Recently a BBB Accounts Payable Staff Member received an email from me, Phil Catlett, CEO of BBB, requesting that she wire money immediately, and to send a reply email to receive further details about where to send the funds. And had she responded to that email it would obviously have never reached me, it'd be headed to some scammer from who knows where.
The past couple of years, BBB has been hearing about scammers targeting W-2 employee tax forms.
W-2 forms have everything needed to file a fraudulent tax refund request, including the employer name, employer ID, address, taxpayer address, Social Security number and information about 2016 wages and taxes withheld.
The IRS just issued a warning that scammers are seeking W-2 information in order to file fraudulent tax refund requests. School districts, healthcare organizations, chain restaurants, temporary staffing agencies, tribal organizations and nonprofits are all mentioned in the IRS information as targets.
It could happen to any of us, but scammers don’t just stop after they get access to your sensitive information. The IRS reports that after they get your personal information, the W-2 scammers send an email to the payroll or comptroller of a company requesting that a wire transfer be made to a certain account.
“This is one of the most dangerous email phishing scams we’ve seen in a long time,” said the IRS Commissioner. “Although not tax related, the wire transfer scam is being coupled with the W-2 scam email, and some companies have lost both employees’ W-2s and thousands of dollars.” It is also being reported that scammers are selling 2016 employee W-2 forms that were stolen from victim organizations, peddling individual W-2 tax records for anywhere between $4 and $20 apiece.
The IRS says organizations who received or fell victim to a W-2 scam email should:
+ Forward the email to email@example.com and place “W-2 Scam” in the subject line.
+ File a complaint with the Internet Crime Complaint Center (IC3,) operated by the FBI.
+ Employees whose W-2 forms have been stolen should file a Form 14039 Identity Theft Affidavit if the employee’s own tax return rejects because of a duplicate Social Security number or if instructed to do so by the IRS.
But the simplest and best way for individuals to avoid becoming a victim of tax refund fraud is to file your taxes before criminals do it. To reduce risk of businesses being hit by these frauds, use two-factor authentication for email, such as telephone calls to verify significant banking transactions. BBB advises that any information about employee activities listed on your websites or in social media can make you more vulnerable as well.