Tax preparers: where SSNs hide after filing season

April ends, the extension rush passes, and the office exhales. What nobody does is walk around and ask where all those Social Security numbers went. They did not vanish when the returns were e-filed. They are sitting in places that made sense in February and have been forgotten since.

This guide is for tax and accounting offices. It lists the usual hiding spots, a way to clean them up, and a short routine for next season. It is general education, not legal advice; ask an attorney or your security advisor about the specifics for your firm.

Why this matters more for tax work

Tax preparers and many accounting firms are treated as non-bank financial institutions under the FTC Safeguards Rule (16 CFR Part 314). In plain terms, the rule expects a written information security program, a designated qualified individual, and a risk assessment. It also asks you to identify and manage the data, people, devices, systems and facilities involved. You cannot manage customer information you have not located. Finding it is the first honest step, and the details of your own obligations are worth confirming against the current text of the rule. There is more on the sector at /for/accounting/.

The usual hiding places

Picture a four-person firm. The tax software holds the official return data, so the owner assumes that is where everything lives. Then look around:

• Downloads folders. Clients email a W-2 or a scanned ID, someone saves it to Downloads to open it, and it stays there for years.
• Desktop and Documents. Organizer spreadsheets, prior-year PDFs, and a folder named "Smith 2023 - working" that was never moved into the client file.
• Synced cloud folders. A OneDrive or Google Drive folder set up for one busy week, still syncing a copy to every connected laptop.
• Exported reports and CSV files. Client lists exported for a mailing, a bank, or a data conversion, often with a full SSN column.
• Saved email messages. Messages dragged out of the mail program and saved as .eml or Outlook .msg files, attachments included.
• USB drives and external disks. The "backup from last season" that now lives in a desk drawer or a laptop bag.
• Old computers. The workstation replaced two years ago whose drive still has everything on it.
• Scanned documents. Scanner-to-folder shares that deposit a PDF of every ID and Social Security card, named by date only.

How to find them without opening every folder

Searching by file name misses most of it, because "scan0042.pdf" tells you nothing. You need to look at what is inside the files. MyVaultMate scans local drives, synced OneDrive and Google Drive folders, and external or USB disks for Social Security numbers and ITINs by pattern, then ranks what it finds by severity and by computer. It reads Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files. It does not read RTF and PowerPoint files, Outlook .pst data files, or zip archives yet, so those need a manual look. A PDF from a scanner is usually only a picture of each page. MyVaultMate does not read those, or pictures, videos and recordings: they are listed as “Not scanned” with a risk score of 70, so the scanner folder needs a manual look too.

Be realistic about limits. Detection is rule-based, so you will see the occasional false alarm, such as a nine-digit order number shaped like an SSN. Treat the report as a ranked to-do list, not a verdict. The product moves or deletes nothing on its own; that part is yours or your IT provider's.

A post-season cleanup order

1. Start with the highest severity. Files with many distinct SSNs (full client lists, organizer exports) come first.
2. Move, do not copy. Put what you must keep into your client file system or tax software, then remove the stray copy. Confirm the destination actually opened before deleting.
3. Delete what has no purpose. Check your retention schedule and your engagement letters first. If you are unsure how long to keep a record, ask your attorney or advisor rather than guessing.
4. Handle removable media. Collect USB drives, decide what each is for, and either secure it in a locked place or wipe it properly.
5. Retire old machines. Before a computer leaves the office, make sure its drive is wiped using a method your IT provider recommends.
6. Re-scan. A second scan shows what is left, and comparing it with the first report shows progress you can show a partner or an advisor.

A checklist for May

• List every computer, laptop, external disk and synced cloud folder that touched client data this season.
• Empty the Downloads folder on every machine, after moving anything needed.
• Remove exports and working spreadsheets that duplicate data already in the tax software.
• Change scanner settings so scans go to a controlled folder, not a shared desktop.
• Write down who is responsible for the cleanup and when it will be repeated.
• Put a recurring reminder on the calendar for the same week next year, plus one mid-season.

Once cleaned, set a schedule so new strays are caught early. Scans can run manually, hourly, daily or weekly, and later scans can be incremental, re-reading only changed files. You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).