# W-2 phishing scams: how to protect payroll data in tax season

URL: https://iblockspam.com/blog/w2-tax-season-phishing
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How W-2 phishing scams trick HR into sending employee tax data, how fake IRS emails work, where to report them, and the steps to take if W-2s were already sent.

## Short answer

A W-2 phishing scam is an email that pretends to come from an executive and asks payroll or HR for every employee's Form W-2 or Social Security number. Never send W-2 data because of an email; confirm by phone. If data was sent, email dataloss@irs.gov, forward the scam to phishing@irs.gov and file at ic3.gov.

Every January, payroll teams send out Forms W-2, and every year criminals try to get a copy first. The W-2 scam doesn't break into your systems. It asks, politely, in an email that seems to come from the boss. This guide covers the W-2 request scam, fake IRS emails, attacks on tax preparers, and exactly what to do if employee data has already gone.

## What is the W-2 phishing scam?

The IRS describes it as a form of business email compromise (BEC). Criminals use spoofing techniques to make an email "appear as if it is from an organization executive." It goes to payroll or human resources and asks for "a list of all employees and their Forms W-2" ([IRS](https://www.irs.gov/newsroom/form-w-2-ssn-data-theft-information-for-businesses-and-payroll-service-providers)).

A typical message is short:

> Hi Sarah, are you in today? I need the 2025 W-2s for all staff in PDF for a review with the accountants. Please send them to me before 3pm.

The IRS has noted that these emails "may start with a simple, 'Hey, you in today?'" and use subject lines with words like "review" or "request" ([IR-2017-197](https://www.irs.gov/newsroom/national-tax-security-awareness-week-no-4-employers-payroll-officials-avoid-the-w-2-email-scam)). That warning is archived, but the pattern still shows up because it still works.

### Why W-2 data is so valuable

A Form W-2 holds everything needed to file a fake tax return: name, address, Social Security number and wages. The IRS says criminals try "to quickly take advantage of their theft, sometimes filing fraudulent tax returns within a day or two." Stolen W-2s can also be sold or used to open credit in employees' names.

### Why it works

- **It looks like a normal request.** Payroll staff answer W-2 questions all season.
- **It comes from authority.** Few people want to delay the CEO or CFO.
- **Nothing looks technical.** There's often no link and no attachment, so nothing for a filter to detonate.
- **The theft can stay hidden.** In 2017 the IRS said victims who believed they were helping a superior might not notice for weeks.

In 2017 the IRS also warned that W-2 scammers were following up with a second request: a wire transfer ([IR-2017-20](https://www.irs.gov/newsroom/dangerous-w-2-phishing-scam-evolving-targeting-schools-restaurants-hospitals-tribal-groups-and-others)). The same verification rule should cover both. Our guide to [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) explains the wider pattern, and [payroll diversion scams](https://iblockspam.com/blog/payroll-diversion-scam-emails) cover the related trick of redirecting someone's salary.

## What other tax-season phishing should you expect?

W-2 requests aren't the only tax-themed emails that reach businesses.

| Scam | Who it targets | What it wants | Main defense |
|---|---|---|---|
| W-2 or SSN request "from the CEO" | Payroll, HR | All employees' W-2s or SSNs | Phone verification, two-person rule |
| Fake IRS email | Anyone | Logins, personal data, malware | Know that the IRS doesn't start contact by email |
| "New client" or "document request" email | Tax preparers, accountants | Client data, malware | Don't open unexpected files; verify the client |
| Wire request after a W-2 request | Finance | Money | Callback on a known number |

### Fake IRS emails

The first item on the IRS's [2026 Dirty Dozen list](https://www.irs.gov/newsroom/dirty-dozen-tax-scams-for-2026-irs-reminds-taxpayers-to-watch-out-for-dangerous-threats) (IR-2026-30, March 5, 2026) is IRS impersonation by email and text. The IRS says scammers "send emails, direct messages (DMs), and texts that appear to be from the IRS", and the release says some use QR codes that lead to fake IRS sites.

The rule to teach staff is simple. The IRS's reporting page says: "We never email without your permission." Its data theft page adds that the IRS "doesn't initiate contact with taxpayers by email, text messages or social media channels" to request personal or financial information. An unexpected "IRS" email about a refund, an audit or an account check is a scam.

