Guidance for employers affected by a W-2 phishing scheme

Cybercriminals, posing as company executives, are emailing payroll and HR professionals to request lists of employees and their personal information. These emails may appear legitimate because they contain, for example, the name of the company’s actual chief executive officer.

What actions should I take?

If you are an employer who has been a victim of this scam and, in response, released any payroll data, such as W-2 information and Social Security numbers, please take the following steps:

1. Notify New York State immediately. Call the Wage Reporting Unit at 518-457-7105 with the following information at hand:
   • your business name;
   • your business EIN;
   • your business address;
   • the tax year for which the information was provided; and
   • the number of employees affected, whether current or prior employees.
2. Notify the IRS and any other taxing jurisdictions where you report wages and withholding.

What happens next?

If your company has been affected by a scam, your employees’ returns will be subject to additional review to protect their information and stop questionable refunds.

Resources

• Visit the IRS:
  • IRS, States and Tax Industry Renew Alert about Form W-2 Targeting Payroll, Human Resource Departments;
  • Form W-2/SSN Data Theft: Information for Businesses and Payroll Service Providers; and
  • report instances of W-2 phishing to DataLoss@IRS.gov.
• Visit the Federation of Tax Administrators (FTA):
  • Fraud? Scam? Phishing?; and
  • report instances of phishing to StateAlerts@taxadmin.org.
• Report fraud, scams, and identity theft
• Tax scams and consumer alerts