Tax season: W-2 and payroll email scams

Every tax season, the IRS warns about emails that impersonate people you trust to steal employee tax information or redirect pay.

The W-2 scam. An email that appears to come from an executive or someone in authority asks for a list of all employees' Forms W-2. Thieves use the information to file fraudulent tax returns and claim refunds.

The direct deposit scam. An email that appears to come from an employee, often a senior one, asks payroll or HR to change their direct deposit details to a new bank account. The IRS has published real examples, such as: “I changed my bank and I will like my paycheck DD details changed.” Spelling and grammar mistakes like this are common, but not guaranteed.

How to protect your company

1. Verify by phone or in person before sending W-2 information or changing bank details. Use a number you already have, not one from the email.
2. Be wary of urgency and secrecy. “I need this today” and “keep this between us” are warning signs.
3. Check the sender's address, not just the name.
4. Report it using Report > Report phishing in Outlook, and tell us.

Reporting to the IRS (usually for payroll, HR or finance teams)

• Received a W-2 scam email but didn't respond: save the email as a file, attach it to a new email and send it to phishing@irs.gov with the subject “W2 Scam.” Don't include any employee details.
• Sent W-2 information to a scammer: email dataloss@irs.gov straight away with the subject “W2 Data Loss,” without attaching employee details, and call us on 707-755-8000.
• Either way: file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.