Cybersecurity and Compliance

Welcome to Accountants Law Pod, where accounting professionals and law firms converge. Hosted by Lynda Artesani, Sarah Prevost, and Stephen Libhardt.

Welcome back to the podcast, everyone, and welcome back, Sarah. It seems like you've been gone for like a month and a half.

It feels that way.

It feels that way for sure, for at least me anyway. Yeah.

Well, to think you got sick in the middle of all this.

Yeah, you were sick, which you never get sick. Knock on wood. Knock on wood. You don't usually ever— it's been years. I've known you 5 years. I think this is the first time I've seen you sick.

That was pretty bad. Yeah. I was like, oh, God, I felt knocked out.

But you've been traveling a lot. Just like fun trips, but also work stuff. And I think that traveling is like a petri dish. I don't care what anybody says. It's like I always get that man behind me coughing and not covering his mouth, and I want to turn around and go, didn't your mother teach you that?

Or sneeze into your hands and then—

Oh my God.

I'm like, oh no, people.

Yeah. Don't you know about the elbow?

Being in compliance with the rules.

Speaking of compliance, that's kind of the topic today. How was that segue? Was that a good one? And we're Steve-less this week, but he's busy working, so it's just me and you, but not just me and you, but you haven't been around, so your turn.

Yeah, I know, right?

Well— So the topic is cybersecurity and compliance. And compliance is big, especially this year with the new rule that, well, I don't think it's new, but we've talked about it in the past. I mean, cybersecurity, first of all, is gonna be huge, especially with AI and the changes to what they can get away with.

I'm, you start to see— Oh, with scams. Did you see the, the Google recently announced something about be careful about clicking on the authorization codes. Like, you know how you, you do the two-factor and then—

Oh, in your phone?

Yeah, it'll say, hey, is this you? And I did get one of those while traveling internationally. I don't know when it came in, but I clicked dismiss because obviously it was too late and I wasn't going to. But there was an announcement that Google was like, hey, be careful because there's some scam going out there.

You know, that's funny because I had two of— actually had one and Tiara said somebody— you tried to log in or it wasn't me. And then I had one go in my other email, the bookkeeping one, the same exact email. And I said, oh, this is fake. It looked real.

It looked real. It did.

And it came through.

Yeah.

And that's one of the biggest things down here in Florida because you get a lot of older people that are not so tech forward and they're easily duped because they're not like my husband, not great on the computer. And he clicks things without thinking. I think I've got him better trained. Although if you asked him our secret code word, he'll never, he'll always say, "I didn't know we had one." And I'll have to tell him what it is again to say, "Hey, this is our word." So that if anything, like you ever get a phone call when I'm traveling saying, "Hey, it's me," 'cause they can mimic your voice. Mm-hmm. They can, they've got enough video footage on us that we, they could actually create a, if you were calling like on FaceTime. So those are things, not that I'm high on the priority list for that, but you know, like celebrities are probably gonna be the first ones or anybody with a lot of money. So you want to be careful of that, and that kind of lands in cybersecurity bucket.

I feel like overall, I don't know if you feel this way, Lynda, it's really hard to keep data secure with the multiple places that we're having to— I mean, we all know email's not the safe place.

No.

Our phones now, we're being told, you know, those things that we do to verify who we are, be careful of that. There's multiple ways of getting scammed. You get emails from obviously banks that are just close enough with the right logo.

