IRS: Email scam targets school districts, nonprofits to get W-2 information
(KMSP) - Authorities are warning companies and organizations in the Twin Cities area about an email scam in which people try to get employees’ personal information from their W-2s in order to file fraudulent tax returns.
The Better Business Bureau says the scam initially targeted private sector businesses, but it is now being used against school districts, nonprofit organizations, healthcare providers, temporary staffing agencies and chain restaurants.
Dan Hendrickson from the Better Business Bureau says scammers are realizing targeting human resources department or accounting departments of businesses, school districts and even non-profits gives them a better chance of collecting the money they are after or the personal information of multiple people.
“Once it's out there it's a perennial headache,” says Hendrickson. “You have to keep your eyes open night and day."
The Internal Revenue Service says the company or organization’s accounting or human resources department will receive a phony email asking for a list of all of the company’s W-2 tax forms, employees’ dates of birth and Social Security numbers.
The fake emails may include wording such as: “Can you send me the updated list of employees with full details (name, SSN, date of birth, home address and salary” or ‘Kindly send me the individual 2016 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review.”
Authorities believe the scammers intend to use the employee’s personal information to file fraudulent tax returns.
As his latest example of what anyone with an email account should be looking for Mark Lanterman from Computer Forensic Services points to an email with misspellings including zeros instead of Os, an abbreviated link and an urgent message. The email was at the root of the DNC breach, and ultimately lead to Hillary Clinton's emails being delivered to WikiLeaks. Lanterman says this goes to show anyone can be fooled.
“In 2016 I was retained by four of the top ten law firms in Minneapolis, because they fell victim to a W-2 scam,” says Lanterman.
A version of the W-2 scam was emailed to someone in the finance department of Bloomington Public Schools earlier this month. The employee, who is now in administrative leave, took the bait and sent the hacker the 2016 w-2 forms for all 28 hundred employees in the district.
“The criminals aren't stupid and they know what info is on a W-2 -- your name, date of birth, address, social security number and how much you make, pretty much everything I need to file a tax return fraudulently, or perhaps take out mortgages in your name,” says Lanterman. “I can sell your stolen credit card information for $5 but I can sell you online for over $800."
More information on the scam and how to prevent W-2 theft can be found here.