W-2 Phishing in Tax Season?
During tax season, an 'executive' emails HR requesting every employee's W-2 — urgently, for an audit. It's not the executive. One email reply hands criminals the names, Social Security numbers, and salaries of the entire workforce: everything needed for tax identity theft at scale.
TL;DR / Quick Fix
During tax season, scammers impersonate executives to trick HR into emailing all employee W-2s — a single email exposes everyone's Social Security numbers. Verify unusual data requests by phone, and never send W-2s or tax files by email to unverified requesters.
Follow these steps
- Verify the requester by voice. Call the executive at a known number before any W-2 leaves HR. Tax-season urgency is the scammer's leverage — see payroll diversion.
- Never email W-2s broadly. W-2s move through secure payroll systems, not email attachments. Any email request for bulk W-2s is suspect by definition.
- Train seasonal staff early. Temporary tax-season hires are prime targets — brief them before the season starts, not after the first attempt.
- Watch for the executive-spoof pattern. The requester is always senior, always urgent, always 'in a meeting.' The pattern is the tell.
- Report attempts immediately. Forward to IT and report to the IRS. W-2 phishing waves hit many companies simultaneously — early reports protect others.
- Have an incident plan ready. If W-2s do go out, you must notify affected employees fast — they need fraud alerts and credit freezes before tax filing.
What NOT to do
- Do not send W-2s to 'verify' the requester. Sending the data to test legitimacy hands over exactly what the scammer wants.
- Do not assume the internal email is genuine. Spoofed display names and compromised accounts both deliver these requests.
- Do not wait until tax season to set policy. The rule — no bulk tax data by email, ever — must exist before January.
- Do not keep the attempt quiet if it succeeds. Delayed notification multiplies victim harm; disclosure laws in many places require speed.
Frequently asked questions
Why W-2s specifically?
Each W-2 bundles name, SSN, address, and income — the complete kit for filing fraudulent tax returns in employees' names.
What should employees do if their W-2 is stolen?
File taxes early, place fraud alerts, consider a credit freeze, and get an IRS Identity Protection PIN.
Do scammers target small businesses too?
Yes — smaller HR teams with less training are softer targets, and the per-victim payoff is identical.