Yeah, it's crazy because they just, even if you look like before, you'd look at the URL and it would look weird or junky, especially something from Intuit. And then I heard because we used to have it, we used to be send it to spoof@intuit.com and that's no longer available. I think it's phishing@intuit. If you have an email come through, which there's been quite a few of those lately too, that you look at it and it's like, I get one every once in a while and it says that a check from my company to my real estate company bounced. And there's no way. First of all, I don't write checks from Artesani to the real estate company. So I look at it. It would make you nervous though, because it looks like one of those emails that says that it bounced. And I'm like, but I know because I know Mike doesn't do it. And I know that myself, I didn't do it. There's no other way a payment would go out. And it's like, for a small amount, like $25, it looks real. And if you look at the URL, it looks real. And it might just say qbo@intuit.com or something like that that looks like it could be, but there is no qbo@intuit.com. And then if you really dig into it, and it keeps resurfacing and recycling. So I see it, then it goes away, then I see it. And I actually, this last time I looked, I'm like, wow, this is like the second time I've seen this. And I looked on all the bank accounts. There's plenty of money in all the bank accounts. I'm like, okay, So I can't understand what this is, but it's just fake is what it was. It's not real because there was a place to click on it to check the account and log into QuickBooks here. Well, that's not QuickBooks. So then they would have had your QuickBooks login, which is what they're phishing for.

Just what they're phishing for. Yeah. And so I feel like what we've done proactively as a group, you and I, we've done security on our domains. You can't log in unless you've gone through all of these extra protocols. But it doesn't, it's still to your point, it doesn't prevent you from getting scammed from a very innocent looking. I mean, it literally looks legit or a phone call sometimes that happened to one of our employees recently.

Where you've gone through the extras, you're much more proactive on this stuff as part of what we do together is you, you went the extra step with all that stuff with our Apple products and, and getting all the stuff set up. That was all stuff for our security, locking down the domains. Use Practice Protect. So we've got the Practice Protect in place, which every once in a while I get on one of the staff with the staff member, I'll go, hey, that little C is grayed out. Need to go log back into that because you have to keep logging into it. It doesn't stay logged in from, I don't think, more than a few days and you have to relog into it.

Yeah.

And, um, it's, it's one of those things you're not paying attention, you don't see it, but that's part of the things that we do to keep our company safe. We, we try to go the extra steps, but clients don't. You bring them into Licio, you tell them this is where we communicate, and then next thing you know, they're sending you an email. And then when they send you the email, you're like, no, we need to communicate in Licio. And then they, I don't like that, takes too long. And you're not supposed to be sending their documents through. So sometimes just to appease them if they're being persnickety is we've locked out PDFs with a padlock and password, and we've done some other things to try to get them to that. But we don't want to go that route. We want to stay with what we got.

Sometimes clients— Well, we have to with the FTC under—

Right, the FTC rules.

The rules. I mean, regardless of those rules, it's just knowing that we honor and invest in taking that extra precaution. It is hard though when you get those announcements that a government employee's computer was stolen. I mean, you don't know, are you part of that— Yes. All those class action lawsuits, there's that one going on right now. I don't know much about it, so I don't want to speak too deeply to it. But a lot of people are going back to Chase and Bank of America and all those and saying, hey, you're not protecting me on Zelle because you get on this fake website. It's a flurry. Like you said, it's a small dollar amount, send this much, and then before you know it, you're sending $500 or however much you sent. So all this money via Zelle, there's no— Right.

And there's no undoing that. And, you know, Zelle is funny. So they've recently updated their platform. It's a lot more steps to get a payment out of Zelle too. Like, I use it for personal use for like hairdresser and things like that to pay them instead of writing a check. But I've seen it with that, the BOI. People go on, they click off boi.com and it's not that because it's, I think it's .gov and people are going in, they're paying and then they're finding out that that's a scam. You know, you're in a hurry because you, want to get it done and it shouldn't cost you money. And people are paying it to somebody, whoever that, that got that domain or some other sites that send you an email saying, hey, you didn't file your BOI and this is the fines and all that to scare you. We get them on paper or email too. I get them every year from somebody that's here.

Yeah.

I get from somebody that mails me something every January telling me I got to make sure I file the tax return for the state. Work for the state and it's a fee and it's not the real website because the real website comes later and they get those mail, that mailing out. If you look at it, it looks real official with like the, you know, the thing, the crest of the state of Florida and everything. It looks real and it's not. Mm-hmm. And that's the kind of stuff that's, if we gotta be careful of. And I mean, it, that's the part. And we had a client, remember a long time ago that had, he was hacked and paid the ransom.

