Firm Management | August 31, 2026
How Accounting Firms Can Protect Against the Rising Threat of Vishing
Accounting and CPA firms hold exactly the kind of data that makes them an attractive target.
Cybercriminals have found a new way to bypass the security awareness that email phishing training has built over the past decade: they’re picking up the phone.
In August 2026, attackers used AI-generated voice cloning to impersonate trusted colleagues at several major investment firms, including Point72, Citadel, and Millennium Management, convincing staff to grant system access before anyone realized the voice wasn’t real, according to Bloomberg’s reporting. One firm, Two Sigma, caught the attempt before it caused damage.
This tactic, known as vishing, or voice phishing, is no longer confined to Wall Street. Accounting and CPA firms hold exactly the kind of data that makes them an attractive target: client Social Security numbers, bank account details, and tax records. Understanding how vishing works, and how to help clients recognize it, is becoming a necessary part of practice management.
