Wang Solutions

W-2 Corporate Email Scam Still Rampant in 2017

Just because tax season is over doesn’t mean scammers are taking a vacation. In fact, according to IRS Return Integrity Compliance Services Acting Director Tamara Powell, the W-2 scammers never left and are still victimizing HR and payroll departments across America.

The W-2 scam first reared its head in 2016, and after a brief hiatus, returned with a vengeance at the beginning of 2017. As a result, the number of organizations that fell prey to this insidious email scam that involves identity thieves posing as company bigwigs jumped big time this year – and the thieves are showing no signs of stopping. Basically, if it ain’t broke, cybercriminals are going to keep using it.

It’s worthwhile to recap how the scam works, so everyone knows what to look out for: via e-mail, the swindlers will pose as a company’s corporate officer – real name and all – and request employee Form W-2s from the company’s HR and/or payroll department. Once the thieves get their dirty paws on the W-2s, which include private details like employee SSNs, names, and income info, they use the info to file fraudulent tax returns for refunds.

In the first third of 2017, a whopping 870 organizations reported that they received a W-2 phishing e-mail. That’s a big number considering that only about 100 companies reported being the unlucky recipients during the same time frame last year. Even worse, whereas only 50 organizations fell victim to the scam and lost data in 2016, around 200 lost data this time around, which could translate into headaches for hundreds of thousands of taxpayers. The bottom line is that the scam got worse this year.

The problem is that the data breaches usually get discovered weeks or months after they first happen, at which point the criminals have already sold the data on the dark web or used it for their own nefarious purposes. According to Powell, identity theft criminals have a big budget and are technically sophisticated, and they start prepping for the filing season even before the IRS does.

The best defense against this phishing scam is awareness, so spread the word to all of your HR/payroll colleagues, friends, family, acquaintances that there’s a bad scam still on the loose!