(Updated: December 6, 2018: See additional warning below.)

The Internal Revenue Service (IRS) issued an urgent alert yesterday (February 2, 2017) to all employers regarding the return of a phishing scam called “The Form W-2 email.” The scam, seen during previous tax seasons, has now spread from targeting small businesses to all employers, including non-profits. The W-2 scammers are also coupling their efforts to steal employee W-2 information with an older wire transfer scheme that is victimizing some organizations twice.

“This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns. We need everyone’s help to turn the tide against this scheme.’’

IRS Commissioner John Koskinen

How the scam works

Cyber criminals use various spoofing techniques to disguise an email so that it appears to be from a company  executive and is a request for information like W-2 data and even social security numbers.

How do they get employee addresses? An email is sent to an employee in the payroll or human resources departments, requesting a list of all employees and their Forms W-2.

Those businesses that received the scam email last year also are reportedly receiving it again this year.

The scam reappeared last week and has seen an upswing in reports in recent days.

New twist to W-2 scam: Companies also being asked to wire money

In the latest twist, the cybercriminal follows up with an “executive” email to the payroll or comptroller and asks that a wire transfer a be made to a certain account.

Although not tax related, the wire transfer scam is being coupled with the W-2 scam email and some companies have lost both employees’ W-2s and thousands of dollars due to wire transfers.

What to do

• The IRS urges all employers to share information with their payroll, finance and human resources employees about the W-2 and wire transfer scam.
• Organizations receiving a W-2 scam email should forward it to [email protected] and place “W2 Scam” in the subject line.
• Organizations that receive the scams or fall victim to them should file a complaint with the Internet Crime Complaint Center (IC3,) operated by the Federal Bureau of Investigation.
• Employees whose Forms W-2 have been stolen should review the recommended actions by the Federal Trade Commission at or the IRS.
• Employees should file a Form 14039, Identity Theft Affidavit, if the employee’s own tax return rejects because of a duplicate Social Security number or if instructed to do so by the IRS.

2018 IRS ALERT

Small businesses should be on-guard against a growing wave of identity theft and W-2 scams. Employers hold sensitive tax data on their employees – such as Form W-2 data – which is highly valued by identity thieves.

All employers are targets for the W-2 scam. This scheme has become one of the more dangerous email scams. Here’s how it works:

These emails appear to be from an executive or organization leader to a payroll or human resources employee.

The message usually starts with a simple greeting, like: “Hey, you in today?”
By the end of the email exchange, all of an organization’s Forms W-2 for their employees may be in the hands of cybercriminals.

Because payroll officials believe they are corresponding with an executive, it may take weeks for someone to realize a data theft has occurred.

Generally, the criminals are trying to quickly take advantage of their theft, sometimes filing fraudulent tax returns within a day or two.

This scam is such a threat to taxpayers that a special IRS reporting process has been established. Here’s an abbreviated list of how a business should report these schemes. They should:

Email [email protected] to notify the IRS of a W-2 data loss and provide contact information. In the subject line, type “W2 Data Loss” so that the email can be routed properly. The business should not attach any employee personally identifiable information data.

Email the Federation of Tax Administrators at [email protected] to get information on how to report victim information to the states.

File a complaint with the FBI’s Internet Crime Complaint Center. Businesses and payroll service providers may be asked to file a report with their local law enforcement agency.
Notify employees. The employee may then take steps to protect themselves from identity theft. The Federal Trade Commission’s www.identitytheft.gov provides guidance on general steps employees should take.

Forward the scam email to [email protected].