A new year is upon us and that means the tax filing season has begun. For those who have employees you know that W-2s must be issued by January 31.The W-2 contains information regarding your employees which is greatly coveted by identity thieves. The IRS is warning small businesses about a new scam specifically targeting employers and W-2s. The IRS has identified this scam as one of the more dangerous ones. The scam works as follows:

1. The scammer will send an e-mail to a payroll or human resource employee. The e-mail will appear to come from someone in authority such as an executive or supervisor of the employee.
2. The e-mail will be friendly and casual and may say things such as “I am analyzing some reports and need copies of the W-2s issued last year” or “I need last year’s W-2s for a meeting with the accountant”.
3. The employee, who thinks the e-mail is coming from an authorized person, will send the W-2s right into the cybercriminal’s inbox.

The scammer, having your employee’s information, will, within a few days of receiving the W-2 information, file a fraudulent tax return requesting a refund. Due to the damage that such a scam can cause taxpayers, the IRS has established a special reporting process. If your business is a target of one of these scams, you need to do the following:

A. Send an e-mail to [email protected] to notify the IRS of the scam. The subject line should be “W2 Data Loss”. Provide your contact information, but do not provide any employee personal information.

B. E-mail the Federation of Tax Administration at [email protected] in order to obtain information on how to report victim information to your state.

C. File a complaint with the FBI’s Internet Crime Complaint Center.

D. Notify all affected employees so they can protect themselves against identity theft.

E. Forward the e-mail sent by the scammer to [email protected].

A second scam involves an e-mail which appears to come from an employee whose paycheck is directly deposited to a bank account. In the e-mail the employee will provide a new bank account and routing number and ask that payroll checks be deposited to the new account. Of course, the bank account is controlled by the scammer. Although the scam is generally discovered pretty quickly, the employee will have lost a couple of paychecks.

A third scam is also occurring to businesses which send out wire transfers. An e-mail will be sent to the person responsible for the wire transfer which will appear to be coming from the person in charge. The e-mail will request that the funds be wired into a specific account which is controlled by the scammer.

The IRS has warned that these scams can take many forms such as fake invoice payments, title escrow payments and any other transfer which can result in a quick payoff for the scammer. The IRS has found that many of the e-mails involve spelling and grammatical errors.

Of course, the best way to protect your business and your employees from these scams is to be alert and to educate your employees and payroll service provider. You can do this by reviewing your company’s policy for sharing employee data and issuance of payments. You may want to consider requiring two people to review the request for the data or changes to account information to determine its legitimacy before any employee information is disseminated or transfers made. Lastly, call or request a meeting with the person requesting the information or change to determine if the request is valid.