’s inside the file, not by how important the client is. A table your staff can pin up does more than a paragraph in the security plan.

The pattern holds for almost anything a client sends you too. Pub 4557 asks firms to “Caution customers against transmitting sensitive data, like account numbers, via email.” In practice that means telling clients once, clearly, where documents go. The signature section below is the easiest place to do it.

Portal or encrypted email, and when each one fits

Both satisfy the IRS. They suit different jobs.

For a firm with staff, the portal wins on the thing this page is about. A file uploaded once has one copy. A file emailed and forwarded has as many copies as it had recipients. Encryption protects each copy. It doesn’t stop them multiplying.

Keep encrypted email for the cases a portal doesn’t fit. The bank’s loan officer needs one return. An attorney wants a schedule today. The client’s new bookkeeper isn’t on the portal. How each kind of encrypted email works, including the password-protected PDF the IRS describes, is in encrypted messages, and who holds the key.

Email attachments for CPA firms: the version in play

Here’s how a firm ends up with three versions of one K-1.

The client forwards the partnership’s K-1 to the staff accountant in February. The accountant forwards it to the senior with a question. In March the partnership reissues it, and the client sends the new one to the partner, because the partner is the name they know. The partner forwards it to the senior with “use this one.” The senior is out that day. The reviewer picks up the return from the staff accountant’s copy.

Four mailboxes now hold a K-1. Two versions are in play. The return is about to be reviewed against the wrong one.

Three things make this worse at firm scale than at a solo desk:

• Clients pick a person, not a process. They send to whoever they last spoke with, so documents for one return arrive at three addresses.
• Forwarding is the handoff. Staff move work by forwarding mail, and every forward is another copy of taxpayer data.
• Nobody owns “current.” Everyone assumes the newest email holds the newest file. The newest email is often just the newest forward.

There’s a security cost too. Each extra copy is more customer information sitting in more mailboxes. Your security plan has to account for every one of them.

If you work alone, the copies problem is smaller. How one practitioner keeps a corrected form from getting lost is in where client documents end up.

One home for the file, and the mail points to it

The fix is a house rule, and it fits on a card. The document lives in one place. Email talks about it.

1. A client’s document goes into the client’s folder the day it arrives. That’s your document management system, your portal or your tax software’s file room. Whoever opens the email files it.
2. Staff hand off with a link to the file, never a fresh attachment. “K-1 is in the 2025 folder, see the note” carries everything a forward did, and makes no new copy.
3. One person decides what’s current. That’s the engagement’s preparer, or whoever owns the return. A corrected form is marked as superseding the earlier one, in the folder.
4. The old version stays, marked replaced. Deleting it erases the record of what you had when.
5. The email stays where it landed. It’s the record of who sent what, and when, and what they wrote above it.
6. Requests for client documents go to named people. Pub 4557’s checklist asks firms to refer “requests for customer information to designated individuals who have been trained in how your company safeguards personal data.” A firm that says who those people are stops the stray request going to a seasonal hire.

Rule two is the one that changes the most. Every handoff that used to be a forward is now a link. The file stays in one place, however many people work on the return.

A file name that says which version it is

Client file names are no help. “Scan_0012.pdf” and “K1 (2).pdf” are typical. Rename on filing, the same way across the firm. One pattern is enough:

Client_Year_Form_Issuer_Version_Received-date

The version and the received date carry the job. When a reviewer opens the folder, the current version is the highest number. The date says which email to read for the note that came with it. Year-month-day dates sort in order, so the folder lists itself.

Auto-filing attachments into document management

Most firms want this step to happen without a person. There are three common ways to set it up:

• The practice management or portal tool files it. Many offer a per-client email address or an add-in that sends a message and its attachments to the client’s folder.
• A mail rule or flow saves attachments. Microsoft’s Power Automate gallery, for example, lists a template called “Save email attachments to a SharePoint library and receive a notification” (checked October 4, 2026). Flows like it match on sender or subject words and save what they find.
• A person files on arrival, with the naming pattern above.

