Protecting Your myIR Account and Client Information: 7 Critical Security Measures for Businesses in 2026

Protecting your myIR account and client information should be a priority for every New Zealand business, accountant, tax adviser, and organisation that accesses Inland Revenue’s digital services.

Protecting your myIR account and client information has become a critical governance, cybersecurity, and compliance responsibility for New Zealand businesses, accountants, bookkeepers, and tax advisers.

As organisations increasingly rely on Inland Revenue’s digital services to manage tax obligations, payroll reporting, GST compliance, and client records, the consequences of a cyber security breach can be significant.

A compromised myIR account may expose sensitive financial information, business tax records, employee data, and confidential client information. Businesses should therefore treat myIR security as an important component of their overall risk management framework.

Why Protecting Your myIR Account and Client Information Matters

myIR provides access to a wide range of business and tax information, including:

• GST accounts and filings.
• PAYE obligations.
• Income tax records.
• Tax payment history.
• Business correspondence.
• Bank account information.
• Client tax records.
• Payroll-related information.

If unauthorised users gain access to a business myIR account, the resulting financial, operational, and reputational impacts may be substantial.

Cybersecurity Risks Continue to Grow

Cyber criminals frequently target government portals, financial systems, and tax accounts because they contain valuable personal and business information.

Modern cyber threats may include:

• Credential theft.
• Phishing attacks.
• Business email compromise.
• Social engineering.
• Malware attacks.
• Unauthorised account access.

Businesses should adopt a proactive approach to cybersecurity rather than waiting for an incident to occur.

7 Critical Security Measures for Businesses

1. Enable Two-Step Verification (2SV)

Two-step verification provides an additional layer of protection beyond passwords.

One of the most effective ways of protecting your myIR account and client information is enabling two-step verification for all authorised users.

Users must provide:

• A password.
• A verification code from a trusted device.

Even if login credentials become compromised, two-step verification can significantly reduce the likelihood of unauthorised access.

2. Use Strong and Unique Passwords

Weak passwords remain one of the most common causes of security incidents.

Businesses should:

• Use long passphrases.
• Avoid predictable passwords.
• Implement password management policies.
• Use unique credentials for each platform.

Password reuse across multiple services should be avoided.

3. Review User Access Permissions Regularly

Businesses should regularly review who has access to their myIR accounts.

Key considerations include:

• Current employees.
• Contractors.
• External advisers.
• Tax agents.
• Authorised representatives.

Access should only be granted where there is a legitimate business need.

4. Remove Former Employee Access Immediately

One of the most overlooked security risks occurs when former employees retain access to systems after leaving the organisation.

Businesses should ensure that:

• User accounts are removed promptly.
• Access permissions are reviewed after staff departures.
• Security procedures are documented.

5. Train Staff to Identify Phishing Scams

Phishing remains one of the most effective methods used by cyber criminals.

Common warning signs include:

• Unexpected emails.
• Urgent requests for action.
• Requests for passwords.
• Suspicious links.
• Fake refund notifications.

Regular staff training can significantly reduce the risk of successful phishing attacks.

6. Monitor Account Activity Regularly

Regular monitoring helps identify unusual activity before significant damage occurs.

Businesses should review:

• Login activity.
• Account changes.
• Tax assessments.
• Payment activity.
• New correspondence.

Unexpected activity should be investigated immediately.

7. Keep Contact Information Current

Updated contact details help ensure that important security alerts and verification requests reach the correct people.

Businesses should periodically verify:

• Email addresses.
• Mobile numbers.
• Authorised contacts.
• Business details.

Protecting Client Information

For accounting firms, tax advisers, and bookkeepers, protecting client information extends beyond securing a single myIR account.

Protecting your myIR account and client information requires a combination of cybersecurity policies, staff training, governance controls, and ongoing monitoring.

Client information may include:

• Tax returns.
• Financial statements.
• Payroll information.
• Business records.
• Personal information.

Strong internal controls and information security policies are essential to maintaining client trust and professional standards.

Governance and Compliance Considerations

Business owners, directors, and partners should ensure cybersecurity forms part of their governance framework.

Directors and business owners should treat protecting your myIR account and client information as a core governance responsibility rather than solely an IT issue.

Good governance practices may include:

• Documented cybersecurity policies.
• Staff training programmes.
• Regular access reviews.
• Incident response planning.
• Periodic security assessments.

Cybersecurity is increasingly viewed as a business risk management issue rather than solely an IT responsibility.

Common Security Mistakes Businesses Should Avoid

Password Reuse

Using the same password across multiple platforms increases the likelihood of compromise.

Shared User Accounts

Individual user access provides stronger accountability and audit trails.

Ignoring Security Updates

Software updates often contain critical security patches.

Insufficient Staff Training

Human error remains one of the most common contributors to cybersecurity incidents.

Related DFK Orb360 Services

Businesses seeking support with governance, compliance, and risk management may find these resources helpful:

• Tax Advisory Services
• Business Advisory Services
• Contact DFK Orb360

As cyber threats continue evolving, protecting your myIR account and client information should remain a key component of every organisation’s risk management strategy.

Businesses that prioritise protecting your myIR account and client information are better positioned to reduce cyber risks, maintain compliance, and preserve stakeholder confidence.

Frequently Asked Questions

Why is myIR security important for businesses?

myIR accounts contain sensitive tax records, GST information, payroll data, and client information. A security breach could expose confidential business information and create compliance risks.

Should businesses enable two-step verification?

Yes. Two-step verification provides an additional layer of protection and is one of the most effective ways to reduce the risk of unauthorised account access.

How often should user access permissions be reviewed?

Businesses should review user access permissions regularly and immediately after staff departures, role changes, or organisational restructuring.

What is the biggest cybersecurity risk for accounting firms?

Phishing attacks remain one of the most common threats because they target employees and attempt to gain access to sensitive systems through deception.

What should businesses do if they suspect unauthorised account access?

Businesses should immediately update passwords, review access permissions, enable security controls, investigate account activity, and seek professional advice where necessary.

External Resources

• myIR Help and Security Information
• Inland Revenue New Zealand
• CERT NZ Cyber Security Guidance
• Own Your Online Security Resources

Key Takeaway

Protecting your myIR account and client information is no longer simply an IT issue—it is a business governance, compliance, and risk management priority.

By implementing strong passwords, two-step verification, staff training, access controls, and regular security reviews, businesses can significantly reduce cybersecurity risks while protecting valuable financial and client information.

As digital tax services continue to evolve, organisations that prioritise cybersecurity and governance will be better positioned to manage risk and maintain stakeholder confidence.