How to Send Tax Documents Securely

Every spring, millions of people photograph or scan their tax paperwork and email it to someone. It's understandable — it's the path of least resistance, and the deadline is close. But tax documents are an unusually concentrated bundle of exactly the data identity thieves want, and email is an unusually leaky way to move them.

This article covers general security practice, not tax or legal advice. For questions about your filing obligations or your preparer's specific requirements, speak to a qualified professional.

What's Actually on These Documents

It's worth being specific about why this category deserves more care than a holiday photo:

• W-2 — full name, home address, Social Security number, employer, and exact annual earnings
• 1099 forms — SSN or EIN, payer details, income amounts
• 1040 and schedules — dependants' names and SSNs, bank account and routing numbers if you took a direct deposit refund
• Brokerage and mortgage statements — account numbers, balances, property details

A Social Security number plus a name, address and date of birth is enough to attempt opening credit in someone's name, or to file a fraudulent tax return to capture their refund. And unlike a password, you can't rotate your SSN after it leaks. That permanence is what makes this different.

Why Email Attachments Are the Wrong Default

Email isn't catastrophically insecure in transit — most major providers encrypt the hop between servers now. The problems are elsewhere, and they're structural:

• It persists indefinitely. The attachment sits in your Sent folder and their Inbox for years. A mailbox compromised in 2029 still exposes the W-2 you sent in 2026.
• It's copied repeatedly. The message exists on your provider's servers, theirs, any backups on either side, and any device that synced the mailbox.
• Autocomplete is unforgiving. Picking the wrong "Dave" from a dropdown is silent, instant, and unrecoverable. Misdirected email is one of the most common causes of accidental data disclosure.
• Forwarding loses control. Once it's in their mailbox it can be forwarded onward without your knowledge.

So the issue isn't that someone is intercepting your email tonight. It's that you've created several permanent copies of your SSN in places you don't control and can't clean up.

Option 1: Your Accountant's Portal

Ask first, before you send anything. Most established CPAs and tax preparers have a secure client portal, and it's usually the best available option:

• It's purpose-built for exactly this document type
• Access is authenticated, not just a guessable link
• It keeps an audit trail on their side, which protects you both
• Documents land directly in their workflow rather than an inbox

If your preparer has one and you email attachments anyway, you're choosing the worse option for no reason. A single message asking "how would you like me to send these?" resolves it.

Option 2: Password + Transfer Link

Plenty of smaller practices and individual preparers don't have a portal. In that case, a reasonable approach is a password-protected file sent via a transfer tool:

1. Combine your documents into one archive and set a password on it. Most operating systems and free archive tools can do this; choose a long passphrase rather than a short password.
2. Upload it at realtimesender.com — up to 30GB, free, no account needed by you or your accountant.
3. Send the download code by email to the address you've verified.
4. Send the archive password separately — by phone call or text. Never in the same email.
5. Confirm they've downloaded it. The file then deletes itself from the server.

Why this compares favourably to an attachment: the file is transferred over an encrypted HTTPS connection, it's deleted automatically after download or when the code expires, and it never becomes a permanent copy in two mailboxes. The exposure window is minutes rather than years.

Being straight about the limits, because this matters for documents like these: Realtime Sender is a temporary transfer tool. It is not an end-to-end encrypted vault, it is not a compliance product, and it makes no certification claims. The protection for your SSN here comes from the archive password you set plus the short lifespan of the transfer — not from the tool alone. If your accountant has a portal, their portal is the better choice.

Rules That Matter More Than the Tool

Which service you use matters less than these habits:

• Never put the file and its password in the same message. This is the single most common mistake and it reduces the password to decoration. Different channel, every time.
• Type the email address manually. Don't trust autocomplete for this. Check it character by character before sending.
• Verify unexpected requests by phone. If you get an email that looks like it's from your accountant asking you to re-send documents or confirm bank details, call the number you already have for them. Tax season is peak season for impersonation, and a convincing email is cheap to produce.
• Prefer short-lived to permanent. A link that expires in minutes beats a cloud folder nobody remembers to revoke.
• Don't text photos of tax forms. Those images end up in your camera roll, your cloud photo backup, and their camera roll — typically unencrypted and permanently.
• Clean up afterwards. If you did email something, delete it from Sent and empty the trash. It won't remove their copy, but it removes yours.

A Note for Tax Preparers

If you're on the receiving side of this professionally, the obligations run in your direction. In the United States, paid preparers are generally expected to maintain a written information security plan, and the IRS publishes guidance on safeguarding taxpayer data in Publication 4557. The FTC's Safeguards Rule also reaches many preparers.

Practically, that means telling clients how to send documents before they improvise. Most clients email attachments because nobody gave them an alternative. A single line in your onboarding email — "please upload documents here, don't email them" — prevents the majority of it.

This is general information rather than compliance advice; your specific obligations depend on your practice, and a professional advisor or your state board is the right source.

Frequently Asked Questions

Is it safe to email tax documents to my accountant?

Plain email attachments are a poor choice for documents containing a Social Security number. The message is copied to multiple mail servers and stays in both mailboxes indefinitely, so one compromised account years later can expose everything. If your accountant offers a secure portal, use it.

What is the safest way to send a W-2 or 1099?

Your accountant's own client portal is normally the best option, because it is built for the purpose and keeps records on their side. If they do not have one, a password-protected file sent through a transfer tool, with the password shared by phone rather than email, is a reasonable alternative.

Should I password protect my tax documents?

Yes, for anything containing a Social Security number or account numbers. The critical detail is to send the password by a different route than the file — a phone call or text, not the same email. Sending both together gives no protection at all.

Do tax preparers have security obligations?

In the United States, paid tax preparers are generally expected to maintain a written information security plan, and IRS Publication 4557 covers safeguarding taxpayer data. It is reasonable to ask your preparer how they want to receive documents and what protections they have in place.

How long should tax documents stay available online?

As briefly as possible. A file that is deleted after the recipient downloads it has a far smaller exposure window than one sitting in a shared cloud folder for years. Avoid leaving tax paperwork in long-lived shared links.