“Your Accountant Made a Mistake” Scam: The Fake Tax Correction Trap

It starts with a message that feels routine, almost boring.

“Your accountant made a mistake.”

Maybe it says a tax calculation was wrong. Maybe a payment was missed. Maybe your filing needs a quick correction to avoid penalties. The tone is calm, professional, and oddly familiar, like the kind of note you would expect to get during tax season or at the end of a quarter.

That is exactly why it works.

This scam is built around a simple idea: if a message sounds like it is coming from the person who already handles your finances, you are far more likely to act quickly, share sensitive information, or approve a payment without slowing down to verify.

And once the scammer has that one moment of trust, they can turn it into money.

Scam Overview

The “Your Accountant Made a Mistake” scam is a social engineering and business email compromise style operation where criminals impersonate an accountant, a bookkeeping firm, a tax preparer, or even a tax authority. Their goal is typically one of two things:

1. Redirect a payment by supplying “updated” bank details or a “corrected” invoice.
2. Steal sensitive financial information by pushing you to click a link, open a file, or fill out a form.

In many cases, the message is designed to feel like a correction to an existing, legitimate process. That design choice is not accidental. Corrections are common in accounting, and most businesses have experienced last-minute clarifications, revised invoices, updated tax forms, or changed payment instructions.

Scammers exploit that normalcy.

Why this scam feels so convincing

This is not the type of scam that relies on obvious typos or cartoonish threats. The best versions are clean, well-written, and plausible. They often include:

• Your name and job title
• Your company’s name, address, or website
• Correct vendor names or real staff names
• Real invoice numbers, payment amounts, or deadlines
• A signature block that looks like a real accountant’s email signature
• References to real-world events like “quarterly filing,” “VAT,” “W-2,” “1099,” “payroll,” or “audit”

In other words, it can look and read like a message you should take seriously.

Common angles used in the message

Scammers rotate through several storylines depending on who they are targeting (individual taxpayers, small businesses, finance departments, or executives). Common versions include claims such as:

• A tax calculation was wrong
• A payment was missed, or a filing was incorrect
• A “corrected” invoice or updated bank details need to be used
• Penalties or audits may follow if action is not taken quickly
• The message is “from your accountant” or from a tax authority “on their behalf”

Sometimes it is framed as a helpful fix:

• “I noticed an error before submission, please confirm these details.”
• “We need your approval so we can correct the filing today.”
• “Here is the revised invoice with correct remittance details.”

Sometimes it is framed as urgent risk:

• “If we do not act today, penalties may apply.”
• “This needs confirmation immediately to avoid an audit trigger.”
• “This correction must be submitted within 24 hours.”

The urgency is the lever. The goal is to compress your decision-making window so you do not verify.

Where the scam shows up

Most people encounter this scam via email, but criminals increasingly use multiple channels to raise credibility or apply pressure:

• Email (most common)
• Text message (especially for executives, owners, and contractors)
• Phone calls (as a follow-up to the email)
• Messaging apps (in organizations that use WhatsApp, Teams, or similar tools)

A scammer may send an email and then call 30 minutes later pretending to “follow up” to ensure it is handled.

What the scammer wants

Even though the message looks like a simple correction, the underlying objective is usually one of these:

1) Payment redirection (invoice fraud)

This is the classic business version. The scammer wants you to send money to their bank account by changing payment instructions.

The message may include:

• A revised invoice
• New bank routing details
• A request to update payment details “for future invoices”
• A reason for the change (bank merger, audit, account closure, new payment processor)

Sometimes they will claim the invoice amount stays the same, only the bank information changed. That makes it feel less suspicious. The invoice looks real. The request looks routine. The result is catastrophic.

2) Credential theft and account takeover

The scammer wants access to email, payroll, accounting software, or banking portals. They do this by:

• Sending a link to a fake sign-in page
• Attaching a file that prompts you to “log in” or “enable editing”
• Asking you to fill out a form with sensitive details

Once they steal credentials, they may:

• Access past invoices and email threads
• Send more convincing messages from your actual account
• Change real vendor bank details inside your accounting system
• Attempt payroll diversions or tax refund theft

3) Data harvesting for later fraud

Sometimes the first message is not the final strike. It is reconnaissance. If you reply, the scammer learns:

• Which addresses are active
• Who processes payments
• Your internal workflow
• How quickly your team responds
• Which vendor names you use
• Which accounting platform you use

That information helps them craft a later, far more damaging attack.

How scammers get the “real” details

A question many victims ask is, “How did they know our accountant’s name or our vendor relationships?”

