W-2 phishing scams: how to protect payroll data in tax season

Every January, payroll teams send out Forms W-2, and every year criminals try to get a copy first. The W-2 scam doesn't break into your systems. It asks, politely, in an email that seems to come from the boss. This guide covers the W-2 request scam, fake IRS emails, attacks on tax preparers, and exactly what to do if employee data has already gone.

What is the W-2 phishing scam?

The IRS describes it as a form of business email compromise (BEC). Criminals use spoofing techniques to make an email "appear as if it is from an organization executive." It goes to payroll or human resources and asks for "a list of all employees and their Forms W-2" (IRS).

A typical message is short:

Hi Sarah, are you in today? I need the 2025 W-2s for all staff in PDF for a review with the accountants. Please send them to me before 3pm.

The IRS has noted that these emails "may start with a simple, 'Hey, you in today?'" and use subject lines with words like "review" or "request" (IR-2017-197). That warning is archived, but the pattern still shows up because it still works.

Why W-2 data is so valuable

A Form W-2 holds everything needed to file a fake tax return: name, address, Social Security number and wages. The IRS says criminals try "to quickly take advantage of their theft, sometimes filing fraudulent tax returns within a day or two." Stolen W-2s can also be sold or used to open credit in employees' names.

Why it works

• It looks like a normal request. Payroll staff answer W-2 questions all season.
• It comes from authority. Few people want to delay the CEO or CFO.
• Nothing looks technical. There's often no link and no attachment, so nothing for a filter to detonate.
• The theft can stay hidden. In 2017 the IRS said victims who believed they were helping a superior might not notice for weeks.

In 2017 the IRS also warned that W-2 scammers were following up with a second request: a wire transfer (IR-2017-20). The same verification rule should cover both. Our guide to business email compromise explains the wider pattern, and payroll diversion scams cover the related trick of redirecting someone's salary.

What other tax-season phishing should you expect?

W-2 requests aren't the only tax-themed emails that reach businesses.

Fake IRS emails

The first item on the IRS's 2026 Dirty Dozen list (IR-2026-30, March 5, 2026) is IRS impersonation by email and text. The IRS says scammers "send emails, direct messages (DMs), and texts that appear to be from the IRS", and the release says some use QR codes that lead to fake IRS sites.

The rule to teach staff is simple. The IRS's reporting page says: "We never email without your permission." Its data theft page adds that the IRS "doesn't initiate contact with taxpayers by email, text messages or social media channels" to request personal or financial information. An unexpected "IRS" email about a refund, an audit or an account check is a scam.

Phishing aimed at tax professionals

Accountants and tax preparers hold W-2s for many clients, which makes them a richer target. Item 11 on the 2026 list is spear-phishing of tax professionals with "new client" or "document request" emails "that deliver malicious links or attachments to steal client data."

The IRS and its Security Summit partners repeated the warning in IR-2026-85 (August 4, 2026). It describes new client scams, spear phishing, clone phishing (a copy of a genuine email resent with a malicious link or attachment) and whaling aimed at leaders and offices such as payroll, HR and finance. Its "Security Six" protections include multi-factor authentication, which it notes is a requirement under the FTC Safeguards Rule. If that rule applies to your firm, see the FTC Safeguards Rule and email security.

How do you stop W-2 phishing before it works?

The IRS's prevention advice is about process, not technology: have "two people review any distribution of sensitive W-2 data or wire transfers," require "a verbal confirmation before emailing W-2 data," and train payroll and HR staff about the scam (IR-2017-197).

A W-2 request policy for HR and payroll

1. Limit who can release W-2 or SSN data. Name two or three people. Everyone else forwards requests to them.
2. Never email bulk W-2s or SSN lists in response to an email. Accountants and auditors should get them through your payroll system or a secure portal.
3. Call to confirm. Use a number from your directory, never one in the email. A message from the CEO's own address still gets a call, because accounts can be compromised.
4. Require a second person to approve any bulk release of employee data and any wire transfer.
5. Treat urgency as a warning sign. "Before 3pm" or "I'm in a meeting, just send it" are reasons to slow down.
6. Tell staff the rule out loud. If the CEO knows a call will follow every W-2 request, nobody needs to feel awkward making it.

