This time of year is super busy for payroll professionals. It’s also a busy time for scammers.
Scammers target payroll professionals in the hopes of getting employee W-2 lists, including names, addresses, and Social Security numbers.
Here’s how it works:
- The scammer sends an email to someone on the payroll team.
- The email looks like it came from a company executive.
- The email requests a list of all W-2s and typically indicates some urgency.
- The scammer bets on targeting an employee who is not aware of the signs of a scam and sends the sensitive information.
- The scammer can then file false tax returns to steal refunds or can open credit accounts and charge thousands of dollars to those accounts.
Here’s how to avoid becoming a victim:
- Look at the sender’s name and email address. Often there will be inconsistencies. But don’t stop there if you believe it matches an executive’s information.
- Pick up the phone and call the executive making the request. Use the phone number listed in your company directory and not any phone number included in the email.
- Verify the request verbally before releasing any sensitive information.
- Notify your head of payroll or HR as a precaution.
- Share these tips with everyone in the company who has access to employee W-2 data.
Releasing sensitive employee data is a big deal and can cause employees headaches for months to come as they work to recover from identity theft. Related scams move beyond employee data and target your company’s cash. They include requests for direct deposit account changes, wire transfer requests, and gift card purchase requests. Don’t fall for it!
The IRS has resources for employers to help identify scams and to determine next steps if you’ve become a victim of fraud.
- IRS W-2 scam video
- IRS phishing scams web page
- IRS warning about payroll deposit and wire transfer emails
For additional recommendations for keeping your payroll data secure from both external and internal sources, read our blog post on the top 5 ways to keep your payroll data secure.