Cyber Security & Managed IT for Perth Accounting Firms

What We See in Perth Accounting Firms Environments

FAQ

Why Perth accounting firms are a deliberate target, not a random one

An accounting or professional services practice in Perth holds the exact combination criminals look for: live ATO and Tax Agent Portal credentials, client TFNs and bank details, signed engagement letters, and a calendar full of payment-related conversations. A four-partner firm in West Perth or a financial planning office in Subiaco is not collateral damage in a broad attack. It is the destination. Attackers know a practice that loses access during the lead-up to the October tax deadline or the BAS quarter cannot simply down tools for a week.

The most common entry point is not dramatic. A staff member reuses a password that already appeared in a known breach, or clicks a "shared document" link that mimics Xero, MYOB, or the portal login. From there the attacker sits quietly inside a mailbox, reads how the firm talks to clients, and waits. The damage starts when they finally act on what they have learned.

What actually goes wrong, and how it unfolds

The scenario WA practices keep walking into is invoice and trust-account fraud built from a compromised mailbox. A bookkeeper's account is quietly accessed. The attacker watches a genuine client conversation about settlement funds or a year-end fee, then sends a follow-up from the real account: "We've changed banks, please use the new account below." Because it comes from the firm's actual address, in the firm's actual wording, the client pays. The money is gone before anyone notices, and the firm wears the trust damage even when it wasn't strictly at fault.

Here is what it costs a 5-50 person practice, without a single dollar figure attached:

• Lost billable days across partners and staff during the worst possible window, while client work stalls.
• Mandatory breach reporting. If TFNs or client financial records are exposed, you are likely into Notifiable Data Breaches obligations under the Privacy Act, plus awkward conversations with every affected client.
• Locked portal access. If ATO or software credentials are compromised, lodgements and client work freeze until identities are reset and re-verified.
• Reputation in a referral market. Perth professional services runs on word of mouth. One mishandled breach travels through a suburb's business community fast.

How COREWEST shuts these specific gaps, Microsoft-first

We secure the place the attack actually happens: the mailbox and the identity behind it. Everything below is built on the Microsoft 365 stack your firm most likely already pays for, configured properly rather than left on defaults.

• Entra ID with Conditional Access — sign-ins are checked against device, location, and risk. A login to a partner's account from outside Australia at 2am is challenged or blocked, not waved through because the password was correct.
• Defender for Office 365 — inspects links and attachments at delivery and rewrites them, so the fake Xero or portal login gets caught before a staff member ever clicks.
• SPF, DKIM and DMARC — locks down your domain so a fraudster can't spoof your firm's address to send a "we've changed bank details" email to your clients.
• Microsoft Defender with Intune — every laptop and phone touching client data is monitored and enforced, including staff using personal devices from home in the Hills or down in Mandurah.
• Microsoft Purview — labels and tracks where TFNs and client financial records live, so you can answer "what was actually exposed" with evidence instead of guesswork.
• Microsoft 365 Backup — recoverable copies of mailboxes, SharePoint and OneDrive, so a ransomware event or a deleted-everything mistake is a restore, not a closure.

The compliance reality, and a practical first step

For accounting and professional services, security is not separate from your obligations. The Tax Practitioners Board expects registered agents to take reasonable care protecting client information. The Privacy Act and the Notifiable Data Breaches scheme apply the moment client financial data is exposed. AFSL holders carry cyber as a board-level risk. And almost every cyber insurance renewal now asks whether you enforce MFA, how you back up, and how you control access — answer those honestly and most firms find they can't, which is exactly the gap an insurer leans on to reduce a payout. We document these controls in plain English so your renewal and your TPB position both stand up.

The honest starting point is finding out what's already exposed. The Free Cyber Risk Snapshot is a 30-minute external check that shows whether your staff passwords sit in known breach databases, whether your email can be spoofed, and where your client data is most at risk — in language a partner can act on, not a technician's report. Book it at calendly.com/corewest/30min.