In practice, scammers gather details from a mix of sources:

• Public websites (company pages, staff pages, contact forms)
• Social media (LinkedIn job titles and responsibilities)
• Data broker leaks and past breaches
• Previously compromised email accounts
• Vendor compromise (a vendor’s email gets hacked and used to contact clients)
• Spoofing and lookalike domains that mimic a real firm’s address

In higher-end cases, scammers do not guess. They read. They already have access to someone’s mailbox and are watching legitimate conversations. That is why the scam can include perfect context.

Red flags that often appear in this scam

Even very polished versions tend to have subtle tells. Here are common warning signs you can train yourself and your team to spot:

• The sender’s email address is slightly off (a missing letter, extra word, or different domain)
• The reply-to address differs from the from address
• The message pushes urgency and discourages verification
• Payment instructions changed unexpectedly
• The message asks you to bypass normal approval steps
• The link goes to a non-standard domain or a generic file host
• The attachment name is vague or mismatched (for example “InvoiceCorrection.pdf” without a known invoice number)
• The message is unusually short for a real accountant-client correction
• The tone is too generic or does not match the accountant’s typical style
• The request involves sensitive data that should never be emailed (bank login, full SSN, passwords)

A single red flag does not always prove it is a scam, but any payment change request should trigger a verification step every time.

Why this scam is so dangerous for businesses and individuals

The damage from this scam can be severe because it hits two high-trust areas at once: money and authority.

For businesses, the consequences can include:

• Direct financial loss from wire transfers or ACH payments
• Compromised payroll systems and employee data exposure
• Unauthorized vendor changes inside accounting platforms
• Ongoing fraud as scammers reuse stolen information
• Legal and compliance issues, depending on what data was exposed
• Operational disruption during incident response

For individuals, it can involve:

• Tax identity theft
• Stolen tax refunds
• Compromised banking access
• Credit fraud using harvested personal details

The scam also has a psychological advantage: people feel embarrassed because the message looks so reasonable. That embarrassment can delay reporting, which gives the scammer more time.

If there is one takeaway from the overview, it is this:

This scam succeeds when people treat a “correction” as routine instead of treating it as a high-risk financial change.

How The Scam Works

Below is a detailed, step-by-step breakdown of how the “Your Accountant Made a Mistake” scam is typically executed, from setup to theft. Not every case includes every step, but most follow this general pattern.

Step 1: Target selection and research

The scammer identifies a person or organization likely to handle payments or tax-related decisions.

Common targets include:

• Business owners
• CFOs, controllers, bookkeepers
• Accounts payable staff
• HR and payroll administrators
• Contractors and freelancers
• Individuals during tax season

Then they gather basic information such as:

• Names, roles, and email formats
• Company vendors and payment timelines
• Names of accounting firms or tax preparers
• Current filing periods or upcoming deadlines

Even minimal public information can be enough to craft a believable first message.

Step 2: Impersonation setup

The scammer sets up the “identity” they will use to contact you.

This typically looks like one of the following:

Lookalike domain impersonation

They register a domain that looks close to the real one, such as:

• Using .net instead of .com
• Swapping letters (like “rn” for “m”)
• Adding a word like “support” or “services”

To a busy reader, it looks legitimate.

Display name spoofing

The email might show the accountant’s real name as the display name, even if the underlying email address is not theirs. Many people read the display name and stop there.

Compromised real email account

In more advanced cases, the scammer is sending from a real, compromised email account belonging to the accountant, the bookkeeping firm, or a vendor. This is the hardest to detect because the address is correct and email threading may look normal.

Step 3: The initial message lands

The scam message arrives and tries to create immediate credibility.

It often includes:

• A calm, professional tone
• A “mistake” explanation that sounds plausible
• A quick action request
• A file or link that looks like routine documentation

It may say something like:

• “I found an error in the tax calculation and need your confirmation.”
• “Please use the corrected invoice attached.”
• “We need to update bank details for the next payment run.”
• “This needs approval today to avoid penalties.”

The scammer is setting the stage for either a payment change or a credential grab.

Step 4: Urgency and authority get layered in

Once you engage, the scammer leans on two psychological pressures:

• Authority: accountants and tax authorities are perceived as experts. People defer.
• Urgency: the threat of penalties, audits, or missed deadlines creates anxiety.

They may add:

• A looming deadline
• A mention of an audit risk
• A warning about penalties or interest
• A claim that “submission is scheduled for today”

The goal is to keep you moving.

