It's February. Tax season is ramping up. Your accountant is buried. Your bookkeeper is pulling documents. Everyone's thinking about W-2s, 1099s, and deadlines.
Here's the part nobody puts on the calendar: the first real tax-season headache usually isn't a form. It's a scam.
And there's one that shows up before April even gets close. You might already have it sitting in someone's inbox right now. 😬
The W-2 Scam: Devastatingly Simple
Here's how it works.
Someone in your company — usually whoever handles payroll or HR — gets an email that looks like it's from the CEO or owner.
The message is short and urgent:
"Hey, I need copies of all employee W-2s for a meeting with the accountant. Can you send them over ASAP? I'm slammed today."
Sounds normal, right? The tone is right. Tax season is busy. The urgency feels natural.
So, your employee sends the W-2s.
Except the email wasn't from the CEO. It was from a criminal using a spoofed address.
And now that criminal has every employee's full legal name, Social Security number, home address, and salary information. Everything needed for identity theft. Everything needed to file fraudulent tax returns before your employees do.
Here's how victims usually find out: An employee files their tax return. It gets rejected — "Return already filed for this Social Security number."
Someone already claimed their refund. Already got the money.
Now multiply that by your entire payroll. Now imagine explaining to your team that their personal information was compromised because someone fell for a fake email.
That's not just a security problem. That's a trust problem. An HR nightmare. A potential lawsuit.
Yikes.
Why This Scam Works So Well
This isn't a Nigerian prince email. It doesn't look fake.
It works because:
- The timing is perfect. W-2 requests are expected in February. Nobody questions it.
- The request is reasonable. It's not "wire $50,000." It's something that actually gets shared during tax season.
- The urgency feels normal. "I'm slammed, can you send this quick?" doesn't raise red flags in a busy office.
- Employees want to be helpful. Especially to the boss. Urgency overrides verification.
How to Protect Your Business (Before This Lands)
The good news: this scam is preventable. And it takes policy + culture more than fancy tech.
- Make a "no W-2s via email" rule. Period. No exceptions. If someone asks for them via email — even if it looks like the CEO — the answer is "no."
- Verify sensitive requests through a second channel. Phone call. In person. Slack. Anything other than replying to the email. Use a number you already have, not one in the message. Takes 30 seconds. Can save months of cleanup.
- Do a 10-minute tax-scam huddle NOW. Not later. Not "when we get closer." Tell your payroll/HR people: "These scams are spiking. This is what they look like. This is what we do."
- Lock down payroll systems with MFA. If someone's credentials get phished, multi-factor authentication is the last door they'll slam into.
- Make verification a culture, not a burden. The employee who calls to double-check a request from the CEO should be praised, not made to feel paranoid. When questioning is rewarded, scams have nowhere to hide.
Five rules. Simple enough to implement this week. Strong enough to stop the first wave.
The Bigger Picture
The W-2 scam is just the opening act.
Between now and April, expect a flood of tax-themed attacks: fake IRS notices, phishing emails disguised as tax software updates, spoofed messages from "your accountant" with malicious links.
Criminals love tax season because everyone's distracted, moving fast, and financial requests don't seem unusual.
Businesses that get through tax season clean aren't luckier. They're prepared.
Is Your Business Ready?
If you've already got policies in place and your team knows what to look for — great! You're ahead of most.
If not, now is the time. Not after the first scam hits.
Book a 15-minute discovery call and we'll review your payroll access, W-2 verification rules, and the one policy tweak most businesses miss.
[Book your 15-minute discovery call here]
Because tax season is stressful enough without identity theft on top of it. 💪
