Requests for employee tax forms are a favorite of scammers

How it works

The email looks like it comes from a senior person in the company, often the owner or CEO. It asks someone in HR, payroll or accounting to send a copy of every employee’s annual tax forms, or a list of names, addresses, Social Security numbers and pay.

The forms are exactly what someone needs to file false tax returns and claim refunds in employees’ names, or to open accounts using their identities. The scam is most common in the first months of the year, when tax forms are being prepared.

Sometimes a second request follows, asking for a wire transfer.

What gives it away

• The request is unusual. Executives rarely need every employee’s tax forms sent by email.
• There is urgency or secrecy. “I need this today” or “I’m in meetings, just email it.”
• The reply-to address is different from the sender, or the sender’s address is slightly wrong.

What to do

• Confirm by phone or in person before sending any employee personal data, whoever appears to be asking.
• Do not send tax forms or Social Security numbers by ordinary email. Use a secure, approved method.
• If you already sent them, tell your manager and IT immediately. Employees may need to be warned and identity protection steps taken.