W-2 / Employee-Data Request BEC
A scammer posing as an executive asks HR/payroll to send employees' W-2s or a payroll data file — harvesting SSNs and wages to file fraudulent tax returns.
Think a message like this reached you? You can check it right now.
What this scam is
Especially around tax season, a fraudster impersonating a company leader emails HR or payroll requesting copies of all employees' W-2 forms or a spreadsheet of payroll data 'for review.' Complying exposes every employee's name, SSN, and wages, which criminals use to file fraudulent tax refunds and commit identity theft. It's a data-theft form of BEC. Verifying any bulk-data request by a known phone number, and never emailing sensitive HR data on request, are the controls.
What it usually looks like
- An 'executive' requesting all employee W-2s or payroll data.
- A tie-in to tax season or 'review.'
- Urgency and a request to email a file.
- A spoofed or hacked sender address.
Common warning signs
- Bulk employee-data requests by email.
- Requests for W-2s or SSNs from 'leadership.'
- Urgency and no verification.
- Slightly-off sender addresses.
Example wording scammers use
“Please send me the W-2s for all employees for my review before the board meeting.”
“I need the payroll spreadsheet with SSNs and wages emailed to me today.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Employees' SSNs and wage data.
- To file fraudulent tax returns.
- Mass identity theft.
What to do
- Verify any bulk-data request with the executive via a known number.
- Never email W-2s/SSNs on request; use secure, verified processes.
- Train HR/payroll on this scam, especially at tax time.
- Report suspicious requests to security.
What to do if you already responded
- Notify affected employees and report to the IRS (dataloss@irs.gov) and ic3.gov.
- Advise employees to watch for fraudulent returns and consider IRS IP PINs.
- Report at reportfraud.ftc.gov.