As tax season approaches, businesses prepare W-2 forms, review payroll records, and organize sensitive employee information. Unfortunately, this busy period also creates opportunities for scammers to exploit employers and their employees.
Fraudulent emails, employee impersonation, and requests for sensitive tax information can put businesses at risk of financial loss and identity theft. The IRS regularly warns employers about these threats, including scams specifically targeting payroll and human resources departments.
Understanding common payroll scams and taking a few preventative steps can help protect your business as you prepare for the upcoming tax season.
Common Payroll and Tax Season Scams
Employee Impersonation and Direct Deposit Fraud
One common payroll scam involves criminals impersonating employees to request changes to direct deposit information.
Scammers may create email addresses that closely resemble legitimate employee addresses or use compromised accounts to make their requests appear authentic. They typically contact payroll or HR departments and ask to update banking information before the next payroll is processed.
If you approve the request without verification, an employee's paycheck could be redirected to a fraudulent account.
What to watch for: Unexpected requests to change direct deposit information, unfamiliar email addresses, or messages that pressure you to make changes immediately.
Fraudulent W-2 Requests
During tax season, businesses handle large amounts of sensitive employee information, making W-2 forms an attractive target for scammers.
In this type of scam, the scammer may impersonate a company executive or other authorized employee and request copies of W-2 forms or employee wage information.
Because W-2 forms contain Social Security numbers, earnings, and other personal details, sharing them with an unauthorized individual can expose employees to identity theft and fraudulent tax filings.
The IRS specifically warns businesses about these schemes and provides guidance on W-2 Forms and Social Security number data theft.
IRS Impersonation and Phishing Emails
Scammers may also pose as the IRS or other government agencies to obtain sensitive business or employee information.
These messages often claim there is a problem with a tax return, an outstanding payment, or an account that requires immediate verification. Some include links to fraudulent websites designed to collect personal information or login credentials.
The IRS generally contacts taxpayers by regular mail rather than through unexpected emails, text messages, or social media messages requesting sensitive information.
For additional information, review the IRS guidance on recognizing fraudulent IRS communications.
What to watch for: Unexpected tax notices delivered by email or text, suspicious links, requests for confidential information, or threats demanding immediate action.
How to Protect Your Business from Payroll Fraud
As scams evolve, a few consistent security practices can reduce the risk of payroll fraud.
Verify Requests Through a Trusted Channel
Never rely solely on an email or text message when processing changes to sensitive employee information.
If an employee requests a direct deposit change or someone asks for confidential payroll records, confirm the request through a separate, trusted communication method, such as calling the employee using a phone number already on file.
Review Email Addresses and Unusual Requests
Scammers often use email addresses that look nearly identical to legitimate accounts. Always examine the full sender address rather than relying on the displayed name.
Be especially cautious of unexpected requests involving employee banking information, W-2 forms, or payroll records, even when the message appears to come from someone you know.
Establish Clear Procedures for Payroll Changes
Having a consistent process for handling payroll changes can help prevent fraudulent requests from slipping through.
Consider requiring employees to submit direct deposit changes through an approved, secure process and verifying changes before they are processed.
For particularly sensitive requests, such as releasing multiple employee W-2 forms, consider requiring a second authorized employee to review and approve the request.
Protect Sensitive Employee Documents
W-2 forms, pay stubs, and payroll reports contain confidential information that should be handled carefully. Use secure systems to distribute employee tax documents and avoid sending sensitive personal information through unsecured email.
Businesses should also limit access to payroll records to employees who need the information to perform their jobs.
Keep Employees Informed
Payroll security is a shared responsibility. Remind employees to be cautious of suspicious emails requesting personal information, banking details, or tax documents.
Encourage employees to report unusual requests immediately, particularly during the busy tax filing season.
What to Do if You Suspect a Payroll Scam
If you receive a suspicious request or believe your business may have been targeted, act quickly to limit potential damage.
Do not respond or share information: Avoid clicking suspicious links or opening unexpected attachments.
Verify the request: Contact the employee, executive, or organization through a trusted communication channel.
Notify the appropriate parties: If payroll information or funds may have been compromised, contact your payroll provider, financial institution, and IT or security team promptly.
Report the incident: The IRS provides instructions for reporting tax-related phishing attempts and W-2 data theft.
Stay Vigilant This Tax Season
Tax season can be a demanding time for businesses, but payroll security should remain a priority.
Whether you're distributing W-2 forms, updating employee information, or processing direct deposit changes, taking a few extra moments to verify requests can help protect your business and employees from costly scams.
At PayWorks Payroll, we're committed to helping businesses navigate payroll processes with confidence. If you have questions about payroll security or employee information changes, contact your PayWorks team.
PayWorks is not providing legal or tax advice. The information on this website is for informational purposes only and should not be relied upon as legal or tax advice. You should consult with your own legal and tax advisors before making any decisions about your financial situation.