The Payment That Never Arrived: Tax Season, AI Phishing, and the MFA Decision That Cost
The attacks aren't limited to individual taxpayers, either. Microsoft reported tax-themed phishing campaigns throughout the 2026 filing season, including one in February that sent fake W-2 documents and malicious QR codes to roughly 100 organizations across manufacturing, retail, and healthcare. Payroll access, direct-deposit changes, and invoice payments are all on the target list.
AI Has Changed What a Phishing Email Looks Like
For years, security training taught people to look for red flags: bad grammar, odd formatting, a generic "Dear Customer." Those cues are disappearing.
A large field study presented at the USENIX Security Symposium in August 2026 tested phishing on more than 7,700 participants. Emails that AI personalized automatically drew about 10% click rates, compared with under 4% for generic messages, and each tailored email cost roughly three cents to produce. Every participant had already completed security training and knew they were part of a study. Real-world results are likely worse.
Separate research from BYU found that AI-written scam messages matched or beat human-written ones about 80% of the time, and participants could only tell AI from human writing about half the time. In other words, guessing.
The FBI's 2025 Internet Crime Report backs this up in dollars. Business email compromise (BEC) generated more than $3 billion in reported losses across nearly 25,000 complaints, and for the first time the report included a dedicated section on AI-enabled fraud.
The takeaway isn't that training is useless. It's that training alone isn't enough anymore. You have to assume someone, eventually, will click, and build your defenses so that one click doesn't become a disaster.
The Payment That Never Arrived
As part of our standard security baseline, LBT Technology Group requires multi-factor authentication (MFA) on every account and requires administrative privileges to be removed from the accounts people use every day for email and browsing. Admin rights belong on separate, dedicated accounts used only when administrative work is needed.
One client chose not to enforce those requirements. MFA felt like an inconvenience, and keeping admin rights on a daily account was easier. We documented our recommendation, and they accepted the risk.
A few weeks later, one of those daily-use accounts, the one with admin rights and no MFA, was phished. The email was convincing enough that the user entered their credentials without a second thought. With no MFA prompt standing in the way, the attacker simply signed in.
What happened next is what makes BEC so dangerous. The attacker didn't encrypt files or announce themselves. They stayed quiet and used the real mailbox to email the company's actual customers, informing them that the company's bank information had changed and that all payments should be remitted to a new account. The messages came from a trusted address, referenced a real business relationship, and looked exactly like a routine billing update.
Because the email came from a trusted partner, one customer didn't make a follow-up phone call to verify the change. They updated their records and paid an outstanding invoice using the new account information, sending the money straight to the attacker.
Nobody inside the company noticed. The breach was only discovered later, when the business tried to collect on that invoice and was told it had already been paid. By then, the money was gone.
The response was immediate. Leadership sent an emergency email to all employees directing them to add MFA to their accounts right away. The company then scheduled a meeting to enroll in LBT Technology Group's flagship Managed Risk & Support Protection (MRSP) program.
The hardest part of this story is that every step of it was preventable. MFA would likely have stopped the sign-in. Removing admin rights from the daily account would have limited what the attacker could reach. Both controls had already been recommended.
What Happens If You Wait
When businesses put off securing their systems, the consequences rarely stop at one bad day. A single compromised account can lead to:
- Direct financial loss from redirected customer payments, diverted payroll, or wire transfers that are rarely recovered.
- Damaged customer trust, because your customers were the ones targeted, and from your email address.
- Exposure of sensitive data, including W-2s, Social Security numbers, and banking details, which can trigger breach notification obligations.
- Downtime and recovery costs for investigation, cleanup, and legal guidance.
- Insurance problems, since many cyber insurance carriers now expect MFA and may question or limit claims when it's missing.
Microsoft has long reported that MFA blocks well over 99% of automated account-compromise attacks. Few security controls offer that much protection for so little cost.
Six Steps to Take Before Tax Season
- Enforce MFA on every account. No exceptions for executives, shared mailboxes, or "just this one."
- Separate admin accounts from daily accounts. Email and web browsing should never happen on an account with administrative rights.
- Train and test your people. Ongoing security awareness training with realistic, AI-era phishing simulations keeps skills current.
- Verify money requests by phone. Confirm any change to bank details or payment instructions using a phone number you already have on file, not one in the email.
- Monitor sign-ins and mailbox rules. Watch for logins from unusual locations, new forwarding rules, and sudden bursts of outgoing mail.
- Have an incident response plan ready. Know who to call, what to lock down, and how you'll notify customers if something goes wrong.
Don't Wait for Your Own Story
Our client learned these lessons the expensive way. You don't have to. LBT Technology Group's Managed Risk & Support Protection (MRSP) program puts these protections under active management, so security isn't something your team has to remember to do during the busiest season of the year.
Tax season is coming either way. Contact LBT Technology Group, LLC today to schedule a security review and learn how MRSP can help protect your business before the first W-2 goes out.
Related Resources
- CPA Practice Advisor — IRS flags phishing, impersonation in 2026 Dirty Dozen (March 18, 2026)
- ERP Today — Tax Season Scams 2026: How IRS Phishing, Fake Tax Messages, and AI Fraud Threaten Businesses (April 14, 2026)
- BIFOLD / TU Berlin — AI Goes Phishing (USENIX Security 2026 study)
- Phishing Tackle — Spear Phishing Just Got Automated, and Cheap (August 20, 2026)
- KSL — AI is making spear phishing scams more successful, BYU research finds (September 20, 2026)
- FBI IC3 — 2025 Internet Crime Report
- Techlicious — FBI Report: Online Scams Stole $20.9 Billion from Americans in 2025 (April 7, 2026)
