It’s February.
Tax season is ramping up. Accountants are booked. Bookkeepers are gathering documents. Everyone is focused on W-2s, 1099s, and deadlines.
What rarely makes the calendar?
The first real tax-season problem most businesses face isn’t a form—it’s a scam.
And one scam, in particular, shows up early every year because it’s simple, believable, and aimed directly at small businesses. There’s a good chance it’s already landed in someone’s inbox.
The W-2 Scam: How It Actually Happens
Here’s the typical setup:
Someone in your organization—usually payroll or HR—receives an email that appears to come from the CEO, owner, or a senior executive.
The message is short and urgent:
“Hey, I need copies of all employee W-2s for a meeting with the accountant. Can you send them ASAP? I’m slammed today.”
Nothing about it feels strange.
Tax season is busy. The request is reasonable. The tone sounds right.
So the employee sends the W-2s.
Except the email didn’t come from the CEO.
It came from a criminal using a spoofed email address or a look-alike domain.
And just like that, the attacker now has every employee’s:
- Full legal name
- Social Security number
- Home address
- Salary information
Everything needed for identity theft.
Everything needed to file fraudulent tax returns—before your employees do.
How Businesses Find Out
This is usually how it surfaces:
An employee files their tax return.
It gets rejected: “A return has already been filed for this Social Security number.”
Someone else claimed the refund. The money is gone.
Now that employee is dealing with the IRS, credit monitoring, identity theft reports, and months of paperwork—because of a document they didn’t even know had been shared.
Now multiply that by your entire payroll.
That’s not just a security incident.
It’s a trust issue. An HR crisis. A potential legal problem. A reputational hit.
Why This Scam Works So Well
This isn’t an obvious phishing email. It succeeds because:
- The timing is perfect. W-2 requests are normal in February.
- The request is reasonable. This is information that really does get shared.
- The urgency feels legitimate. Busy leaders ask for quick help all the time.
- The sender looks real. Criminals research names, roles, and relationships.
- Employees want to help. Especially when the request appears to come from the boss.
Urgency overrides verification—and attackers count on that.
How to Protect Your Business (Before This Happens)
The good news: this scam is highly preventable. It’s more about policy and culture than expensive tools.
- No W-2s via email. Period.
Sensitive payroll documents never leave the organization as email attachments—no exceptions. - Verify sensitive requests using a second channel.
Phone call. In person. Chat. Anything except replying to the email. Use contact info you already trust. - Hold a 10-minute tax-scam huddle now.
Show payroll and HR teams what these scams look like and what to do. Awareness is cheap insurance. - Lock down payroll and HR systems.
Enable multi-factor authentication anywhere employee data lives. MFA stops stolen credentials cold. - Reward verification, don’t discourage it.
Employees who double-check—even with executives—should be praised, not questioned.
Five steps. Easy to implement this week. Strong enough to stop the first wave.
The Bigger Picture
The W-2 scam is just the opening act.
Between now and April, expect:
- Fake IRS notices demanding urgent payment
- Phishing emails posing as tax software updates
- Spoofed messages from “your accountant”
- Fraudulent invoices timed to look tax-related
Criminals love tax season because everyone is busy, distracted, and moving fast.
Businesses that make it through clean aren’t lucky—they’re prepared.
Is Your Business Ready?
If you already have policies, training, and safeguards in place, you’re ahead of most small businesses.
If not, now is the time—before the first incident.
If this sounds like your organization, book a 10-minute discovery call and we’ll review:
- Payroll and HR access controls and MFA
- W-2 handling and verification rules
- Email protections against spoofing
- The one policy gap most businesses miss
If it doesn’t sound like you, chances are you know a business owner it does sound like. Forward them this article. It could save them a very expensive headache.
Book your 10-minute discovery call here!
Because tax season is stressful enough without identity theft on top of it.