Step 5A: Payment redirection path

If the scammer’s objective is money, the next step is to get you to send funds to a new account.

This often happens in one of these ways:

“Corrected invoice” with new remittance details

You receive a PDF invoice that looks real. The amount is plausible. The vendor name is correct. But the bank details are the scammer’s.

If you pay it, the money is gone.

“Updated bank details” for a known vendor

The scammer claims a vendor updated their bank information and wants you to update it in your system.

If you update it, then the next legitimate payment goes to the scammer.

“Deposit” or “penalty prevention” payment

The scammer invents a payment that feels like damage control:

• A deposit to avoid a penalty
• A fee to correct a filing
• A late charge that must be paid immediately

This can be especially effective against individuals, who may not know typical tax workflows.

Step 5B: Credential theft path

If the scammer’s objective is account access, they will push you toward a link, portal, or form.

Common lures include:

Fake “secure portal” login

They claim your accountant needs you to log in to review the correction. The link goes to a fake sign-in page designed to steal your credentials.

Fake document signature request

They ask you to “review and sign” a corrected filing. The signature platform is fake or the file leads to a credential prompt.

Malicious attachment

The attachment may be designed to:

• Harvest credentials
• Install malware
• Trick you into enabling macros or editing

Once they have credentials, the scam often escalates quickly.

Step 5: Escalation after access

If the scammer gets into an inbox or platform, they may:

• Search for invoices, payment schedules, and vendor details
• Forward rules to hide future messages
• Insert themselves into real conversations
• Send messages from your account to others
• Change vendor bank details in accounting software
• Request payroll changes or employee data

This is where a simple “accountant mistake” message turns into a full-scale compromise.

Step 6: Cover and persistence

Scammers often try to delay detection.

They may:

• Ask you not to call due to “being in meetings”
• Push email-only communication
• Use plausible explanations for delays
• Send follow-ups that sound like normal accounting workflows

If money was sent, they may ask for additional payments, claiming the correction was only partial.

Step 7: The victim discovers the problem

Victims usually discover the fraud when:

• A vendor reports they never received payment
• A bank flags unusual transfers
• A user cannot log into an account
• An accountant says they never sent that message
• Payroll or tax accounts show changes

By then, the scammer may already have moved on, and recovery becomes a race against time.

Example Scam Messages

These examples are intentionally sanitized and use placeholders like [Company Name] and [link]. Real scams often look similar, but may include your actual details.

Use these to train your eye for patterns, not to “compare word-for-word.”

Example 1: “Corrected invoice” email

Subject: Correction needed: invoice for [Month]

Hi [Name],
I spotted a mistake in the tax calculation tied to your last invoice.

Please use the corrected invoice attached and arrange payment today to avoid penalties.
Let me know once it is done so I can finalize the filing.

Thanks,
[Accountant Name]
[Accounting Firm]

Red flags to notice

• Sudden urgency tied to “penalties”
• “Pay today” pressure
• Attachment you were not expecting
• No clear reference to a prior agreed workflow

What to do instead
Call your accountant using a known number and confirm whether a corrected invoice is real.

Example 2: “Updated bank details” email

Subject: Important: updated remittance details

Hello [Name],
We need to update our bank information for future payments. Please see the updated details below and confirm once your records are updated.

New bank: [Bank Name]
Account: [Account Number]
Routing: [Routing]

This change is effective immediately. Please do not use the previous account.

Regards,
[Accountant Name]

Red flags to notice

• Bank details changed “effective immediately”
• Requests that you update records without verification
• “Do not use the previous account” pressure

What to do instead
Verify via phone with a trusted contact and confirm using a second channel.

Example 3: “Missed filing” pressure email

Subject: Action required today: filing issue

Hi [Name],
There was an error in your filing and we need to correct it today. If we miss the submission window, you may be flagged for review.

Please confirm the following details:

• Full legal name
• Address
• Tax ID
• Bank used for payments

Reply ASAP so I can proceed.

Thanks,
[Accountant Name]

Red flags to notice

• Requests for sensitive identifiers by email
• Threat language like “flagged for review”
• “Reply ASAP” pressure

What to do instead
Do not email sensitive IDs. Verify with your accountant and use a known secure method.

Example 4: “Secure portal” credential phishing

Subject: Please review the correction in portal

Hi [Name],
I uploaded the corrected documents to our secure portal. Please log in and approve so we can finalize.

Access here: [link]

Thank you,
[Accountant Name]

Red flags to notice

• Unfamiliar portal link
• “Approve” language tied to urgency
• You are pushed to click instead of navigating normally

What to do instead
Type the portal address manually or use a bookmarked link you already trust.

