The W-2 phishing scam is one of the oldest tricks in tax season, and it still works because it asks for something payroll and HR staff are paid to provide: employee information, quickly, for someone senior. For an accounting firm, the request can arrive twice, once aimed at the firm’s own pay800roll and once aimed at the payroll the firm runs for its clients.
It is the last week of January, and the firm’s bookkeeper is already behind.
W-2s are due to employees and the government by the end of the month. The managing partner is at a conference. Three clients are asking about payroll corrections. The inbox is full.
At 2:10 in the afternoon, an email arrives from the managing partner.
“I’m in back-to-back sessions and can’t talk. Our auditors need the payroll register and a copy of every staff W-2 for the year. Please send them as one PDF today. This is time sensitive, thanks.”
The name matches. The tone matches. The signature block is identical to every email the partner has ever sent.
The bookkeeper compiles the file and sends it. It contains the names, addresses, and Social Security numbers of every person who works at the firm.
Three weeks later, two employees try to file their taxes and receive a message that a return has already been filed under their Social Security numbers. A third employee notices that her direct deposit has been going to an unfamiliar account since February.
The email was never from the managing partner. The reply address was a Gmail account with his name in it.
It Is One of the Most Persistent Scams the IRS Has Ever Tracked
This is not a new threat. The IRS first warned employers about it years ago, and it has returned every tax season since, in more sophisticated forms.
The IRS describes the scheme as a form of business email compromise or business email spoofing. A scammer impersonates an executive and emails someone in payroll, HR, or finance, asking for a list of employees and their Forms W-2. Employees’ Social Security numbers are what make the data valuable, because criminals use them to file fraudulent tax returns and claim refunds.
The agency has warned that the scam evolved. It began with corporate payroll departments and moved on to schools, hospitals, restaurants, tribal organizations, and small businesses. It has been combined with wire transfer requests, so that a company can lose both its employees’ data and its money. And it has a close cousin: a message that appears to come from an employee, asking payroll to change the employee’s direct deposit to a new account, which belongs to the scammer. By the time anyone notices, the employee may have lost one or more paychecks.
The FBI tells the same story from the money side. In its most recent annual report, the Internet Crime Complaint Center recorded more than 24,000 business email compromise complaints and over three billion dollars in reported losses for 2025, making it the second-costliest category of cybercrime it tracks. The report also attributed more than thirty million dollars in business email compromise losses to scams with a confirmed connection to artificial intelligence, a reminder that the emails are getting more polished, not less.
Why Accounting Firms Are Doubly Exposed
Every employer faces this threat. Accounting firms face it in two forms.
The firm’s own payroll. A CPA firm has employees, partners, and seasonal staff, each with a Social Security number, a direct deposit account, and a W-2. The firm is as vulnerable as any small business to a fake request from “the managing partner.”
Clients’ payroll. Many firms run payroll for clients, or handle their payroll tax filings and W-2 preparation. That means the firm holds the personal information of employees at dozens of other organizations. A scammer who impersonates a client owner and asks for the payroll register, or requests a change to a client employee’s direct deposit, is targeting data the firm does not own and cannot easily replace.
The IRS has directed its guidance specifically at businesses and payroll service providers because attackers aim for them. A payroll provider’s compromise multiplies across every client.
Timing matters too. Requests for employee data are normal in January, when W-2s are prepared and filed. A bulk data request in the last week of January looks like routine business, which is exactly why scammers choose it.
How the Email Earns Its Trust
The messages work because they are built to look ordinary.
The display name. Many email programs show only the sender’s name, not the underlying address. A message from “Michael Alvarez” that actually comes from a free email account looks identical at a glance, especially on a phone.
The lookalike domain. A near-copy of the firm’s domain, with a swapped character or an extra word, can pass a quick check.
The compromised account. In some cases the attacker has broken into a real executive’s mailbox, and the request comes from the genuine address. Those are the hardest to spot.
The tone and timing. The message is short, confident, and urgent. The sender is unavailable. The request is routine. The attachment should go out today.
The ask for secrecy or speed. As discussed in earlier articles in this series on gift card fraud and voice cloning, urgency and discouragement of verification are the signature of this entire family of scams.
Generative tools now make the writing flawless, so the grammar mistakes that once gave these emails away are disappearing.
What the Criminals Do With the Data
Understanding the payoff helps explain why the scam persists.
Stolen W-2 data lets criminals file fraudulent tax returns early in the season, claiming refunds before the real taxpayer files. Employees discover the problem when their legitimate return is rejected. Untangling identity theft with the IRS can take months and is stressful and disruptive.
The same data supports other fraud, including opening credit accounts and, in the combined scheme the IRS has described, targeting the company’s own bank account with follow-up wire requests that are quickly converted to cash and are very difficult to recover.
