The Hidden Cybersecurity Risk in Recruitment: Why Accounting Firms Must Rethink Hiring Assessments

Most accounting firms carefully review their cybersecurity controls when purchasing software, handling client data, or onboarding new technology. Yet many unknowingly create a significant cyber risk through their hiring processes. 

A recent BBC report highlighted a growing recruitment scam in which job seekers are tricked into downloading supposedly legitimate assessment software as part of a recruitment process. In one case, a victim lost approximately US$24,000 after malware was installed during what appeared to be a genuine hiring process. 

While that individual loss is significant, it pales in comparison to the scale of cybercrime seen elsewhere. The Binance case highlighted reported losses of approximately US$6.3 billion linked to cybercriminal activity facilitated through staff applying for bogus jobs advertised on reputable job boards.  

The Risk Is More Real Than Many Firms Realise 

At Accountests, we see evidence of this risk every day. New customers regularly find us through searches such as personality test for a job, aptitude test for recruitment, and pre-employment testing. The reality is that employers, recruiters, HR professionals, and candidates are actively searching online for assessments. 

Unfortunately, not every assessment provider is reputable. The barrier to creating and distributing a recruitment test has never been lower, making it easy for malicious actors to disguise malware as an employment assessment. 

Why Accounting Firms Are Particularly Vulnerable 

Accounting firms are especially attractive targets for cybercriminals because they hold some of the most valuable commercial information available. 

Client financial records; Tax returns and tax file numbers; Payroll information; Bank account details; Corporate financial statements; Merger and acquisition data; Employee personal information; Client portals and cloud accounting credentials. 

For many firms, trust is their most valuable asset. A cyber incident originating from something as simple as a recruitment assessment could lead to reputational damage, client attrition, regulatory scrutiny, and business interruption. 

The Internal Threat Many Firms Overlook 

An employee applying for a role during a lunch break may be asked to download software, install an application, enable macros, or run files as part of an assessment. From the employee perspective they are applying for a job. From the firm perspective they may be introducing malware onto a device connected to the corporate network. 

Many accounting firms allow employees to access email and browse the internet from work devices. If an employee downloads a fraudulent assessment while connected to the firm network, the issue is no longer a personal cybersecurity problem. It becomes a business risk. 

Why Downloads Should Never Be Part of Recruitment Testing 

No employment test, personality questionnaire, aptitude assessment, critical reasoning test, or skills assessment should require a candidate to download software. Modern assessments can be delivered entirely through a secure web browser. 

There is no need for executable files, software installations, browser plugins, downloaded applications, compressed archives, or macro-enabled spreadsheets. Every download creates unnecessary risk and increases an organisation's attack surface. 

What Should Firm Leaders Do? 

Only use established assessment providers. Ensure all assessments are browser-based. Prohibit downloadable assessments. Educate employees about recruitment-related cyber threats. Treat assessment providers with the same due diligence applied to other software vendors. Review whether employees can install software on company devices. 

Final Thoughts 

No personality test. No aptitude assessment. No critical reasoning test. No skills assessment should ever require a software download. 

If a recruitment test requires candidates to download software, install an application, enable macros, or run files locally, accounting firms should view that as a warning sign. In today's hiring environment, the safest assessment is one that runs entirely in a web browser.