Scam of the Week: FBI Warns of Spike in W2 Phishing

The FBI has joined the IRS in warning that W2 tax form phishing is on the rise.

The US tax filing deadline is now less than a month-and-a-half away, and tax-themed phishing is trending up. Compromised or spoofed emails alleging to be from a company executive are received by the human resources department. Those emails request W2 information.

The scam’s ultimate goals are usually one of the following: either collection of personal information on employees, fraudulent wire transfers of company funds, or both. The emails asking for W2 information often contain the wire transfer request.

Training against this kind of social engineering is valuable, and HR personnel should be unusually vigilant for phishing attempts during tax season. Here’s the FBI advisory:

Two Central Texas Employers Fall For The Scam

AUSTIN (KXAN) — The W-2s of workers of two Central Texas employers were compromised in two separate phishing scams. 

The Austin Diagnostic Clinic Association reported the 2017 W-2 and address information of employees were compromised on Feb. 27, thanks to an email attack. Patient information was not affected, according to Bob Presley, a compliance officer at ADCA.

“Based on the information we currently have, the only information that was compromised was that which is contained in a W-2 form and address information; there was no compromise of patient health information,” Presley said.

Separately, Rockdale Independent School District fell victim to a similar scam, in which all of its W-2s were also compromised.

Both groups reported the incidents to law enforcement and the IRS, and they are working with employees to get credit protection for those who were affected.

Last year, the IRS says more than 200 employers fell victim to the phishing scam, which translated into hundreds of thousands of employees who had their information compromised. The IRS says the Form W-2 scam has emerged as one of the most dangerous phishing emails in the tax community. More at:

Cyber-attacks are rapidly getting more sophisticated. GDR Group will help train your employees to better manage the urgent IT security problems of social engineering, spear-phishing and ransomware attacks. Take the first step now and email [email protected] to request a quote for security awareness training for your organization.