Yeah, yeah, which I know from personal experience, not myself, but somebody in my family member, um, that had that happen to them where their entire Windows computer was locked out and down and he had to pay a sum to get it unlocked.

And is that crazy?

It's crazy to think. And I know that we just— you and I have a client who has such a presence and he's being like you said, imitated and a link that looks like his link. Clients are paying.

Which is horrible.

Which they think they're paying him.

And they're not.

They're not. And I've received it too where, you know, I've gotten a message that says, hey, I'm so-and-so, do you want to connect? And come to find out that's not the real person, they're scamming. And the words that they said to one of our staff members was, I have to make money somehow. I'll just move on to the next one. That's exactly what they said to her on the phone.

That is just horrible.

I mean, you're stealing so much.

To justify it, they showed a couple of, they showed a couple of girls in California because California voters voted to enact stronger rules about, well, it's a felony when you steal. And these two girls were in the back of a police car and I guess the recording was on and she's like, We didn't take that much. They went into like Ulta, the makeup store, and they said— the other girl said, it's the new rule, and became a felony. Why are they charging us for a felony? And they both— and she goes, it's the new law that just passed. So they were getting away with it before. But California, they went and increased it because I think people are getting tired of having to buy stuff behind glass and unlock things like your toothpaste, and they enacted a stronger rule against what becomes a felony, what you steal. And they Otherwise you're just gonna keep stealing. And she, it was just a funny conversation between these two girls that were caught. I mean, they had everything, they didn't even, they blatantly did it. It's on camera, like their face, they didn't, nobody even covered their face. And then they're just sitting in the back of the police car having a conversation about how, you know, when did this become a felony?

And having it over coffee.

Yeah, they were on their way to jail. So yeah, I don't know how long they'll be in jail, but yeah, it was interesting to see. But that's, You know, when you come— when it comes to cybersecurity, you can hire a company to come in and check if you don't understand it or know enough about what you want to protect. There are companies that will come in and give you like a report card, and they'll actually come in and see how things are, and they'll train your staff. So to see, they'll even test it, test up and send them out a little fake email and see how everybody reacts just to check.

Yeah.

People are actually doing what they've been instructed because you can teach them, you can lead a a horse to water, but you can't make them drink. So it teaches them without the real ramifications of what happened if, if it really was something like that. And it's so easy to get scammed by it today.

So easy. It's, it feels so, it's so embarrassing to who, the people that do get scammed. And there's been a lot of people actually out there that have been posting on social media how easy they've been scammed. Mhm. And I know they say it's the frequency and the how fast somebody's asking you for money and so forth, but the the details are so much to your point, Lynda. You said AI is out there and they know. So there's so much is known about us already, and then they could craft it in such a way. And so with all of those pieces, it's part of like the part that we ask for from our own clients is please let us do the things that we need to stay compliant for us, but also to help you make sure that that we're not passing through a driver's license on an email. Yes. We're passing it through a secure portal. We're not texting information that could easily— I did, this happened to me. I received, when I was able to get the global information back on my phone, we changed the setting. I received all these texts from Xfinity and I'm like, is this even real? Because it was so, like, I was having a hard time understanding. It wasn't pointing out I'm multiple accounts. It wasn't pointing out what it was. And I would log in and I couldn't find anything and my VPN was blocking me. So that came even.

Yeah.

At some point you start to wonder like, is this real? Am I, am I giving away information just by trying to log in? And so I just, I just feel like it's just so becoming so much more easier and it's so much more deliberate. It's becoming harder and harder. And I wonder at what point does protocols change yet again. And it is hard for us to even protect our own information as it is and as owners, as individuals. But then—

Yeah, so if there's two-factor authentication on any software that you're using, as much as a pain in the you know what that is, sign up for it, do it. Oh my God. Because it is not— and use the code. The code is actually, you know, the authenticator—

I prefer the authenticator codes.