Automation does the moving well. It does the deciding badly. Here’s where it slips at a firm:

• The match is on the wrong thing. A rule that files by sender files the bookkeeper’s forward under the bookkeeper, not the client. A rule that files by subject files “Re: lunch” with a W-2 inside under nothing.
• It files every copy. The client’s original and three internal forwards land as four files. The duplication you were trying to end now lives in the folder.
• It can’t tell v1 from v2. A corrected 1099 and the original often share a file name. Automation saves both, under names that don’t say which stands.
• Links aren’t files. A Drive or Dropbox link in the message saves as nothing. Someone has to download it.

The arrangement that holds up is automation for the moving and a person for the naming. The rule drops files into a “to file” folder per client. The preparer renames and marks the current version once a day. It’s a few minutes, and the reviewer never opens the wrong K-1.

Whichever way you file, check the vendor. The Safeguards Rule at 16 CFR 314.4(f) asks you to oversee service providers that hold customer information. A tool that reads your mail and copies its attachments is one of them.

When the attachment comes from a stranger

At a firm, the person who opens an attachment may not be the person who’d spot the scam. Staff open documents all day. That’s the job.

On February 13, 2024, the IRS warned tax professionals about a “new client” email scam:

The scammer emails a tax professional to ask for help with their taxes. This phishing email has a malicious link or attachment that the scammer claims is their tax information.

Pub 4557’s answer is short: “Never open or download attachments from unknown senders, including potential clients; make contact first by phone, for example.”

For a firm, write that into the intake process:

• A first email from someone who isn’t a client gets a reply pointing them to your portal or a phone call. Nobody opens what they attached.
• A known client who suddenly sends a link to “view documents” gets a phone call before anyone clicks.
• Mail asking for a password, an EFIN or a login gets checked by phone, whoever it seems to come from.
• Anyone who opened something and then thought better of it tells the person who runs the security plan, the same day.

Point helps at the front of that list. Messages that look built to manipulate whatever reads them are held in quarantine before they reach anyone’s feed, and kept away from the AI. How that works is in keeping suspicious mail away from AI.

What your security plan should say about attachments

Every firm that prepares returns needs a written information security plan. The IRS publishes a template, Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice. Most plans say a lot about laptops and passwords and very little about mail. Five lines cover attachments:

1. How files go out. Portal by default, an encrypted file when the portal doesn’t fit, never a plain attachment for anything on the table above.
2. How files come in. Clients are pointed to the portal. Anything that arrives by email is filed to the client folder and handled under the house rule.
3. Who handles requests for client data. The named people, as Pub 4557 suggests.
4. How long attachments stay in mail. The Safeguards Rule at 16 CFR 314.4(c)(6) asks for procedures to dispose of customer information “no later than two years after the last date the information is used,” with exceptions the rule sets out. Your mail is customer information too. How long a firm keeps mail, and the notices around it, is a policy question of its own.
5. Who can see what was opened. Section 314.4(c)(8) asks you to “monitor and log the activity of authorized users.” A portal’s access log does this for files. Your mail provider’s audit log does it for mailboxes.

Training belongs in the plan as well. The checklist in Pub 4557 counts trained, designated people as a safeguard, and the person who opens attachments all day is the one to train first.

Sending an invoice by email

An invoice is one of the few documents that goes out as a plain attachment. It carries your fees, not a client’s tax data. People who search “how to write an email with an invoice attached” usually want two things: what to put in it, and a version they can copy.

Put these in the message, not only the PDF:

• Who it’s for, by the name on the engagement letter
• The invoice number and the period or work it covers
• The amount and the due date
• How to pay, with a link if you take online payment
• One line saying your payment details won’t change by email

That last line matters more each year. A fake “updated bank details” email is a common fraud, and a client who’s been told to call you first is hard to fool.

Here’s a version to copy:

Subject: Okafor Holdings, invoice 2026-114, 2025 returns

Hi Dana,

Your invoice for preparing the 2025 business and personal returns is attached. It’s invoice 2026-114, for $3,850, due by May 15.

You can pay online here: [payment link]. If you’d rather pay by check or transfer, the details are on the invoice.

Our payment details never change by email. If you get a message saying they have, please call us at 555-0142 before you pay anything.

Thank you for trusting us with this year’s returns.

Priya

At a firm, send invoices from one address, in one format. A client who gets invoices from three people, in three styles, can’t tell a real one from a fake. Name the PDF the way the subject line reads, so it’s findable in their mail and yours.

