IRS Warns about a Tax Scam Before Criminals Can Strike

The IRS is inundated with scam activity every year, from fraudulently filed tax returns to tax refund theft to victim calls about threatening phone calls. There is so much tax-related scam activity, in fact, that this year the agency is issuing widespread warnings about what the public can do to help minimize the threat.

One such warning has already been issued for this filing season, and it involves one of the easiest ways to steal numerous tax identities at once. It affected hundreds of businesses and thousands of individual victims last year, largely because it requires almost no skill to pull off.

The scam involves W-2 forms, the document that individuals use to report their income to the IRS. Using a little information that’s readily available online, a scammer creates a fake email address that masks the company’s real one—like using a number 0 in place of the letter O in the name, or a capital I instead of a lowercase L—and reaches out to an employee in the company, pretending to be the boss. Some reports of this scam have even said the scammer struck up a conversation at the beginning, starting with messages like, “You at your desk right now?”

Once the employee answers, the scammer claims to need all of the W-2 forms sent over as an attachment. Sadly, it’s too easy to comply; when the boss says do something, it’s literally your job to do it. They send all the requested forms back to the “boss,” and probably don’t give it another thought.

Until everyone in the company becomes the victim of tax refund fraud, that is. Even worse, the information on the W-2 forms is sufficient to steal all of their identities in other ways, too, such as opening a new credit card or filing for government disability benefits.

Preventing this crime is easy, almost ridiculously easy: just don’t comply. The IRS is urging businesses of every size to understand this threat of “phishing” and make a company-wide policy about sharing sensitive information, even if it looks to be inside the company. All an employee has to do to prevent the loss of the company’s data is pick up the phone and call the boss before following any potentially sensitive requests…once they have verbal confirmation, then it’s safe to send over any requested documents.

However, it’s just as likely that the boss will answer, “What do you mean? I didn’t request the W-2 forms!” Then you’ll know you’re dealing with a scammer. If that occurs, it’s a good idea to report it to the authorities and the IRS so they can help get the word out.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.