Beware of Another W-2 Scam
By John Bowlby, Staff Accountant, Tax & Business Services
On August 15, 2017, the Internal Revenue Service reiterated a warning urging businesses to be wary about a proliferating W-2 email scam. The alert updated a prior warning about the scam first issued in 2016, when the IRS identified an emerging scheme. The scam is carried out by cybercriminals posing as a business’s leaders and requesting, via email, W-2 information from the business’s human resources or payroll departments. The nefarious emails closely resemble a company’s internal emails, so the recipient would not suspect that the request for a W-2 is not a legitimate inquiry. The perpetrators are often successful in obtaining names, addresses, social security numbers, and other information based on these phony emails.
The cost is high to businesses and their employees, as the stolen information can be used in any number of identity theft schemes.
The scammers contact payroll departments that are already expecting to receive emails requesting W-2s and other tax-related information. The emails typically use a technique called “spoofing” wherein an email is sent from an address that is easily mistaken for a legitimate company address, appearing to come from a company executive or department head. A wide variety of organizations are being targeted, including universities, nonprofits, and governments. Any organization that uses email is a potential target.
The IRS and the FBI, which investigates cybercrimes, have resources available on their websites discussing how to help prevent W-2 email scams. Businesses whose information has been stolen by cybercriminals using W-2 email scams can report the theft by sending an email with “W-2 scam” in the subject line to [email protected].Businesses that have received suspicious emails can alert the IRS by forwarding the email to [email protected], using “W-2 scam” as the subject line.
Since the IRS released its original warning about W-2 email scams in 2016, the number of victims has grown. The August 2017 IRS Warning is a necessary reminder about a problem that seems to be getting worse. According to the IRS, organizations should protect themselves by training employees and by investing in software that can screen suspicious emails.
As the tax season comes to a close this year, Marcum clients who receive emails from a Marcum email address requesting private information are invited to call us to confirm the request’s validity, especially if the email is from an associate to whom you’ve never spoken. Marcum also utilizes a Secure Client Server. All email responses should be sent through the server, and if not, your Firm contact should be notified. We you are available to verify communications you receive from Marcum and to help resolve any questions.
For clients wishing to follow the IRS advice to employ cybersecurity measures, Marcum Technology offers a comprehensive portfolio of solutions designed to repel all types of cyber threats, including the W-2 email scam.
