Identity Theft Scam Aimed at W-2 Data
With the deadline for submitting income tax returns in sight, identity thieves are increasing their efforts to steal valuable data than can help them file bogus tax returns.
This threat comes in the form of a fake email message that claims to be from an organization executive. It’s usually sent to an employee in a company’s human resource or payroll departments and requests a list of all the company’s employees and their Forms W-2.
But the cyber-thieves are also targeting income tax professionals with threats ranging from phishing emails to outright hacking of their office computers. If any taxpayer data is compromised, whether from Forms W-2 or from any other source, here’s what the Internal Revenue Service recommends:
- Contact Law Enforcement. Contact the IRS stakeholder liaison office for your area. Also contact your local office of the FBI and local law enforcement authorities. NOTE: IRS operators on the agency’s toll-free lines cannot accept third-party notification of tax-related identity theft. Use the stakeholder liaison office link, or call your local IRS office if you have one.
- Any breach of personal information could have an effect on the victim’s tax accounts with the states as well as the IRS. Email the Federation of Tax Administrators at StateAlert@taxadmin.org to get information on how to report victim information to the states.
- Contact a Security Professional. An expert can help you determine the cause and scope of the data breach, how to stop it, and how to block further breaches.
Contact Your Insurance Company. Report the data loss and see if your policy might cover part of your recovery costs.
- Contact Affected Clients. Send an individual letter to all victims to inform them of the breach but work with law enforcement on timing. (Clients should complete IRS Form 14039, Identity Theft Affidavit, only if they receive a notice or letter from the IRS or their e-filed return is rejected because of a duplicate Social Security number.)
- Contact the Federal Trade Commission to report the loss of personal data. For general guidance email the FTC at firstname.lastname@example.org.
The IRS has a number of resources for tax professionals to help arm them against identity theft threats. Their web page, Identity Protection: Prevention, Detection and Victim Assistance; has a wide range of help topics available, both for tax pros and taxpayers. Identity Theft for Tax Professionals has answers to a lot of tax pro questions about identity theft.