Technical controls that help

Email controls reduce how many of these messages reach payroll in the first place.

• Enforce DMARC on your own domain so an attacker can't send mail that passes as exactly ceo@yourcompany.com. See stop spoofing of your domain, and check your record with the DMARC Checker.
• Flag external mail and display-name tricks. Many W-2 requests come from a free webmail account with the CEO's name in the display name. Display name spoofing explains how to catch it.
• Watch for lookalike domains, such as yourcompany-hr.com, in replies and Reply-To headers. The Email Header Analyzer shows where a reply would really go.
• Protect payroll mailboxes with MFA, so a stolen password can't be used to send a request from inside.

No filter catches every polite one-line email from a compromised account. The phone call is the control that does.

What should you do if W-2 data was already sent?

Act the same day. The IRS and states set up a special reporting process because fraudulent returns can follow within days.

1. Email the IRS at dataloss@irs.gov. Use the subject line "W-2 data loss" and include your business name, the EIN connected to the loss, a contact name and phone number, a summary of how the loss happened and the number of employees affected. The IRS says: "Don't attach any employee personally identifiable information." (IRS report phishing page)
2. Report the phishing email to phishing@irs.gov with the subject "W-2 scam", and say you were a victim. Attach the original email as a file or use "forward as attachment" so the headers are kept.
3. Contact the states. The IRS's data theft page says to email statealert@taxadmin.org for instructions from the Federation of Tax Administrators on reporting to state tax agencies.
4. File a complaint with the FBI at ic3.gov. You may also be asked to report to local police.
5. Check for a second request. If a wire transfer or gift card request followed, call your bank immediately.
6. Find out how the email got in. If it came from a real internal account, treat it as a compromise: reset the password, revoke sessions and look for forwarding rules. Our guide to signs an email account is compromised has the checklist.
7. Check your notification duties. The FTC's Data Breach Response guide notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of breaches involving personal information. Talk to your legal adviser about what applies to you.

Tell your employees what to do

Notify affected employees quickly so they can protect themselves. The IRS suggests employees:

• Place a fraud alert with one of the three credit bureaus, and consider a credit freeze.
• Report the identity theft to the FTC and follow its recovery steps.
• Read the IRS identity theft guide.

Also point them to the Identity Protection PIN. The IRS describes it as "a six-digit number that prevents someone else from filing a tax return using your Social Security number." Anyone with an SSN or ITIN who can verify their identity can get one. The fastest route is the IRS online account, and a new IP PIN is generated each year.

How do you report a W-2 scam email you didn't fall for?

Reporting helps the IRS warn others, even if nothing was lost. The IRS asks you to send the email to phishing@irs.gov with the subject line "W-2 scam", as an attached email file or "forward as attachment" rather than a plain forward. You can also report it to IC3. Don't attach Social Security numbers or W-2s.

For fake IRS emails aimed at individuals, use the subject "IRS" (or "Treasury" for a Treasury-themed scam). Tax professionals who receive targeted phishing use the subject "Spearphishing". Then use your normal internal process: the report button in Outlook or Gmail, so your filter learns too. Our guide to reporting phishing emails covers the buttons in each mail app.

Next steps

• Write a one-paragraph W-2 and SSN release policy this week, and get your CEO and CFO to sign off on the callback rule.
• Move W-2 delivery to accountants and auditors into your payroll platform or a secure portal.
• Check your domain's DMARC policy with the DMARC Checker, and plan the move to enforcement if it's still at p=none.
• Add W-2 requests and fake IRS emails to your next security awareness session, before January.
• Filtering helps with the volume: iBlockSpam adds spoofing and phishing protection at the MX level for the whole domain. See how it works.

Browse our other phishing and threat guides.