W-2 email scam is growing, IRS reports

The IRS, state tax agencies and private-sector tax groups warned the nation’s business, payroll and human resource communities about a growing W-2 email scam that threatens sensitive tax information held by employers.

These emails may start with a simple, “Hey, you in today?” and, by the end of the exchange, all of an organization’s Forms W-2 for their employees may be in the hands of cybercriminals. This puts workers at risk for tax-related identity theft.

The W-2 scam has emerged as one of the most dangerous and successful phishing attacks as hundreds of employers and tens of thousands of employees fell victim to the scheme in the past year, the IRS said. “This scam is such a threat to taxpayers that a special IRS reporting process has been established.”

All employers are at risk, the IRS said.

“In 2017, the W-2 scam made victims of businesses large and small, public schools and universities, as well as tribal governments, charities and hospitals. The scam, which grows larger each year, will likely make the rounds again in 2018.”

As part of a recent Security Summit effort, the IRS, state tax agencies and the tax industry working together to fight against tax-related identity theft and to protect taxpayers.

Because of inroads into stopping stolen identity refund fraud, criminals now need more information to file a fraudulent return, the IRS said.

“That means they need more accurate data about taxpayers, causing them to target tax practitioners, payroll professionals and employers. The Form W-2 contains income and withholding information necessary to file a tax return.”