It's better than actually using it, going to your tech phone because somebody could steal your phone and force you in, you know what I mean? Like, so the code is supposed to be stronger. Those are things that you could do to help mitigate any hacking.

Like, what we do too is with, like you said, the Apple Business Essentials, I can go in if a computer is lost or stolen, I can just wipe it down remotely. Like, I totally wouldn't have And we did that on purpose to have that.

Yeah. Which is important, which thankfully Apple has just as a general member. I lost that computer, was brand new. Lost that computer. I had to go and shut everything down, which they were gonna wipe it out anyway, but I had to, I shut it down immediately as soon as I realized I didn't have the computer, which was in minutes.

Yeah.

I immediately shut it down. I couldn't find it. I just shut it down and, and wiped it out. But those are things you wanna think about because, you know, it's like anything else. Especially when it comes to cybersecurity, you wanna make sure that you're protected as best you can. And then you also have some redundancy in your backups because, and test them out when it comes to that stuff. So want to make sure, because I think a lot of times people think, oh, I'm backing up QuickBooks, but you don't realize what is backed up, what isn't backed up until you test it out. It's not everything. It's not like a desktop backup.

So Remember that horror story we got from a client? Like, to your point about testing, and no one ever tested the data, and it was saved, and they never brought it in to see who had the code. And so they lost years of just historical data. Years. Oh, that just felt heartbreaking to hear. But I guess there's a piece out there about, to your point, Lynda, about the 5 Cs of cybersecurity. So it's change, continuity, cost, compliance, and coverage. So those are like—

So there is coverage, which we haven't talked about. There is coverage for cybersecurity and it wasn't that expensive a long time ago and now it's so— it's like anything else. But you want to make sure that you're able to have that insurance. If you have a bigger firm or even a smaller firm, you want to know that that's out there. There is insurance for it. It's expensive and it's complicated. How it works. A lot— who is it we talked to one time that told us that if there's ransomware, they pay it? And I was surprised to hear that the insurance company would pay it to get the data back. Somebody, was it Chris from Lycio? Somebody told us that. I was like, whoa.

Well, I mean, speaking of ransom and stuff, you know how with, was it blockchain and all those key codes? And like, they're so cryptic and only one person could have it. Well, I guess with the new open source AI, there's something that can immediately possibly—

Yeah, that never sat well with me because it all—

That seems crazy, right? Well, I feel like that's an indication of where our lives are going in this rapid speed. Like, we— it's, it's always a misnomer, like, How do we handle it? How do we do it? How do you do it? How do you do it right?

Even with Bitcoin now, that, that's a conversation that obviously we're starting to look into because we need to make sure that we're— if it's gonna start to become a thing and used as currency, the United States has to be in the forefront of it or we're gonna lose our front row. And hopefully that's done in an intelligent way. I, I just saw the other day what Bitcoin, the actual Bitcoin what it went for. Is it the one that's called Bitcoin? That the original one that I—

Original one.

Worth. Yeah. The what they're worth now since the election. It, it's a crazy number and it ha— it has to be that one though. I, and I'm no expert in this Bitcoin stuff. I know there's like Ethereum and there's all these different type, all these different named ones and which ones are good and some are junk. But it's just, yeah, it's fascinating. Like how do you, how do they figure out that value? 'Cause money's always been based on like golden thing and—

Trade debt and all of those other things.

It's weird.

It's so weird. But the fact that you could crack something that was supposed to be so cryptic, right?

That was going to not ever be cracked.

Yeah. And now it's like, okay, what does that say to all of these other areas that it does feel very archaic to be doing things via email in a big way. Yeah.

Let's do away with email. I vote yay. I'm with you.

But yeah, I just— but it is still the main mode of communication. It's like kind of faxes, you know, to get things faxed right before you actually machine. And now it's electronic. Now you can do it on the web.

