EP553: Craig Taylor - You Are A Prime Target: Why Bookkeepers Must Understand Modern Cyber Threats

See what the team at The Successful Bookkeeper has on right now →

Bookkeepers sit right next to the money, and that makes them a favorite target for financially motivated hackers. In part one of this two-part conversation, Cyberhoot founder and CEO Craig Taylor explains how AI has changed the threats landing in your inbox, your texts and your phone calls. He also gives you a short list of habits that shut most of those attacks down. Craig started in cybersecurity 30 years ago with a psychology degree, and his focus is on behavior change rather than fear and shame.

Chapters

• [00:00] Why bookkeepers are targets
• [02:00] Craig's path from psychology to cybersecurity
• [08:00] How AI changed phishing attacks
• [11:00] Smishing, quishing and vishing explained
• [15:00] Safe words and callback verification
• [19:00] A listener's phishing story
• [22:00] Are QR codes safe to scan?
• [24:00] Password managers and passkeys
• [29:00] Next-of-kin recovery and staff transitions

Why bookkeepers are a prime target

Craig is blunt about it: "Bookkeeping is the purse strings of the companies you're supporting." If you pay bills, wire funds or manage the financials of multiple companies, you are, in his words, "not just a little one, you're a prime target." Five years ago the attack was a clumsy gift card request with bad grammar. Today it can come from a breached inbox, with perfect spelling, the right branding, and urgency, authority and secrecy built in to rush you past your instincts.

Phishing, smishing, quishing and vishing

Craig walks through the whole family of scams: phishing (email), smishing (SMS text), quishing (QR code phishing) and vishing (voice). Fake toll violation texts and stickers pasted over parking meter QR codes are everyday examples. Voice is the scariest, because AI can clone a voice from two or three seconds of audio, and a call that sounds like someone you know carries built-in trust. As Craig puts it, the common thread is "getting you to react and do something financially without proper validation."

Verify before you act

The fix is the same whatever the delivery method: verify the identity of the requester. Craig's two best tips for bookkeepers:

• Set a safe word with every client. Never publish it in email or any electronic format. If an urgent wire request comes in by phone and the caller can't give the safe word, "click, they hang up" and move on to an easier target.
• Call back on a number you already trust. Use the one saved in your phone, not the one in the email, because attackers will swap in a number they answer themselves.

Michael adds his own version of this: when someone calls claiming to be the bank or the government, look up the general number yourself and call in.

QR codes and a real-world phishing story

Michael shares a listener's story. After an office break-in, she tightened up her security, then got caught by a very good phishing email over a busy weekend and entered her password. Craig says scanning a QR code on your phone is relatively benign unless something is attacking the phone itself, but you should know where the code came from. A menu at a busy restaurant is fine, while a code on a telephone pole is not. If the next screen asks for a credit card when you only wanted an event date, stop.

Make this the week you adopt a password manager

If you do one thing after this episode, Craig says, make it a password manager: "It allows you to create unique passwords everywhere you go." A manager only fills in credentials on the real site, so it protects you from phishing pages, and it saves you from changing 100 passwords after one breach. Craig also recommends passkeys, which can't be stolen and reused, and says to protect the manager itself with multi-factor authentication. Both he and Michael use 1Password. Set up the next-of-kin recovery feature so a trusted person can regain access after a delay. It also helps when staff change jobs: the next person can pick up the client accounts the last one managed.

Links mentioned

• Cyberhoot
• 1Password
• The Successful Bookkeeper: thesuccessfulbookkeeper.com (resources and links)
• Part 2 of this conversation: business-side cybersecurity and preparing your team

About the guest

Craig Taylor is the founder and CEO of Cyberhoot, a company that makes cybersecurity simpler, more practical and easier to manage for small and mid-sized businesses. He began his career in cybersecurity roughly 30 years ago after studying psychology in Guelph, Ontario, and worked at several Fortune 500 companies, including a large bank, Computer Sciences Corporation and Vistaprint. Twelve years ago he founded Cyberhoot to teach cyber literacy in a way people enjoy, using positive reinforcement rather than punishment and shame.

About the host

Michael Palmer

Michael Palmer is the host of The Successful Bookkeeper podcast — almost 600 episodes and counting — and founder of The Successful Bookkeeper Global. He's spent over 15 years in the bookkeeping industry, working one-on-one with thousands of bookkeepers across the globe. He started this work because of his father — a brilliant electrical contractor who worked twice as hard as he should have had to, because nobody on the financial side was in his corner. That gap is what The Successful Bookkeeper exists to close. His view: bookkeepers are the most undervalued force in small business — and every bookkeeper who builds a real business changes two families: theirs, and their clients'.