February marks the start of tax season. Accountants and bookkeepers begin preparing reports, and attention shifts to W-2s, 1099s, and key deadlines.
A convincing email scam is often the first challenge people encounter during tax season, rather than a missing form.
Understanding the W-2 scam
Here is how the scam typically unfolds:
A payroll or HR employee receives an email that appears to come from the owner, CEO, or another senior leader. The message is typically short and urgent:
“Can you send me copies of all employee W-2s for my meeting with the accountant? I’m tied up today, so ASAP would help.”
At first glance, the request seems routine. During tax season, such inquiries are common and do not appear suspicious. However, these messages are often sent by someone impersonating an executive, using a spoofed address or a similar-looking domain. If W-2s are sent, attackers gain access to sensitive employee data, including names, Social Security numbers, addresses, and wage information.
Many organizations remain unaware of the breach until an employee attempts to file taxes and receives a rejection notice indicating a return has already been filed for their Social Security number.
At that stage, the employee must navigate IRS identity theft procedures, while the company manages a preventable data exposure. Although the financial impact affects the individual, the loss of trust affects the employer.
This scam is effective because it aligns with the timing and context of tax season:
- Timing makes it believable. W-2 requests are expected in February.
- The request is plausible. It’s a document leaders and accountants really do ask for.
- A sense of urgency is typical. Phrases like “I’m slammed, can you send it quick?” are common in the workplace.
- Impersonation techniques are improving. Attackers research names and roles to make emails appear legitimate.
- People want to be helpful. Especially when the email appears to come from leadership.
Five practical ways to reduce the risk
Fortunately, this risk is largely preventable, and effective measures do not require complex tools.
- Make a “no W-2s by email” rule.
W-2s and similar payroll documents should never be sent as email attachments. Use a secure portal or an approved internal process for sharing these documents. - Verify sensitive requests using a second channel.
If you receive a request for payroll data, verify it by phone, chat, or in person using contact information you already possess, not details provided in the email. - Do a quick tax-season reminder with the right teams
A brief meeting with payroll, HR, and staff who handle employee records is valuable. Share examples of these messages and establish clear “pause and verify” procedures. - Require MFA for payroll and HR systems.
Multi-factor authentication should be required for all systems storing employee data. While it may not prevent every scam, it limits potential damage if credentials are compromised. - Normalize verification as a good practice.
Encourage your team to verify requests without hesitation. The aim is to make quick confirmation a standard business practice, not an inconvenience.
The W-2 scam is one of several tax-season themes that show up every year: fake IRS notices, tax software “update” emails, messages that appear to come from your accountant, and invoices timed to look like normal seasonal expenses.
Organizations that avoid these issues typically have simple controls in place and teams that are comfortable verifying unusual requests.
Want a quick review?
We can do a short Tax Season Security Check to review a few essentials:
- Payroll/HR access and MFA
- How W-2s and employee records are shared
- Basic email protections against spoofing
- One or two policy adjustments that close common gaps
Tax season is already demanding. Having a clear process for handling sensitive requests streamlines operations for everyone.
____________________________________________
About The Mac Guys: We support small businesses that run on Macs, iPhones/iPads, and Apple services. Our focus is practical reliability: setup, troubleshooting, maintenance, security basics, and workflow improvements.
Need help? Contact The MacGuys+ at 763-331-6227
Top-notch IT support for Mac-based businesses in Minneapolis, St. Paul, Twin Cities Metro, Western WI, and beyond. Enjoy seamless nationwide co-managed Mac IT support for a flexible work-anywhere experience.