Direct deposit diversion is more straightforward. The scammer collects one or two paychecks and disappears, leaving the employee out of pocket and the employer responsible for the explanation.
Controls That Actually Work
The defenses are consistent across IRS, FBI, and industry guidance, and none require sophisticated technology.
Verify any bulk data request by voice. Any request for employee lists, payroll registers, or W-2 data must be confirmed by calling the supposed requester on a number already in the firm’s records, never a number in the message. This is the single most effective control, and it costs a minute.
Define who is allowed to receive employee data. The firm should know which outside parties, such as auditors, insurers, and benefit providers, legitimately receive payroll data, through which secure channel. A request from anyone else, or through any other channel, is suspect by default.
Route direct deposit changes through a controlled process. Employees should change their own bank details through a secure self-service portal protected by multifactor authentication, or in person with identification. A request by email, text, or phone to change an account is verified through a separate channel and held for a short period before taking effect. Notifying the employee at the previously known phone number when a change is made catches many frauds within hours.
Require dual approval for first payments to new accounts. A second person reviews any payment to an account the firm has not paid before.
Never send sensitive files by unprotected email. Employee data should move through secure file sharing with expiring links and access logs, which also reduces the damage if a request slips through.
Technology Raises the Cost for Attackers
Process controls are the backbone, and technology provides important supporting layers.
Email authentication. Domain protections such as SPF, DKIM, and DMARC make it harder for outsiders to send messages that appear to come from your domain. They do not stop a free email account using a partner’s name, but they close one easy door.
Warning banners and lookalike detection. Mail systems can label messages from outside the organization and flag domains that closely resemble the firm’s, so an impostor’s message looks different at a glance.
Phishing-resistant multifactor authentication. If an attacker steals a partner’s password, strong authentication keeps them out of the mailbox, which closes the path to the hardest-to-detect variant.
Mailbox rule and sign-in monitoring. Attackers who do get in often create hidden forwarding rules, and unusual sign-in locations can reveal a compromise early.
Data loss prevention rules. Mail systems can flag or block outbound messages containing patterns that look like Social Security numbers, adding a safety net when a request gets past a human.
Role-based access and audit logs in the payroll system. Only the people who need payroll data should be able to export it, and every export should be logged.
Train the People Who Handle the Data
General awareness training is not enough for the staff who sit closest to this risk.
Payroll, HR, and bookkeeping employees need specific training with realistic examples: a partner asking for W-2s, an employee asking for a direct deposit change, a client owner asking for a payroll register. They should practice the callback, and they should hear plainly from leadership that pausing to verify is expected, even when the request appears to come from the managing partner.
That last point matters most. A junior employee is reluctant to question a message that seems to come from the top of the firm. A written policy that says, “we verify every request for employee data and every bank change by phone, regardless of who appears to be asking,” removes the awkwardness and protects the employee as much as the firm.
If It Happens: The First Day
Speed matters. The IRS has set up specific channels for exactly this scam.
Report the data loss to the IRS. Email dataloss@irs.gov with “W-2 data loss” in the subject line. Include the business name, the employer identification number, and a summary of how the loss occurred. The IRS asks that you not attach any employee personal information.
Report the phishing email. Save the message as an email file and attach it to a new message sent to phishing@irs.gov with “W-2 scam” in the subject line. Simply forwarding the message strips information the IRS needs to investigate.
File with the FBI. Report the incident to the FBI’s Internet Crime Complaint Center, and move quickly if money was sent. The FBI’s recovery efforts have frozen large sums for victims who reported fast, which depends entirely on speed.
Notify affected people. Tell employees promptly, and point them to the Federal Trade Commission’s identity theft resources and the IRS identity theft guidance. Employees whose returns are affected can file an identity theft affidavit with the IRS, and many choose to request an IRS Identity Protection PIN.
Contact the bank. If a payment or direct deposit was diverted, call the bank immediately and ask for a freeze or recall.
Preserve evidence and call counsel and the insurer. Keep the original email and logs. Names combined with Social Security numbers are the kind of personal information covered by state breach notification laws, including Florida’s, so counsel should assess notification duties, and the firm’s cyber insurance carrier may require prompt notice.
Secure the accounts. Reset passwords, review mailbox rules, and confirm that no attacker retains access.
When the Data Belongs to a Client
If the compromised data belongs to a client’s employees, the response must include the client.
Tell the client promptly and honestly what was lost. Coordinate the employee notification, the IRS report, and any state notification so nothing is duplicated or missed. Keep a record of the decisions made and why. Clients forgive an honest incident report far more readily than a delayed one, and a firm that can show it had verification procedures in place is in a much stronger position.
Firms that run payroll should also confirm in writing how clients will make payroll change requests, so the firm’s own policy is not undermined by an informal habit of accepting a text from a client’s owner.