Finally, I think the old-fashioned fax is dead officially, I would hope. I know some insurance companies still make you fax and it's like, oh God, how do I fax again? Because you do it online now, the PDFs and things like that. But yeah.

Yeah.

Fascinating.

It is. It's hard. It's not one— we're always learning together, Lynda and I, in our company. But it's not one that, you know, you're always feeling like, oh, I've got it just right. It's one that you're always going to be working on and always refining.

Maybe with AI, it will— maybe there'll be ways to protect yourself better in the future with AI and with cybersecurity. Who knows? Maybe there'll be better ways where we won't be using to have to type in password. I saw a meme one day and it said a good day is when I don't have to reset a password.

My God. How many passwords do we have to have? Like, just not having a password holder of any kind is also very scary.

Yep.

Like, people putting it on notes on a computer. I'm like, yeah, no, that's not—

Maybe someday we won't have to have a password. I don't know. That would be interesting. And maybe we won't have to be worried so much about cybersecurity in the future. Who knows? But right now and actually think we're gonna go through a spell where we're gonna need it more than ever. But maybe someday in the future we won't have to. Who knows what the future will bring? I just saw the other day that OpenAI, I guess they're trying to be a for-profit company, which is interesting.

That's interesting.

Yeah. They're, they're switching from a nonprofit and they're trying to figure out why. And I think that came out somewhere. I read it where it explained why, why they're doing what they're doing. Yeah, it's interesting. And then there's a lot of like, murmuring about who wants it and who doesn't want it. It should never be, should it be? It's the people stuff. It's just interesting to see how it's going to go. Yeah.

With the way that cyber, the security of it, the way it gets handled in the future and the way insurance companies handle it in the future. What is the digital footprint that can be found with the way that all this technology Because it reads and analyzes things way faster than the brain can.

So, and it can read volumes of information, which is why it's so good for the medical field, you know, analyzing records and things like that. So I think that, and, and it's great for law firms. I mean, law firms reading long reports and documents, it's able to, with its vast knowledge, be able to read it better than a human, right? And pick up any little tiny things. So we'll see. I guess we'll see.

Interesting. Yeah. Well, I mean, if anything, the one thing that we would ask is that our clients would just meet us where we know it's safe because we pay to play in that.

They need to listen to us. Don't fight us. I know it's a— nobody likes friction. And that's the problem is not everybody wants to live in a really frictionless world, right? Frictionless world. And that's not the case. If you do, you're opening your doors to cybersecurity. So, you know, there's reasons why we kind of really circle back to Licio, why we bring the conversation back, copy paste it and answer there, because we wanna make sure that the information's secure. I do not want documents floating through. You hired somebody new and you've put that in the little email with everything to steal this person's identity.

No, not— Not interesting.

That was easy for you to send it to me that way. No, it's not good.— and your financial documents as well.

Yeah, so true. Well, that's our take on cybersecurity and compliance.

Actually, we could go on for a whole show about compliance, but make sure you do 3-way bank reconciliation.

Oh yeah.

That's a good one on compliance. I know this was about cybersecurity and compliance, but yeah.

Yeah, definitely.

To support the Accountants Law Pod, don't forget to like, share, and leave a review. And if you haven't already, hit that subscribe button on YouTube or wherever you enjoy your favorite podcasts. If you have questions or topic requests, shoot us an email at info@accountantslawpod.com or send us a message through our website, accountantslawpod.com. To join our weekly Accountants Law Lab mastermind sessions, head over to accountantslawlab.com to sign up.

All right.

Well, this is always a good topic. Yeah. Now we have one in the books. So like you said earlier when we were off camera, We'll just send it, or maybe it's Tiara. Just send them this recording. Just send them. When somebody doesn't do it right, say, here, listen to this podcast.

Yeah, please just do it this way. Help us out. Yeah. Well, thanks, everybody.

Thanks, everybody. Till next week.