They Know When You Are Busiest
HMRC reported over 135,500 scam reports in ten months, with clear spikes around Self Assessment deadlines, year-end filings, and MTD submission windows. This is not coincidence. Attackers study the accountancy calendar the way a burglar studies when you leave for work.
The logic is simple: urgency overrides caution. When your team is processing 200 returns in the week before a deadline, an email that says "HMRC: Urgent action required for client UTR 12345678" gets clicked. The same email in August gets scrutinised. Attackers know this.
Click Any Month to See the Threat Landscape
What Lands in Your Inbox
Not all phishing is created equal. Modern attacks against accountancy practices use four distinct approaches, each designed to exploit a different trust relationship.
What These Emails Actually Look Like
Click each example to see the analysis. These are based on real attack patterns documented by HMRC, ICAEW, and incident response teams working with accountancy practices.
How to Defend Against Calendar-Aware Attacks
Most phishing training sends test emails at random times. That misses the point entirely. Send your simulated phishing during the week before the SA deadline, during year-end processing, during MTD submission windows. Test your team when they are under the same pressure that real attackers exploit. The results will be dramatically different from a simulation sent on a quiet Tuesday in August.
During high-risk months, add a mandatory verification step for any email requesting credential entry, document downloads, or payment actions. This could be as simple as a Slack message to a colleague: "Can you verify this looks legitimate?" The goal is to interrupt the urgency loop that attackers depend on. Five seconds of pause prevents five-figure losses.
In the week before each major deadline, send a 2-minute briefing to all staff: "We are entering a high-risk window. Attackers will send HMRC-themed phishing this week. Do not click links in unexpected HMRC emails. Verify via the HMRC app or by calling 0300 200 3310 directly." Repetition is not annoying. It is effective.
HMRC publishes indicators of known scam domains and phone numbers. Feed these into your email security and DNS filtering. HMRC closed down 25,000 fake websites and phone numbers in 10 months. Your email security should be blocking these domains before they reach your team's inbox, not relying on human judgment alone.
The most targeted attack against accountancy practices starts with a fake new client. Before opening any documents from an unknown contact: check Companies House for the business, find a phone number independently, call and verify the person exists and made the enquiry. This adds two minutes and eliminates the most dangerous attack vector in the sector.
The Bottom Line
Attackers are not more sophisticated than your team. They are more patient. They study your calendar, wait for the moment of maximum pressure, and strike when caution is at its lowest. The defence is not better technology alone. It is calendar-aware security: different protocols for different risk windows, timed training, and a culture that says slowing down during busy periods is not a weakness but a discipline.
They know your deadlines. Make sure your defences know them too.