### Phishing aimed at tax professionals

Accountants and tax preparers hold W-2s for many clients, which makes them a richer target. Item 11 on the 2026 list is spear-phishing of tax professionals with "new client" or "document request" emails "that deliver malicious links or attachments to steal client data."

The IRS and its Security Summit partners repeated the warning in [IR-2026-85](https://www.irs.gov/newsroom/security-summit-warns-tax-pros-to-watch-out-for-phishing-emails-and-other-attacks) (August 4, 2026). It describes new client scams, spear phishing, clone phishing (a copy of a genuine email resent with a malicious link or attachment) and whaling aimed at leaders and offices such as payroll, HR and finance. Its "Security Six" protections include multi-factor authentication, which it notes is a requirement under the FTC Safeguards Rule. If that rule applies to your firm, see [the FTC Safeguards Rule and email security](https://iblockspam.com/blog/ftc-safeguards-rule-email-security).

## How do you stop W-2 phishing before it works?

The IRS's prevention advice is about process, not technology: have "two people review any distribution of sensitive W-2 data or wire transfers," require "a verbal confirmation before emailing W-2 data," and train payroll and HR staff about the scam ([IR-2017-197](https://www.irs.gov/newsroom/national-tax-security-awareness-week-no-4-employers-payroll-officials-avoid-the-w-2-email-scam)).

### A W-2 request policy for HR and payroll

1. **Limit who can release W-2 or SSN data.** Name two or three people. Everyone else forwards requests to them.
2. **Never email bulk W-2s or SSN lists in response to an email.** Accountants and auditors should get them through your payroll system or a secure portal.
3. **Call to confirm.** Use a number from your directory, never one in the email. A message from the CEO's own address still gets a call, because accounts can be compromised.
4. **Require a second person** to approve any bulk release of employee data and any wire transfer.
5. **Treat urgency as a warning sign.** "Before 3pm" or "I'm in a meeting, just send it" are reasons to slow down.
6. **Tell staff the rule out loud.** If the CEO knows a call will follow every W-2 request, nobody needs to feel awkward making it.

### Technical controls that help

Email controls reduce how many of these messages reach payroll in the first place.

- **Enforce DMARC on your own domain** so an attacker can't send mail that passes as exactly `ceo@yourcompany.com`. See [stop spoofing of your domain](https://iblockspam.com/blog/stop-email-spoofing-of-your-domain), and check your record with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
- **Flag external mail and display-name tricks.** Many W-2 requests come from a free webmail account with the CEO's name in the display name. [Display name spoofing](https://iblockspam.com/blog/display-name-spoofing) explains how to catch it.
- **Watch for lookalike domains**, such as `yourcompany-hr.com`, in replies and Reply-To headers. The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) shows where a reply would really go.
- **Protect payroll mailboxes with MFA**, so a stolen password can't be used to send a request from inside.

No filter catches every polite one-line email from a compromised account. The phone call is the control that does.

## What should you do if W-2 data was already sent?

Act the same day. The IRS and states set up a special reporting process because fraudulent returns can follow within days.

1. **Email the IRS at dataloss@irs.gov.** Use the subject line "W-2 data loss" and include your business name, the EIN connected to the loss, a contact name and phone number, a summary of how the loss happened and the number of employees affected. The IRS says: "Don't attach any employee personally identifiable information." ([IRS report phishing page](https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages))
2. **Report the phishing email to phishing@irs.gov** with the subject "W-2 scam", and say you were a victim. Attach the original email as a file or use "forward as attachment" so the headers are kept.
3. **Contact the states.** The IRS's [data theft page](https://www.irs.gov/newsroom/form-w-2-ssn-data-theft-information-for-businesses-and-payroll-service-providers) says to email statealert@taxadmin.org for instructions from the Federation of Tax Administrators on reporting to state tax agencies.
4. **File a complaint with the FBI** at [ic3.gov](https://www.ic3.gov/). You may also be asked to report to local police.
5. **Check for a second request.** If a wire transfer or gift card request followed, call your bank immediately.
6. **Find out how the email got in.** If it came from a real internal account, treat it as a compromise: reset the password, revoke sessions and look for forwarding rules. Our guide to [signs an email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) has the checklist.
7. **Check your notification duties.** The FTC's [Data Breach Response guide](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of breaches involving personal information. Talk to your legal adviser about what applies to you.

