Beware of W2 Phishing

The W-2 provided by your employer is a treasure trove of private information. In addition to how much money you earn, it also reports the amount of federal, state, and other taxes withheld from your pay. In short, your W-2 is a peek into your financial relationship with the company you work for.

Now, imagine that someone wants to use that information for their own purposes. Perhaps they want to file a fraudulent tax return and claim any refund you are due. Maybe they hope to secure a loan and plan to steal your identity in order to do so. Whatever the bad guy’s intentions, you never want your W-2 to land in his (or her) hands.

W-2 phishing is one of the ways criminals attempt to trick unsuspecting taxpayers. The scam frequently works like this: your employer sends you an electronic W-2. Shortly after, you receive an email from someone claiming to be the CEO or head of accounting for the company. The email says that a mistake was made on your W-2 and you need to return it to the sender. Step number one in protecting yourself is to verify who the email is from. Call the office of the person who sent the email to verify that the request is legitimate.

Steps You Can Take to Protect Yourself

• Know your company’s email policies. Most companies have a policy regarding what can and cannot be sent via email. Often, sensitive financial information (like W-2s) cannot be sent electronically. Some companies even outline what their top executives are allowed to ask for via email due to security concerns.
• Be suspicious. Any time you receive an email asking for sensitive information, consider it a red flag. If someone asks you to provide account numbers, passwords, or anything you normally keep private, do not comply with the request.
• Flag scam requests. If you do receive a scam email asking for private information, inform your employer. If the email requests a copy of your W-2, forward it to phishing@irs.gov. Write “W2 Scam” in the subject line.

With tax season upon us, now is the time phishers come alive. According to the Internal Revenue Service, W-2 phishing scams have moved beyond the corporate world and are spreading to other sectors. If you work for a nonprofit, school district, hospital, or even a tribal organization, you should be on the lookout for scammers. The IRS calls the problem, “one of the most dangerous email phishing scams we’ve seen in a long time.”

Although they are asking for information provided by your employer, it is your identity these scammers need. If you can picture the hassle involved in trying to untangle bank loans made in your name, tax refunds sent to someone you don’t know, and a damaged credit score, you understand the value of protecting yourself. It all begins by being vigilant and reminding others in your organization to do the same.