Phishing Hackers Targeting W-2s This Tax Season

By Mike Grant, Principal & Director, Data Breach Practice and Brad Hering, Marketing Executive

clock February 27, 2017 at 2:00 PM

phishing blog graphic.jpgLast year, the IRS estimated income tax fraud would cost taxpayers roughly $21 billion[1]. The upcoming tax season is expected to bring more losses from phishing scams due to the amount of personal information (W-2s, tax returns, social security numbers, etc.) circulating during tax season and the increased sophistication of the attacks.

Hackers use phishing emails to convince employees (typically in the Human Resources or Finance departments) to send over personal information about employees, often by email. These types of emails are deceiving, with many disguised to look like they are coming from company executives, such as the CEO. Once received by the hacker, this personal information allows them to file a tax return, cash in on someone’s tax refund or steal their identity.  The process is quick as hackers have machines set up to take advantage of this information almost as soon as they receive it.

Common Phishing Emails

The IRS reported that the following are some common phishing emails to look out for:[2]

  • “Kindly send me the individual 2015 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review.”
  • “Can you send me the updated list of employees with full details (Name, Social Security Number, Date of Birth, Home Address, Salary).”
  • “I want you to send me the list of W-2 copy of employees wage and tax statement for 2015, I need them in PDF file type, you can send it as an attachment. Kindly prepare the lists and email them to me asap.”

Reducing Your Risk

Beazley Group, one of the insurance industry’s leading underwriters and experts in cyber risk, suggests taking the following actions to reduce the chance of a successful scam.

  1. Inform employees about this kind of scam, especially those with access to this type of information. Payroll and human resources professionals are common targets.
  2. Implement a procedure for how W-2 information should be accessed and alert employees.
  3. Teach employees best practices for identifying a phishing email.

For more information about the cyber security landscape, download the 2016 MMC Cyber Handbook.

New Call-to-action

[1] Source: https://www.scmagazine.com/phishing-w-2-scams-will-boost-2016-income-tax-fraud-losses-to-21-billion/article/528952/

[2] Source: IRS Alerts Payroll and HR Professionals to Phishing Scheme Involving W-2s, IRS, 2016 https://www.irs.gov/uac/newsroom/irs-alerts-payroll-and-hr-professionals-to-phishing-scheme-involving-w2s

Topics: Property + Casualty, Cyber & Data Security, Technology

Subscribe to the Blog

Follow Us


Search Blog