### Tell your employees what to do

Notify affected employees quickly so they can protect themselves. The IRS suggests employees:

- Place a fraud alert with one of the three credit bureaus, and consider a credit freeze.
- Report the identity theft to the FTC and follow its recovery steps.
- Read the [IRS identity theft guide](https://www.irs.gov/identity-theft-central/identity-theft-guide-for-individuals).

Also point them to the [Identity Protection PIN](https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin). The IRS describes it as "a six-digit number that prevents someone else from filing a tax return using your Social Security number." Anyone with an SSN or ITIN who can verify their identity can get one. The fastest route is the IRS online account, and a new IP PIN is generated each year.

## How do you report a W-2 scam email you didn't fall for?

Reporting helps the IRS warn others, even if nothing was lost. The IRS asks you to send the email to **phishing@irs.gov** with the subject line "W-2 scam", as an attached email file or "forward as attachment" rather than a plain forward. You can also report it to IC3. Don't attach Social Security numbers or W-2s.

For fake IRS emails aimed at individuals, use the subject "IRS" (or "Treasury" for a Treasury-themed scam). Tax professionals who receive targeted phishing use the subject "Spearphishing". Then use your normal internal process: the report button in Outlook or Gmail, so your filter learns too. Our guide to [reporting phishing emails](https://iblockspam.com/blog/report-phishing-email) covers the buttons in each mail app.

## Next steps

- Write a one-paragraph W-2 and SSN release policy this week, and get your CEO and CFO to sign off on the callback rule.
- Move W-2 delivery to accountants and auditors into your payroll platform or a secure portal.
- Check your domain's DMARC policy with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and plan the move to enforcement if it's still at `p=none`.
- Add W-2 requests and fake IRS emails to your next [security awareness session](https://iblockspam.com/blog/email-security-awareness-training-small-business), before January.
- Filtering helps with the volume: iBlockSpam adds spoofing and phishing protection at the MX level for the whole domain. See [how it works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What is the W-2 phishing scam?

It's a business email compromise scam aimed at payroll and HR. The criminal spoofs or imitates an executive's email and asks for a list of all employees and their Forms W-2, or their Social Security numbers. The IRS says thieves sometimes file fraudulent tax returns with the stolen data within a day or two.

### Where do I report a W-2 phishing email to the IRS?

If you didn't reply, send the email as an attachment to phishing@irs.gov with the subject line "W-2 scam". If W-2 data was sent, also email dataloss@irs.gov with the subject "W-2 data loss" and your business details, but no employee personal information. You can also file a complaint at ic3.gov.

### Does the IRS email employers or taxpayers?

The IRS says it doesn't initiate contact by email, text or social media to ask for personal or financial information, and its reporting page says: "We never email without your permission." An unexpected email from the IRS asking you to verify details or claim a refund is very likely fake.

### What should employees do if their W-2 was stolen?

The IRS suggests placing a fraud alert with a credit bureau and considering a credit freeze, reporting to the FTC, and following the IRS identity theft guidance. Each employee can also get an Identity Protection PIN, a six-digit code that stops anyone else filing a return with their Social Security number.

### When does W-2 phishing happen?

It peaks around tax season, when payroll teams expect W-2 questions and data requests look routine. But the IRS has warned for years that tax scams run year-round, and the same email can arrive at any time. Your verification rule for W-2 and SSN requests should apply every month, not only January to April.

## Sources

- [IRS: Form W-2/SSN data theft: Information for businesses and payroll service providers](https://www.irs.gov/newsroom/form-w-2-ssn-data-theft-information-for-businesses-and-payroll-service-providers)
- [IRS: Report fake IRS, Treasury or tax-related emails and messages](https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages)
- [IRS IR-2017-197: Employers, payroll officials, avoid the W-2 email scam (archived)](https://www.irs.gov/newsroom/national-tax-security-awareness-week-no-4-employers-payroll-officials-avoid-the-w-2-email-scam)
- [IRS IR-2026-30: Dirty Dozen tax scams for 2026](https://www.irs.gov/newsroom/dirty-dozen-tax-scams-for-2026-irs-reminds-taxpayers-to-watch-out-for-dangerous-threats)
- [IRS IR-2026-85: Security Summit warns tax pros to watch out for phishing emails and other attacks](https://www.irs.gov/newsroom/security-summit-warns-tax-pros-to-watch-out-for-phishing-emails-and-other-attacks)
- [IRS: Get an Identity Protection PIN (IP PIN)](https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin)
- [FTC: Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/w2-tax-season-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt