The scam is growing. The Internal Revenue Service (IRS) has issued an urgent alert to all employers that the form W-2 email phishing scam is now targeting school districts, tribal organizations, and nonprofits. Previously, the scammers had been focusing their energies on for-profit corporations.
Here's how the phishing scam typically works. Fraudsters send a fake email pretending to be from a high-level corporate employee requesting information about employee forms W-2 from a company's payroll or human resources departments. The emails typically ask for the forms W-2 and earnings summary of all W-2 employees or an updated list of employees with their personal details including Social Security Number, home address, and salary. This scam is sometimes referred to as business email compromise (BEC) or business email spoofing (BES).
Just like that, the scammers can literally capture all of the data for an entire company. That's exactly what happened to one popular Indiana-based restaurant chain. A fraudster posing as Scott Wise, the founder of Scotty's Brewhouse, tricked the company's payroll department into sending tax forms belonging to all 4,000 employees.
Once the scammers have tricked the company's payroll or human resources departments into releasing the information, they can use the information to file fraudulent tax returns to obtain bogus tax refunds.
(You can read my prior story on the scam here.)
The scam, which made the rounds last year, initially appeared to target for-profit companies. Now, however, the IRS is reporting that it's ballooning, and affecting more companies, including non-profits like school districts.
"This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns. We need everyone’s help to turn the tide against this scheme," said IRS Commissioner John Koskinen.
Even worse? The scammers have been following up with an another scam. In the second phase, the "executive" email requests that funds be transferred by wire to a certain bank account to cover payroll or other bills. The result is that some companies have handed over their employees' forms W-2s as well as thousands of dollars to identity thieves and scammers.
The IRS, state tax agencies and tax industry partners are urging employers to share information with their payroll, finance and human resources employees about these scams. If you receive one of these scam emails, forward it to phishing@irs.gov with "W2 Scam" in the subject line. Companies that receive these scam emails or have been victimized by these scammers should file a complaint with the Internet Crime Complaint Center (IC3), operated by the Federal Bureau of Investigation. Affected employers and companies should also alert the state tax agencies by notifying StateAlert@taxadmin.org.
Reporting these scams is key. A follow up to an incident report filed by a victim in one of those bogus IRS scam calls has been credited with the eventual arrest of a number of suspects. Every tip helps.
If you are an employee whose form W-2 has been stolen, you should review the recommended actions by the Federal Trade Commission at www.identitytheft.gov or the IRS at www.irs.gov/identitytheft. If your form W-2 was stolen and your tax return is kicked back during tax season, you should file a form 14039, Identity Theft Affidavit (downloads as a pdf).
Don’t fall for the tricks. Keep your personal information safe this tax season by remaining alert. For tips on protecting yourself from identity theft related tax fraud, click here.
