Every day, businesses interact with the information systems of state revenue authorities (SRA)—filing reports, issuing electronic invoices (e-Invoices), and checking notifications. But wherever money and data are involved, scammers are always lurking.
Cybercriminals frequently impersonate tax authorities to steal your credentials, electronic digital signatures (EDS), or bank funds.
We’ve put together 5 simple yet critical cyber hygiene rules to protect your account and your business from IT threats
1. 📂 Guard Your EDS Like a Vault Key
- Never share your EDS keys with anyone (even a "highly trusted" freelance accountant). If an accountant leaves, their access privileges must be revoked immediately.
- Set a strong, unique password for the EDS key itself, moving away from default ones like 123456.
- Do not store keys on computer desktops or in shared network folders. The ideal approach is to use a secure hardware token (a password-protected USB drive).
2. 🌐 Always Verify Website URLs (Phishing Alert!)
- Scammers create exact replicas of the Taxpayer’s Profile or e-Invoicing portals to trick you into entering your password.
- The Rule: Never log into your accounts via links found in emails or SMS text messages. Bookmark official government portals in your browser and access them exclusively through those bookmarks.
3. ✉️ Beware of "Tax Authority Emails"
- Did you receive an email about an "urgent tax debt," an "unscheduled audit," or a "frozen account" with an attachment (ZIP, PDF, or Excel)? Do not rush to open it!
- SRA sends official notifications directly to your secure Personal Account or Taxpayer's Profile.
- Malicious attachments in fake emails can infect your PC with ransomware, locking up your entire accounting system (e.g., 1C) and demanding a ransom.
4. 💻 Secure the Accountant's Workstation
- The computer used for filing tax returns and making payments must be treated like a digital fortress.
- Avoid using personal social media, streaming movies, or downloading third-party software on this specific PC.
- Always use a licensed antivirus program and keep your operating system updated (updates patch the security vulnerabilities that hackers exploit).
5. 👥 Restrict Access in the e-Invoicing System
- If you employ multiple staff members (accountant, billing specialist, procurement), do not share a single login.
- The "Electronic Invoice" system allows you to delegate specific permissions to each employee under their own EDS, restricting their capabilities (e.g., read-only access or invoice creation without authorization to send).
💡 The Golden Rule of Cybersecurity: Verification is always cheaper than damage control. If someone calls claiming to be a "tax inspector" and asks for an SMS code or requests that you install remote access software (like AnyDesk / AnyAdmin) — hang up immediately. Government agencies will never ask you to do this.
Stay safe online and good luck with your tax filings!