26 January 2017 IRS warns that payroll phishing email scam has returned Last year, several businesses and taxpayers were victims of a new email phishing scam that "spoofed" payroll and human resources professionals into responding to requests for Form W-2 information and Social Security numbers. The IRS issued a notice warning employers and state tax agencies to be aware of the scam. (IRS news release, IR-2016-34.) Now the IRS has announced that the email phishing scam has returned for a second round. (IR-2017-10, January 25, 2017.) In 2016, the IRS announced that cybercriminals posing as company executives issued emails to payroll and human resources professionals soliciting Forms W-2 data containing Social Security numbers and other personal identifiable information. According to the IRS, the scheme claimed several victims and was part of a 400% surge in phishing emails last year. — Kindly send me the individual 2016 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review. — Can you send me the updated list of employees with full details (name, Social Security number, date of birth, home address, and salary)? — I want you to send me the list of W-2 copies of employees wage and tax statement for 2016, I need them in PDF file type. You can send it as an attachment. Kindly prepare the lists and email them to me ASAP. Payroll and human resources professionals should review closely any email requests for sensitive information and make it a habit never to email personally identifiable information by using the email reply option. Instead, use intercompany email directories to confirm and fulfill requests for information from authorized company personnel. If businesses receive an unsolicited email that appears to be from either the IRS e-services portal or an organization closely linked to the IRS, report it by sending it to phishing@irs.gov. Learn more by going to the IRS Report Phishing and Online Scams page.
Document ID: 2017-0176 | ||||||||||||||||||||
