New Phishing Scam Goes After W-2 Forms Scams & Fraud

Scammers Are Phishing for Your W-2 Form

IRS is telling businesses to guard against this costly scheme

Getty Images This week the IRS warned businesses and their employees to beware of scams in which crooks pose as company owners or executives in an attempt to steal valuable tax and personnel information. The thieves can then use the pilfered W-2 data to file false tax returns or sell the information on the dark web, experts say. “Is it pervasive? Yes,” says Raphael Tulino, an IRS spokesman in San Diego. “We’ve seen a lot of it in the last couple of years, unfortunately.” A W-2 form lists an employee’s annual wages paid and withholdings for income taxes, Social Security and Medicare. Large companies may have cybersecurity software and other tools aimed at stopping criminals in their tracks, but smaller businesses, too, must be vigilant, says attorney Joseph Lazzarotti, an expert in data security at law firm Jackson Lewis in Morristown, N.J. “You see people get duped for a lot of things,” he notes. According to the IRS, the scheme usually works this way: A scammer sends an email pretending to be a company executive. The correspondence may begin with an innocuous, “Hey, you in today?” But by the end of the exchange, the asks for a list of employees and their W-2 statements. For more on how to protect yourself, . The W-2 scam arose in 2016, according to the IRS, which by February 2017 had issued an alert telling businesses that this particular type of had spread and that targets included tribal casinos, temporary staffing agencies, chain restaurants, and shipping and freight firms. Phishing is a fraud technique, usually attempted with an unsolicited email, that tries to lure victims into coughing up their personal or financial information. The IRS says that it has taken multiple steps to weed out phony tax returns and that the W-2 scam is a key way for criminals to try to grab Americans’ refunds. In 2017 the agency estimated that there were 597,000 tax returns filed fraudulently. That’s down from 883,000 confirmed cases in 2016 and 1.4 million in 2015, the IRS said earlier this year. According to an IRS estimate, in 2016 between $1.68 billion and $2.31 billion was paid out in refunds that may have been claimed as a result of identity theft. The money is “likely to be unrecoverable,” the agency said in a report. Using data analytics and partnering with software providers and state tax agencies have helped the IRS identify suspicious filings, according to the agency. Lazzarotti said scams targeting businesses also sometimes feature fictitious wire instructions from a crook (posing as a CEO) who instructs an employee to wire $100,000 to a “client.” His advice to workers? “Pick up the phone and verify” that the putative CEO’s email is legit. Lazzarotti also urges employers not to fixate solely on the possibility of W-2s being compromised because employers maintain a variety of sensitive tax and personnel information. “Other types of forms are vulnerable.”

More on Scams & Fraud

Cancel You are leaving AARP.org and going to the website of our trusted provider. The provider’s terms, conditions and policies apply. Please return to AARP.org to learn more about other benefits. Your email address is now confirmed. You'll start receiving the latest news, benefits, events, and programs related to AARP's mission to empower people to choose how they live as they age. You can also by updating your account at anytime. You will be asked to register or log in. Cancel Offer Details Disclosures

Close In the next 24 hours, you will receive an email to confirm your subscription to receive emails related to AARP volunteering. Once you confirm that subscription, you will regularly receive communications related to AARP volunteering. In the meantime, please feel free to search for ways to make a difference in your community at Javascript must be enabled to use this site. Please enable Javascript in your browser and try again.