It's January. Your accountant needs last year's P60, your self-assessment workings, and a couple of receipts. You hit reply-all on the email chain and attach the lot. A week later you read about a phishing scam targeting clients of that very firm.
Tax documents are catnip for fraudsters. Lock them.
What's in a tax PDF that matters
A typical UK self-assessment PDF contains: your National Insurance number, full name, address, UTR (the unique reference HMRC uses), bank details for the refund, total income including each source, and your accountant's name. In the US, expect SSN, EIN, full income and bank routing on tax returns.
Any one of those is a step toward identity theft. Together, they're the whole staircase.
The workflow
Merge the documents into a single PDF if there are several — easier to encrypt and easier for your accountant. Then run the file through Flint's password tool and set a generated passphrase.
Email the file. Text the password. Wait for confirmation that the accountant opened it. Once tax season is done, delete the email and the local copy.
Long-term storage
Don't store unencrypted tax PDFs on a synced cloud drive that touches your phone, laptop and partner's iPad. Either keep them encrypted at rest or move them to a dedicated, access-controlled archive. HMRC says keep records for at least 22 months; many people keep them for six years. That's a long time to leak quietly.
FAQ
Can HMRC accept password-protected PDFs?
HMRC agents typically receive documents via secure portals, not raw email. If you're sending to your accountant who then forwards to HMRC, encrypt your side of the chain.
Should I encrypt PDFs already inside an accountant's portal?
The portal provides one layer. A password on the PDF adds a second — defence in depth. Many firms now require it.
What password should I use?
A random passphrase from a password manager. Not your date of birth, not 'tax2024', not your dog's name.
How do I share the password with my accountant?
By a different channel than the file. Text, phone call, secure-send in a password manager.
Tax-season files don't belong unencrypted in your inbox. Lock them before they leave.