The IRS recently announced a warning to the nations’ businesses regarding another scam, this time targeted at W-2 forms. The last several years have seen an increase in a W-2 email scam that threatens personal tax information and the IRS is seeking to alert payroll and human resources associates so they can be on watch for potential attacks.

Noteworthy improvements have been made in suppressing stolen identity refund fraud in recent years, so criminals are now searching for more detailed personal tax information in order to fraudulently file a return. W-2’s contain significant taxpayer income and withholding information, which is exactly the type of information frauds are seeking and why they are targeting employers to acquire it. Hundreds of businesses fell victim to the scheme last year, which left thousands vulnerable to tax-related identity theft.

The scam has unfortunately grown larger in recent years, attacking businesses like public universities, hospitals, charities and small businesses. The IRS is hoping to educate employees and employers, particularly payroll and HR associates who are often the first to receive an email, to limit the number of successful attacks.

The scammer will usually spoof the email of someone higher up in the organization or business, and send an email to a colleague with W-2 access, likely with a subject line similar to “review” or “request.” The email may begin very casual and cordial, not urgent, so the recipient may be tricked into believing it is a reasonable request.

The “request” will likely be a list of all the employees and their W-2 forms and may even specify the file format. Since the employee believes they are communicating with an executive or superior, they may reply without question, which means weeks could pass before the employee or business realizes they have been scammed, giving frauds a wealth of time to file numerous fake returns.

This scam poses a major tax threat at both the local and state level, which has led the IRS to establish a specific reporting process to alert the proper individuals. This process is outlined briefly below:

• Email dataloss@irs.gov to inform the IRS of a W-2 data loss and supply contact information. Make the subject line “W2 Data Loss” so that the email can be appropriately routed and do not include any employee personally identifiable tax information.
• Email the Federation of Tax Administrators at StateAlert@taxadmin.org to get state-specific victim reporting information.
• Businesses or payroll service providers should file a complaint with the FBI’s Internet Crime Complaint Center (IC3.gov). They may also be asked to file a report with local law enforcement.
• Alert employees so they can take protective measures against identity theft. The Federal Trade Commission website, www.identitytheft.gov, provides instruction on steps employees should take.
• Forward the scam email to phishing@irs.gov.

While the IRS wants to educate employees, payroll officials and HR associates about the email scam, they are also encouraging businesses to set up preventative policies safeguarding against hacks. Suggested policies include requiring multiple individuals to receive and examine sensitive W-2 information before it can be sent out, or requiring verbal communication before information can be sent digitally. The IRS is taking strong measures to safeguard taxpayers and decrease the number of tax-related scams, so employers are also encouraged to be on the defensive and protect their own tax paying employees.

If you have any questions, please feel free to contact me at brian@brammerandyeend.com.