A signature that tells clients where documents go

A good professional signature is short and useful. For a CPA firm it can also do a job most signatures don’t. It tells every client, on every email, how to send you a document.

What to include:

• Name, and credential where your state board allows it to be used this way
• Title, and the firm name as registered
• A direct phone number
• The portal link, with one line about using it
• The firm’s website

What to leave out:

• Images that carry the only copy of your phone number or address
• Quotes, slogans and badges
• A wall of legal text. A short confidentiality line is common. It doesn’t protect anything the email itself carries.

An example:

Priya Nair, CPA Senior manager, Hollis & Nair CPAs 555-0142 direct Send documents securely through our portal: portal.hollisnair.com We’ll never ask for tax documents or payment changes by plain email.

The last two lines do more for the firm’s security than any filter. Every client reads them dozens of times a year. Use one signature across the firm, so the portal line appears on every email anyone sends. Your state board’s rules on firm names and the CPA title apply to a signature the same way they apply to letterhead.

How Point keeps track of the files in a firm’s mail

Point takes the hunt out of attachments, so the question “which version did they send?” has a quick answer.

The files gather in one list. Point’s Documents list collects the attachments that matter from your mail as they arrive, named and dated. There are no folders to set up. The client’s February K-1 and the March one sit one line apart.

Each file keeps its thread. One click opens a file’s card. You see a preview, its size and the thread it came in on. One more click opens that thread, so the note above the attachment is right there: “this replaces the one from February.”

You can ask a file a question. “What’s box 1 on the corrected Ridgeline K-1?” comes back as an answer, with a link to the file it was read from. You check the source, then the return. More on that is in getting the answer out of an attachment.

Suspicious attachments wait in quarantine. Point holds hostile-looking mail away from your feed and away from the AI. It waits there until someone reviews it.

A locked message stays locked. When you need to send something sensitive inside Point, you can lock it. Point carries it sealed and can’t read it. So there’s no summary and no task pulled from it.

Filing the working copy into your document system and naming the current version stay with your people. Point keeps every attachment findable from the mail side, tied to the message that explains it. Whether software should read client documents at all is in is AI safe with client financial data. The benefits page lists the rest of what Point handles for a firm.

When another tool fits better

If every client already uploads to your portal, your mail holds notices, not documents. The portal and its folder structure are where the version question gets answered, and that’s the right place for it.

The same is true if your practice management tool already files each email and its attachments to the client record. Point adds the quick search and the questions, but the record of truth is already in place.

Point helps most where documents still arrive by email, from clients who pick a person instead of a portal. That’s still most firms, most Februaries.

Common questions

Is it safe for CPA firms to send tax documents by email?

Not as a plain attachment. The IRS asks for password-protected, encrypted files when a preparer must email them, or a secure file transfer in their place. Federal rules require a firm to encrypt client data when it travels over outside networks. Use your portal for returns and source documents, and plain email for the message saying they’re ready.

Can clients email us their W-2s and 1099s?

They can, and some will. Pub 4557 asks firms to caution clients against sending sensitive data by email, so point them to the portal in your signature and your engagement letter. When a document does arrive by email, file it to the client folder that day and leave the email where it is.

How do we know which version of a document is current?

Make it one person’s call, usually the preparer on the engagement. Keep every version in the client folder, with a version number and the date it arrived in the file name. Mark the older one as replaced instead of deleting it.

How do I write an email with an invoice attached?

Say who it’s for, the invoice number, the work it covers, the amount and the due date in the email itself. Add how to pay and a line saying your payment details never change by email. Use a subject line that names the client and the invoice number, so it’s easy to find later.

What is a good professional email signature for a CPA?

Name and credential, title, firm name, a direct phone number and your website. For a CPA firm, add the portal link and a line saying you never ask for tax documents by plain email. Keep it to five or six lines, in text rather than an image, and use one version across the firm.

Should we auto-file email attachments into our document management system?

Yes for the moving, with a person for the naming. Rules and practice tools save attachments to client folders well. They don’t tell a corrected form from the original, and they file every forwarded copy. Have them drop files into a “to file” folder that the preparer renames once a day.