Why You Should Never Send Your Tax File Number (And Other Sensitive Info) Via Email

Sharing sensitive information online is part of modern life. But when that information includes your Tax File Number (TFN), bank details, passwords or identity documents, how you send it matters.

Professionals such as accountants, lawyers, financial advisers and mortgage brokers need sensitive client data to do their work and they have obligations to protect it, but clients also share responsibility for sending information safely.

Below we explain the risks and give practical, secure ways to share sensitive information.

The risks of sharing sensitive information online:

Some of the risks associated with sharing personal information online include:

• Email interception: Email travels across multiple servers and can be intercepted if not properly secured. Public Wi‑Fi and compromised devices increase the risk.
• Business Email Compromise (BEC): Fraudsters spoof or hack legitimate email accounts to request payments or sensitive documents from clients. These scams are often convincing and costly.
• Phishing and credential theft: Malicious links or attachments in emails can steal login details or install malware, giving attackers access to other accounts.
• Poor password practices: Reusing weak passwords across services makes it easier for attackers to access multiple accounts once one password is exposed.
• Unencrypted attachments and cloud links: Sending unencrypted attachments or public cloud links can expose documents to unauthorised viewers.
• Accidental disclosure: Sending to the wrong email address, including sensitive files in broadly shared folders, or copying the wrong recipients can leak data.
• Social media oversharing: Personal details posted publicly can be used to socially engineer access to accounts or bypass security checks.

How we protect your information:

• Use of password manager: Our team use a password manager for all our personal and shared passwords.
• Multi-Factor Authentication (MFA): All our team members use two-factor authentication to access programs that store client data, even when that program is accessed through our password manager.
• Secure client portals: We use dedicated portals for document exchange, which provide encryption and audit trails.
• Staff training and privacy policies: Our team members are trained in privacy, phishing awareness and data-handling procedures.
• Breach response plans: We have processes in place to respond and notify you if a data breach occurs.

Safer ways to share sensitive information:

Use one or more of these methods instead of plain email whenever possible:

Secure client portals:

Upload documents via your adviser’s secure portal. Portals are designed for confidential file exchange, with encryption and access logs.

Note: Please verify any emails or communications you may receive from a client portal, especially if you aren’t expecting it, as many phishing or scam emails target these platforms.

At Aintree Group, we use portals such as Karbon for our accounting clients, and Aintree Custodian for our legal clients. Learn more about each portal below…

Karbon

Karbon is a secure online management system that allows you to easily and safely send, receive and store all of your accounting and tax information online!

Aintree Custodian

Aintree Custodian is a secure, digital vault or safety deposit box used to store and protect your digital assets, such as legal documents and passwords. 

It is a completely free service that Aintree Group Legal use as a tool to store and distribute your information safely. Once you are set up on Aintree Custodian so you can utilise this tool anytime you need.

End-to-end encrypted file transfer services:

Use services that advertise end-to-end encryption and a zero-knowledge approach. Confirm the service’s security claims before use.

Password-protected files with separate password delivery:

If you must email a document or sensitive information, password-protect the file (for example, a PDF or zipped folder) and send the password via a different channel such as SMS or a phone call.

Temporary secure links:

Use cloud links that expire after a short time and require a password or access restriction. Avoid public or ‘anyone with the link’ permissions.

Phone verification for payments and instructions:

For any payment requests or bank detail changes, call a verified number you already have on file before acting. Never rely solely on an email request to change payment instructions.

Use strong, unique passwords and a password manager:

Create a strong password for each service and store them in a reputable password manager; enable MFA wherever available.

Multi-Factor Authentication (MFA):

Enable MFA for your email and cloud accounts to add a second layer of defence.

Deliver highly sensitive details in person or by post when necessary:

For the most sensitive items, consider handing documents in person or using registered post.

Confirm recipient addresses:

Double-check email addresses and use address books or contact cards to reduce the risk of sending to the wrong person.

Before you send sensitive information, consider…

• Is the recipient using a secure client portal or encrypted service? If yes, use it.
• Could you password-protect the file and share the password separately?
• Do you have confirmation by phone or known contact details for any payment or bank account changes?
• Are you on a private, secure network (not public Wi‑Fi)?
• Have you enabled MFA on your accounts and checked the recipient has basic protections too?
• Does the document include unnecessary personal data you can redact?

What to do if something goes wrong:

• If you suspect a fraud or BEC attempt, contact us immediately.
• Change passwords and enable MFA on any affected accounts.
• Report the incident: use the Australian Cyber Security Centre’s report and recovery guidance and, where relevant, notify the Office of the Australian Information Commissioner (OAIC).
• If financial loss is likely, contact your bank immediately and obtain written confirmation of any steps they will take.
• Keep records of communications and steps taken. We can help coordinate next steps, including a potential breach notification.

Sharing sensitive information securely protects you and the professionals you rely on. If you are unsure how to send documents safely, ask your adviser for their preferred secure method.

Our team is happy to guide you through secure portals, password protection and MFA setup so you can share what’s needed without the worry.

And remember, always prioritise safety over speed when sending personal data online.

This is general advice only and has not been prepared with your situation and needs in mind. For individual and personalised advice, we highly recommend that you seek out proper professional advice from your adviser.