"New Client Inquiry" Spear Phishing Email (Tax Professionals)
Scam email subject line
New client inquiry — tax return assistance needed
Known variants
Referral from [name] — new client seeking tax help
Urgent: need tax professional for 2024 return
New client — prior year returns need review
Document request: 2023 and 2024 tax returns
Engagement letter request from new client
IRS Dirty Dozen 2025 and 2026 both list this as a top 12 tax scam. Cybercriminals impersonate potential new clients to trick tax professionals into opening malicious attachments that compromise their entire client database. One click exposes all clients' SSNs, tax records, and financial information.
Reports
IRS Dirty Dozen 2025 and 2026 — top 12 tax scams both years
First documented
2023
Last active
2026-03
⚠ Email subject lines can be spoofed or randomized. Scammers frequently vary subject lines to evade spam filters. This page documents a subject line pattern reported to official government agencies. It is not a factual determination about any specific sender. Contact [email protected] if you believe your organization is listed in error.
Who this email pretends to be from
What this scam email says
Tax professional receives an email from a seemingly legitimate potential new client. The email is professional in tone, mentions a referral, and asks for help with prior year tax returns. The scammer then sends a malicious attachment (PDF, Word doc, or ZIP file) claiming to contain 'prior year returns for review.' Opening the attachment installs malware that gives the attacker access to all client files and the tax software system.
What this scam email looks like
From: [email protected] Subject: New client inquiry — tax return assistance needed Hello, I was referred to your firm by a colleague. I need assistance filing my 2023 and 2024 tax returns. I have some complicated business income and am behind on filings. I have attached my prior year returns for your review. Please let me know your availability and fees. Best regards, James Morgan [ATTACHMENT: 2023_TaxDocuments.zip] ← malware
Reconstructed example for educational purposes. Not a verbatim reproduction.
Scam email subject line variants
- •New client inquiry — tax return assistance needed
- •Referral from [name] — new client seeking tax help
- •Urgent: need tax professional for 2024 return
- •Document request: 2023 and 2024 tax returns
- •Engagement letter request from new client
5 red flags
IRS Dirty Dozen 2025 and 2026: this exact scam type is #11-12 on both lists
Professional, well-written email is intentional — these are targeted, not mass-blast
Any new 'client' who quickly sends attachments before an engagement letter is suspicious
Malicious attachments may appear as PDFs or Word docs from legitimate cloud storage links
IRS warns: compromise of one tax professional account exposes all their clients' SSNs
What to do
Never open attachments from new clients before verifying identity by phone
All new clients should complete an engagement letter and provide ID before any document exchange
Report to IRS at [email protected] — subject: 'Spearphishing'
If attachment was opened: immediately contact your cybersecurity team or IT professional
Report to FBI IC3 at ic3.gov
Report this email scam
Source
IRS Dirty Dozen 2025 #12 — new client spear phishing targeting tax professionals; IRS Dirty Dozen 2026 #11 — spear phishing and malware campaigns
https://www.irs.gov/newsroom/dirty-dozen-tax-scams-for-2026-irs-reminds-taxpayers-to-watch-out-for-dangerous-threats ↗Fake sender domains used in this scam
Scammers impersonate legitimate brands using these fraudulent domains. If you received an email from one of these, it is a scam.
Related scam email patterns
People also search for
Frequently asked questions
Is an email with subject "New client inquiry — tax return assistance needed" a scam?▼
IRS Dirty Dozen 2025 and 2026 both list this as a top 12 tax scam. Cybercriminals impersonate potential new clients to trick tax professionals into opening malicious attachments that compromise their entire client database. One click exposes all clients' SSNs, tax records, and financial information.
What does this scam email say?▼
Tax professional receives an email from a seemingly legitimate potential new client. The email is professional in tone, mentions a referral, and asks for help with prior year tax returns. The scammer then sends a malicious attachment (PDF, Word doc, or ZIP file) claiming to contain 'prior year retur…
What should I do if I received this email?▼
Never open attachments from new clients before verifying identity by phone All new clients should complete an engagement letter and provide ID before any document exchange Report to IRS at [email protected] — subject: 'Spearphishing'
Who does this email pretend to be from?▼
This scam impersonates: Potential clients, Referrals, Business clients, Prior year CPA referrals. IRS Dirty Dozen 2025 and 2026: this exact scam type is #11-12 on both lists
Received a suspicious email?
Paste the email text or subject line — check it instantly, free.
Check your email →Source: IRS Dirty Dozen 2025 #12 — new client spear phishing targeting tax professionals; IRS Dirty Dozen 2026 #11 — spear phishing and malware campaigns
First documented: 2023 · Last active: 2026-03
← Scam message database