March 01, 2017
The Pennsylvania Department of Revenue and the Internal Revenue Service issued an advisory on Wednesday warning all employers— corporate, educational and nonprofit— of an email phishing scam that requests the W-2 forms of their employees.
An advisory described the scam as an email sent by cybercriminals in the form of a request from an organization executive. The email is received by payroll or human relations employees who are asked to provide a W-2 for each employee in the organization.
“This large-scale theft can give criminals sensitive financial information about employees that can be used to commit various crimes, including tax identity theft by filing a fraudulent tax return in the name of a victim,” said Pennsylvania Secretary of Revenue Eileen McNulty.
According to the IRS, the scam first appeared last year in the corporate world and has since expanded to the realm of public schools, chain restaurants, temp agencies, healthcare organizations and shipping and freight companies.
Scammers sometimes follow up on an initial email with a fake "executive" message to a company's payroll or comptroller staff asking for a wire transfer to a designated account. The IRS has reported cases in which companies gave away their employees' confidential tax information and thousands of dollars in wire transfers.
“We encourage all employers to be on guard and to warn payroll and human resources employees about the scam,” McNulty said.
Employers victimized by this scam should immediately report W-2 thefts to both the Department of Revenue and IRS, which will take immediate steps to help protect employees against tax-related identity theft.
Organizations receiving a W-2 scam email should forward it to both the Department of Revenue at RA-RVPITFRAUD@pa.gov and the IRS at phishing@irs.gov and place “W2 Scam” in the subject line.
