Stop emailing W-2s and 1099s: a safer way to collect tax documents

A W-2 or 1099 carries a Social Security number, an employer or payer, and income. Sent by email, it stays readable in the client’s sent folder, your inbox and both mail providers’ systems for as long as nobody deletes it, and there is no way to take it back.

An upload link fixes that without asking the client to learn a portal. You list the forms, the client uploads them, and you are emailed when they arrive. With ShieldFive, each file is encrypted in the client’s browser to a key only your firm holds, and our servers store ciphertext.

1. Build your list from the Form 1040 document checklist: W-2s, the 1099 series, SSA-1099, last year’s AGI, Social Security numbers or ITINs, mortgage and property tax records. ShieldFive has the same list as a template when you create a request.

2. Create one request per client, with a PIN of at least four characters and an expiry that covers your deadline (up to 7 days on the free plan; 30 or 90 days, or never, on Firm seats).

3. In your engagement email, replace “email me your documents” with the link, and send the PIN by text or tell the client on the phone.

4. The client uploads a photo or PDF of each form from a phone or computer. No account, no app.

5. You get an email when files arrive, and a reminder to follow up if nothing has arrived after about three and seven days. Revoke the link once you have everything; received files stay in your account.

The help article on collecting tax documents without email lists every limit in one table: file size, file types, link expiry, reminders and plans.

Some clients will reply with attachments. Reply with the link and a short reason: “Please use this secure link instead of email for tax forms. It takes a minute on your phone and keeps your Social Security number out of both our inboxes.” Then delete the emailed copy once you have it saved.

The IRS asks tax professionals to protect client data and tells them in Publication 4557 how. For what the FTC Safeguards Rule expects of your firm, see the tax preparer guide to the Safeguards Rule. This page is practical advice, not legal advice.

Chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests: next season you create a new request, though you can reuse the checklist.

It collects documents; it does not e-file, e-sign or bill. If you want all of that behind one client login, you want a portal; the guide to collecting documents from clients securely compares portals with the other options.

You need a free ShieldFive account to create requests; only the client skips signup. A new firm gets 14 days with everything unlocked, then 1 open request at a time free, with links that last up to 7 days and no client reminders. In tax season you will want the Firm plan: €29 per seat per month or €290 per year for unlimited open requests, client reminders, your logo and links up to 90 days or with no expiry. Clients never pay.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.