How fake IRS notices and client document lures target accounting firms, and how to build a “report it, don’t click it” culture before busy season.