It’s February. Tax season is ramping up.
Your accountant is busy. Your bookkeeper is pulling reports. Everyone’s thinking about W-2s, 1099s, and deadlines.
Here’s the part nobody schedules for:
The first real tax-season problem usually isn’t paperwork.
It’s a scam.
And there’s one that shows up early every year because it’s easy, believable, and aimed directly at small businesses.
You might already have it sitting in someone’s inbox.
The W-2 Scam (How It Really Happens)
Here’s the setup.
Someone in your company, usually payroll or HR, gets an email that looks like it came from the owner or CEO.
It’s short. Urgent. Reasonable.
“Hey, I need copies of all employee W-2s for the accountant. Can you send them over ASAP? I’m slammed today.”
Nothing about that feels strange in February.
So the employee sends the W-2s.
Except the email wasn’t from you.
It was from a criminal using a fake or look-alike email address.
And now that criminal has every employee’s name, Social Security number, address, and pay information. Everything needed for identity theft and fraudulent tax filings.
How Businesses Find Out
Most companies don’t catch this right away.
They find out when an employee files their taxes and gets rejected:
“A return has already been filed for this Social Security number.”
Now that employee is dealing with the IRS, credit monitoring, and months of cleanup because of an email they didn’t even realize was fake.
Multiply that by your entire payroll.
That’s not just a tech issue.
That’s a trust issue.
An HR nightmare.
And a reputation problem.
Why This Scam Works So Well
This isn’t an obvious scam email.
It works because:
- The timing makes sense. W-2 requests are expected right now.
- The request is normal. This is something businesses actually share during tax season.
- The urgency feels natural. Everyone’s busy.
- The sender looks legit. Criminals research you. Names and titles matter.
- Employees want to be helpful, especially when the “boss” asks.
How to Stop It (Before It Happens)
The good news: this scam is very preventable.
You don’t need complicated tools. You need clear rules.
- No W-2s via email. Ever.
If someone asks for them by email, the answer is no, even if it looks like it came from the owner. - Verify sensitive requests another way.
Phone call. In person. Chat. Anything except replying to the email. - Warn your payroll and HR staff now.
Not in March. Not later. This scam spikes early. - Protect payroll and HR logins.
Multi-factor authentication on anything that touches employee data. - Make verification normal.
Employees should be praised for double-checking, not made to feel paranoid.
That’s it. Simple rules that stop a very expensive mistake.
The Bigger Picture
The W-2 scam is usually just the beginning.
During tax season, businesses also see:
- Fake IRS payment demands
- Phony tax software emails
- Spoofed messages from “your accountant”
- Invoices timed to look like tax expenses
Criminals love tax season because everyone’s moving fast.
Businesses that make it through clean aren’t lucky. They’re prepared.
Is Your Business Ready?
If you’ve already locked this down, great. You’re ahead of the curve.
If not, now is the time, not after something slips through.
If this sounds like your business, book a quick 10-minute discovery call and we’ll review:
- Payroll and HR access
- W-2 verification rules
- Email protections that stop spoofing
- One simple policy most businesses miss
If this doesn’t sound like you, you probably know a business owner it does sound like.
Send this to them. Because tax season is stressful enough without identity theft on top of it.