Example 5: “CEO-style” payment authorization request (common in businesses)

Subject: Quick confirmation needed

Hi [Name],
We need to correct the invoice payment. Please process $4,850 to the updated account today. This is time-sensitive.

Send confirmation once completed.

[Name]

Red flags to notice

• A sudden request for a specific $ amount
• No invoice context, no purchase order reference
• Push to bypass normal approvals

What to do instead
Stop and verify internally. Confirm using your standard approval workflow.

Example 6: Text message version

Hi [Name], this is [Accountant Name]. Your filing has an error and we need confirmation now. Please open [link] and verify details to avoid penalties.

Red flags to notice

• Accountant contact via text if that is not your normal channel
• Link plus urgency
• “Avoid penalties” pressure

What to do instead
Do not open the link. Call your accountant using the number you already have.

Example 7: Text message with payment change

Payment details changed for your next invoice. Please send $2,190 to the new bank today. I emailed the corrected invoice.

Red flags to notice

• Payment request via text
• “New bank today” urgency
• Attempts to move you fast

What to do instead
Freeze the payment and verify through a known channel.

Example 8: Phone voicemail script (follow-up pressure)

Hi, this is [Accountant Name]. Please call me back urgently about a mistake in your tax filing. We have a short window to fix it today. If you cannot reach me, respond to the email I sent and confirm the updated details.

Red flags to notice

• “Short window today” urgency
• Directs you back to email instead of a trusted workflow
• No verifiable reference details

What to do instead
Call back using a known number from your records, not the voicemail callback number.

What To Do If You Have Fallen Victim to This Scam

If you think you clicked, replied, shared information, or sent money, the priority is speed and containment. The steps below are designed to be practical and calming, even if you are dealing with a stressful situation.

1) Stop all payments connected to the request immediately

• Pause the payment run if you are in the middle of processing it
• Do not send additional funds “to fix it”
• Do not continue emailing the suspected scammer

If you paid by wire or ACH, time matters. The sooner you act, the higher the chance of stopping or recalling the transfer.

2) Contact your bank or payment provider right away

Tell them you believe you were targeted by invoice fraud or payment redirection.

Ask about:

• Wire recall or reversal options
• Freezing or flagging the recipient
• Filing a fraud report internally
• Monitoring your account for additional unauthorized activity

If you have the transaction reference number, provide it. If you do not, provide date, amount, and recipient details.

3) Verify with your real accountant using a trusted method

Do not reply to the suspicious email to “check.”

Instead:

• Call the accountant using a phone number you already have on file
• Use a known portal login (typed manually, not from the email link)
• Ask if they sent the message and whether any correction is actually needed

If they did not send it, ask if they have seen similar scams targeting other clients.

4) Assume credentials may be compromised if you clicked a link or logged in

If you entered credentials on a page you reached from the message, treat that account as compromised.

Immediately:

• Change the password for that account
• Change passwords for any accounts using the same or similar password
• Enable two-factor authentication (2FA) where available
• Log out all active sessions if the platform allows it

Prioritize:

• Email accounts
• Accounting platforms
• Payroll systems
• Banking portals
• Cloud storage that may contain financial records

5) Check for mailbox rules and forwarding settings

If a business email account might be compromised, scammers often set rules that hide their activity.

Look for:

• Auto-forwarding to unknown addresses
• Rules that archive or delete messages containing words like “invoice,” “payment,” “wire,” “bank”
• Filters that route finance emails into obscure folders

Remove suspicious rules immediately.

6) Alert internal stakeholders and lock down approval workflows

If you are in a business setting, notify the right people quickly:

• Accounts payable
• Finance leadership
• IT or security team
• Payroll administrators

Then tighten controls temporarily:

• Require verbal verification for any bank detail changes
• Require dual approval for transfers above a threshold (for example $1,000 or $5,000 depending on your business)
• Implement a vendor change confirmation process

The goal is to prevent a second strike while you investigate.

7) Notify the affected vendor if payment was redirected

If you paid a “corrected invoice” or changed remittance details for a vendor, contact the real vendor using a known number.

• Tell them you suspect payment redirection fraud
• Ask for the correct bank details through an established method
• Ask whether their email was compromised

If their email account is compromised, other clients may be targeted too.

8) Preserve evidence

Even if you feel embarrassed, documentation matters.

Save:

• The original email or text message
• Full email headers if possible
• Attachments and links (do not click them again)
• Transaction details, receipts, and bank confirmations
• Screenshots of the phishing page if you have them

This evidence helps banks, internal teams, and investigators.

