The Internal Revenue Service, state tax agencies and the tax industry urges all employers to educate their payroll personnel about a Form W-2 phishing scam that made victims of hundreds of organizations and thousands of employees last year.

The Form W-2 scam has emerged as one of the most dangerous phishing emails in the tax community. During the last two tax seasons, cybercriminals tricked payroll personnel or people with access to payroll information into disclosing sensitive information for entire workforces. The scam affected all types of employers, from small and large businesses to public schools and universities, hospitals, tribal governments and charities.

Reports to phishing@irs.gov from victims and nonvictims about this scam jumped to approximately 900 in 2017, compared to slightly over 100 in 2016. Last year, more than 200 employers were victimized, which translated into hundreds of thousands of employees who had their identities compromised.

The IRS and its partners in the Security Summit effort hope to limit the success of this scam in 2018 by alerting employers immediately. The IRS can take steps to protect employees, but only if the agency is notified immediately by employers about the theft. Last year, the IRS created a new process by which employers should report these scams.

How the scam works

• Cybercriminals do their homework, identifying chief operating officers, school executives or others in positions of authority.
• Using a technique known as business email compromise (BEC) or business email spoofing (BES), fraudsters posing as executives send emails to payroll personnel requesting copies of Forms W-2 for all employees.
• The Form W-2 contains the employee’s name, address, Social Security number, income and withholdings. Criminals use that information to file fraudulent tax returns, or they post it for sale on the Dark Net.
• The initial email may be a friendly, “hi, are you working today” exchange before the fraudster asks for all Form W-2 information. In several reported cases, after the fraudsters acquired the workforce information, they immediately followed that up with a request for a wire transfer.

Best Practices for Employers 

To prevent falling victim of the Form W-2 Scam, employers can:

• Train payroll or finance personnel employees to recognize and report security threats.
• Create a policy to limit the number of employees who have authority to handle Form W-2 requests.
• Require additional verification procedures to validate actual requests before emailing sensitive data such as employee Form W-2s.

If the business or organization victimized by these attacks notifies the IRS, the IRS can take steps to help prevent employees from being victims of tax-related identity theft.

How to notify the IRS if you are a victim

The IRS established a special email notification address specifically for employers to report Form W-2 data thefts. Here’s how Form W-2 scam victims can notify the IRS:

• Email dataloss@irs.gov to notify the IRS of a Form W-2 data loss and provide contact information, as listed below.
• In the subject line, type “W2 Data Loss” so that the email can be routed properly. Do not attach any employee personally identifiable information data.

Include the following:

• Business name
• Business employer identification number (EIN) associated with the data loss
• Contact name
• Contact phone number
• Summary of how the data loss occurred
• Volume of employees impacted

Businesses and organizations that fall victim to the scam and/or organizations that only receive a suspect email but do not fall victim to the scam should send the full email headers to phishing@irs.gov and use “W2 Scam” in the subject line.

Be aware that cybercriminals’ scams are constantly evolving. Employers should be alert to any unusual requests for employee data.

Taxpayers might be eligible for a tax refund and don’t even know it!  Below are four tax credits that can mean a refund for eligible taxpayers:

1. Earned Income Tax Credit. A taxpayer who worked and earned less than $53,930 last year could receive the EITC as a tax refund. They must qualify for the credit, and may do so with or without a qualifying child. They may be eligible for up to $6,318.
2. Premium Tax Credit.Taxpayers who chose to have advance payments of the premium tax credit sent directly to their insurer during 2017 must file a federal tax return to reconcile any advance payments with the allowable premium tax credit. In addition, taxpayers who enrolled in health insurance through the Health Insurance Marketplace in 2017 and did not receive the benefit of advance credit payments may be eligible to claim the premium tax credit when they file.
3. Additional Child Tax Credit. If a taxpayer has at least one child that qualifies for the Child Tax Credit, they might be eligible for the ACTC. This credit is for certain individuals who get less than the full amount of the child tax credit.
4. American Opportunity Tax Credit. To claim the AOTC, the taxpayer, their spouse or their dependent must have been a student who was enrolled at least half time for one academic period. The credit is available for four years of post-secondary education. It can be worth up to $2,500 per eligible student. Even if the taxpayer doesn’t owe any taxes, they may still qualify. They are required to have Form 1098-T, Tuition Statement, to be eligible for an education benefit. Students receive this form from the school they attended. There are exceptions for some students.

Taxpayers need to file a 2017 tax return to claim these credits. If you are unsure of your eligibility to claim the tax credits mentioned in this article, the professionals in our office can help. Call us today.