Report scams to the IRS
When employers report W-2 theft incidents immediately to the IRS, the IRS can take steps to help protect their employees from tax-related identity theft.
Cybercriminals use email spoofing techniques to disguise a message so it appears to come from an executive at the organization. The email is sent to an employee in the payroll or human resources departments asking for a list of all employees and their Forms W-2. This scam is sometimes known as business email compromise (BEC) or business email spoofing (BES).
The scam is spreading
The Form W-2 email phishing scam, which first appeared last year, is circulating earlier in the tax season and has now evolved beyond the corporate world and is reaching other types of organizations, including school districts, tribal casinos, nonprofits, chain restaurants, temporary staffing agencies, healthcare and shipping and freight. Those businesses that received the scam email last year also report receiving it again this year.