9) Report the incident

Reporting helps create a paper trail and may assist in recovery.

Depending on your location and situation, consider:

• Reporting to your national cybercrime reporting channel
• Filing a report with local law enforcement if money was lost
• Reporting the phishing email to your email provider
• If the scam impersonated a tax authority, report it through that authority’s scam reporting mechanism

Even if recovery is uncertain, reporting can help prevent further harm.

10) Monitor for follow-up attacks

After you respond once, scammers may try again with new angles.

Watch for:

• “Second chance” recovery scams claiming they can get your money back
• New messages pretending to be your bank or accountant
• Requests for additional verification or “urgent confirmations”
• Attempts to reset passwords on your accounts

If you were targeted successfully, you may be placed on a list of “responsive” contacts.

11) Consider a professional security review if this occurred in a business

If money was lost or credentials were entered, a quick internal review may not be enough.

A focused review can include:

• Checking endpoint security logs
• Verifying no malware was installed
• Auditing accounting software vendor changes
• Reviewing all finance-related mailbox access
• Confirming backups and recovery plans

The goal is to ensure the incident is contained, not just patched.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

The Bottom Line

The “Your Accountant Made a Mistake” scam works because it hides inside a believable, everyday scenario. Corrections happen. Deadlines are real. Accountants do send revised documents. Scammers exploit that normal rhythm to push you into acting before you verify.

The safest rule is also the simplest: any request that changes where money goes or asks for financial access must be verified outside the message itself. Call a known number. Use a trusted portal link you type manually. Confirm bank detail changes with a second method every time.

If you already engaged with the scam, focus on speed, containment, and documentation. Payments can sometimes be interrupted, accounts can be secured, and the damage can be limited quickly when you take action right away.

FAQ

What is the “Your Accountant Made a Mistake” scam?

It is an impersonation scam where someone pretends to be your accountant, bookkeeper, or a tax authority contact and claims there was an error that needs urgent fixing.

The “fix” is the trap. It is usually a push to send money to new bank details or to click a link and enter credentials.

Why do scammers use the word “mistake”?

Because it feels normal.

Most people have seen corrections in real life: revised invoices, updated filings, amended forms, recalculated tax totals. “Mistake” triggers urgency without sounding like a scam.

What do scammers usually want from victims?

Typically one of these:

• Money: you pay a “corrected” invoice to the wrong bank account.
• Access: you log into a fake portal and hand over credentials.
• Data: you share sensitive financial information that can be used for later fraud.

How can I tell if the message is fake if it includes real names and company details?

Treat “real details” as neutral. Scammers get them easily from public sources, leaks, or prior compromises.

Instead, look for risk signals like:

• A request to change bank details
• A request for urgent payment approval
• A link to “review” or “confirm” a correction
• A new attachment you did not expect
• Pressure to avoid calling and “handle by email”

Do tax authorities or accountants ever ask for passwords or banking logins?

Legitimate professionals generally do not ask for passwords, full login credentials, or sensitive access details by email or text.

If anyone asks for:

• Passwords
• One-time codes
• Full online banking credentials
• Remote access to your computer
  treat it as a major red flag.

What if I clicked the link but did not type anything?

You may still be fine, but assume elevated risk.

Do this quickly:

• Close the page
• Run a security scan on the device if possible
• Change your email password as a precaution if you are unsure
• Watch for unexpected login alerts

If you downloaded or opened an attachment, move faster and involve IT if this is a business device.

What if the email came from the accountant’s real email address?

That is possible in more serious incidents.

A real address can still be dangerous if:

• The accountant’s mailbox is compromised
• Someone is sending from within their systems
• The message is a reply inside a real thread

In that scenario, verification by phone using a known number is essential.

Can banks reverse a wire or ACH payment?

Sometimes, but it depends on timing and the payment type.

The best approach:

• Call the bank immediately
• Ask for recall or fraud intervention options
• Provide transaction details

Even if recovery is not guaranteed, fast reporting improves your chances.

What is the safest policy for businesses to prevent this?

A simple rule that stops most losses:

Any bank detail change requires out-of-band verification, every time.

That means:

• Call a known number already on file (not the email signature)
• Confirm changes with a second person
• Document who verified and when

If I replied to the scammer, does that put me at risk even if I did not pay?

Yes, it can.

Replying tells scammers:

• The address is active
• You are a real person
• You might handle money or approvals

That can lead to more targeted follow-ups.