Name an Owner for Payroll Data Security
Payroll fraud thrives in the space between roles. The bookkeeper handles the data, the managing partner assumes the controls exist, and IT was never told that payroll files move by email.
Naming an owner closes that gap. One person, or a managed IT services partner working with the firm’s administrator, should know exactly where payroll data lives, who can export it, which recipients are approved, and how bank changes are verified.
That owner should also receive the alerts. When cybersecurity monitoring flags a new mail forwarding rule on a partner’s account, a bulk export from the payroll platform, or an outbound message carrying Social Security numbers, someone needs to see it the same day, not at the next quarterly review.
What This Means for Miami and South Florida Firms
South Florida accounting practices face several local conditions that raise this risk.
The region has a large number of restaurants, hotels, construction companies, and other service businesses with high turnover and large W-2 volumes. Firms that run payroll for these clients handle many employees’ data, and frequent staff changes mean frequent direct deposit changes, which makes a fraudulent one easier to hide.
The workforce and client base are bilingual. A convincing message can arrive in English or Spanish, and a firm’s verification rule must apply equally to both.
Many local firms are small, with one person handling payroll and bookkeeping. When a single employee holds the keys and the managing partner is rarely reachable by email alone, a policy requiring verification by voice is not optional.
And Florida has its own breach notification law covering names combined with Social Security numbers, so an incident that exposes W-2 data is likely to carry state obligations alongside the federal reporting steps.
Ask Your IT Provider Questions Like These
Do we have a written rule that any request for employee data or a direct deposit change is verified by voice using a number we already hold?
Do we use email authentication, external sender banners, and lookalike domain detection to make impersonation harder?
Do our managing partners and payroll staff use phishing-resistant multifactor authentication on email and the payroll platform?
Can our email system flag or block outbound messages containing Social Security numbers, and do we use secure file sharing instead of attachments for payroll data?
Do we monitor for hidden mailbox forwarding rules and unusual sign-ins on partner accounts?
If a W-2 scam succeeded tomorrow, does everyone know who to call at the IRS, the bank, and our insurer in the first hour?
If your IT provider cannot answer these clearly, the next polished email from the managing partner may be the one that works.
A Short Phone Call Is Cheaper Than Identity Theft for Everyone You Employ
The email will look right. It will sound right. It will arrive at a busy time and ask for something that your payroll staff routinely provides.
The defense is a habit that takes one minute: call, using a number you trust, before anything leaves the building.
ITva Technologies provides managed IT and cybersecurity services for CPA and accounting firms across Miami-Dade and Broward, with specific experience protecting payroll and employee data from impersonation fraud.
Our managed IT services include email authentication, secure file sharing for sensitive payroll data, and documented procedures for verifying data requests and direct deposit changes.
Our cybersecurity services include phishing-resistant authentication, mailbox monitoring, outbound data protection, and staff training built around the exact scenarios payroll teams face in tax season.
If your firm has never written down how it handles a request for employee W-2s, that is worth doing before the last week of January.
Schedule a free payroll fraud prevention assessment with ITva.
We will review how employee data and direct deposit changes move through your firm and your clients’ payrolls, and show you where a convincing email could slip through.
Because the email will look like it came from the boss.
Your process is the part the scammer cannot copy.
Frequently Asked Questions
What is the W-2 phishing scam?
It is a business email compromise scheme in which a scammer impersonates an executive and asks someone in payroll or HR to send employees’ Forms W-2 or a payroll register. The Social Security numbers in that data are used to file fraudulent tax returns and commit other identity theft.
What is payroll diversion fraud?
A scammer impersonates an employee and asks payroll to change that employee’s direct deposit to an account the scammer controls. The employee loses one or more paychecks before the fraud is discovered.
How should we report a W-2 scam to the IRS?
If data was lost, email dataloss@irs.gov with “W-2 data loss” in the subject line and include your business name, employer identification number, and a summary, without attaching employee personal information. If you received the email but did not respond, save it as an email file and send it as an attachment to phishing@irs.gov with “W-2 scam” in the subject line. Also report to the FBI’s Internet Crime Complaint Center.
Does this affect accounting firms that run payroll for clients?
Yes. A firm that handles client payroll holds many employees’ personal information and may be impersonated by a scammer posing as a client owner. The IRS guidance addresses payroll service providers specifically, and firms should apply the same verification rules to client requests as to internal ones.
What is the most effective defense?
Verifying every request for employee data or a bank change by calling the supposed requester at a number already on file, backed by secure file sharing, strong email authentication, and training for the staff who handle payroll.
What should employees do if their W-2 information was stolen?
They should follow the FTC’s identity theft guidance and the IRS identity theft guidance, file an identity theft affidavit with the IRS if their tax return is affected, and consider requesting an IRS Identity Protection PIN. The employer should notify them promptly.