Scams Target Taxpayers' Personal Information

The Internal Revenue Service (IRS) has issued an alert to payroll and human resources professionals to beware of a "phishing" email scheme that purports to be from company executives and requests personal information on employees.

Background
The IRS has learned that this scheme--part of the surge in phishing emails seen this year--has claimed victims as payroll and human resources offices mistakenly email payroll data, including Forms W-2, that contains Social Security numbers (SSNs) and other personally identifiable information to cybercriminals posing as company executives.

IRS Criminal Investigation is reviewing cases in which people have been tricked into sharing SSNs with what turned out to be cybercriminals. Criminals using personal information stolen elsewhere seek to monetize data.

Phishing Schemes
This phishing variation is known as a "spoofing" email. It will contain, for example, the actual name of the company chief executive officer (CEO). In this variation, the "CEO" sends an email to a company payroll office employee and requests a list of employees and information, including SSNs.

The following are some of the details contained in the emails:

• Kindly send me the individual 2015 W-2s (PDF) and earnings summary of all W-2 of our company staff for a quick review.
• Can you send me the updated list of employees, with full details (names, SSNs, dates of birth, home addresses, and salaries)?
• I want you to send me the lists of W-2 copies of employees' wage and tax statements for 2015. I need them in PDF file type--you can send them as attachments. Kindly prepare the lists and email them to me ASAP.

Additional Information
The IRS, state tax agencies, and the tax industry are engaged in a public awareness campaign to encourage businesses to do more to protect personal, financial, and tax data. IRS Publication 4524 features additional steps you can take to protect your business.

Preferred Partner of