The IRS is urging vigilance this tax season in avoiding phishing scams for Form W-2s and is providing contact information tools for those who have been breached or suspect that they have.
While there were a little more than 100 reports to email@example.com for suspected scams in 2016, the IRS says that number climbed in 2017 to approximately 900. More than 200 employers were victimized last year, which resulted in compromised identities for hundreds of thousands of employees.
Cybercrooks are fooling people with access to payroll information into giving away sensitive information. All ranges of workforces can be targeted, whether it’s large or small businesses, hospitals, charities or public schools and universities.
In a typical scam, an email comes in the guise of someone in a position of authority within the organization and asks for copies of W-2 data. Because a W-2 contains an employee’s name, Social
Security number, address, income and withholdings, fraudsters use that information to file fraudulent tax returns or attempt to sell it online.
There is a process where employers can report scam attempts so the IRS can take steps to protect affected employees, but time is of the essence when alerting the agency.
Victims of Form W-2 data thefts should email firstname.lastname@example.org a subject line of “W2 Data Loss.” Never attach any personally identifiable data of employees. Include the Business Employer
Identification Number (EIN), a summary of how the data loss occurred and the extent of employees affected.
For all the suggested steps for reporting phishing attacks and attempts, visit “Form W-2/SSN Data Theft: Information for Businesses and Payroll Service Providers.”
Be aware that cybercriminals constantly evolve their scams. Finance and payroll personnel must be alert for all unusual and unexpected requests for employee data.