# W-2 phishing: verify any executive request for employee W-2s, and report data loss to dataloss@irs.gov > The IRS warns of email scams in which a spoofed executive asks payroll or HR staff for every employee’s Form W-2. Businesses that lose W-2 data should email dataloss@irs.gov, contact the Federation of Tax Administrators and file with IC3, and businesses that only receive the email should forward it with headers to phishing@irs.gov. - Canonical URL: https://update.dsesecurity.com/updates/irs-form-w-2-phishing-bec-payroll-data-loss-reporting-dataloss-irs/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:27:59+00:00 - Modified: 2026-10-19T01:55:07+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Playbook - DSE priority: Important - Topics: Business Continuity, Cybersecurity - Reading time: 2 minutes ## What you need to know The IRS warns of email scams in which a spoofed executive asks payroll or HR staff for every employee’s Form W-2. Businesses that lose W-2 data should email dataloss@irs.gov, contact the Federation of Tax Administrators and file with IC3, and businesses that only receive the email should forward it with headers to phishing@irs.gov. ## Potentially affected Employers, payroll and HR staff, and payroll service providers that hold Forms W-2 or employee Social Security numbers. ## DSE recommendation DSE recommends requiring a call-back on a known number before anyone sends W-2s or employee lists, and preparing the IRS reporting steps before tax season. ## Article The IRS warns of email scams in which a spoofed executive asks payroll or HR staff for every employee’s Form W-2. Businesses that lose W-2 data should email dataloss@irs.gov, contact the Federation of Tax Administrators and file with IC3, and businesses that only receive the email should forward it with headers to phishing@irs.gov. ## Source facts The IRS page on [Form W-2 data theft](https://www.irs.gov/newsroom/form-w-2-ssn-data-theft-information-for-businesses-and-payroll-service-providers) describes a scam in which cybercriminals spoof an email to appear to come from an organization executive and ask an employee in payroll or human resources for a list of all employees and their Forms W-2, a scheme sometimes called business email compromise. It says criminals who steal W-2s immediately try to file fraudulent refund returns or sell the data, and that if notified quickly the IRS may be able to help protect employees from tax-related identity theft. To report a loss, the IRS asks businesses to email dataloss@irs.gov with the subject W2 Data Loss, giving the business name, EIN, contact, a summary of how the loss occurred and the number of employees affected, without attaching employee personal data. It also directs them to email statealert@taxadmin.org about state reporting and to file a complaint with IC3, and businesses that received the email without falling victim should save it as a file so its headers are kept and send it as an attachment to phishing@irs.gov with the subject W2 Scam. The IRS says it does not initiate contact with taxpayers by email, text or social media to request personal or financial information, and suggests sharing IRS Publication 5027 with affected employees, including steps such as a fraud alert or credit freeze and a complaint to the Federal Trade Commission. ## Applicability Use this for any employer or payroll provider that holds Forms W-2 or Social Security numbers. State breach-notice laws can also apply after a loss, so involve counsel. ## DSE recommendation DSE recommends requiring a call-back on a known number before anyone sends W-2s or employee lists, and preparing the IRS reporting steps before tax season. Limit who can export payroll reports, tag email from outside the organization, brief payroll and HR staff on this scam each January, and keep the IRS, state and IC3 reporting steps in the incident plan. ## Verification Test the call-back rule with an internal exercise, confirm only named staff can export W-2 data, and check that the incident plan lists each reporting address and the details the IRS asks for. ## Official reference [Internal Revenue Service — Form W-2/SSN data theft: Information for businesses and payroll service providers](https://www.irs.gov/newsroom/form-w-2-ssn-data-theft-information-for-businesses-and-payroll-service-providers). Reviewed October 19, 2026. ## Primary reference - Name: Internal Revenue Service — Form W-2/SSN data theft: Information for businesses and payroll service providers - Authority: www.irs.gov - URL: https://www.irs.gov/newsroom/form-w-2-ssn-data-theft-information-for-businesses-and-payroll-service-providers - Source publication date: Not stated by the source ## Citation and use Preferred citation: “W-2 phishing: verify any executive request for employee W-2s, and report data loss to dataloss@irs.gov,” DSE Security, https://update.dsesecurity.com/updates/irs-form-w-2-phishing-bec-payroll-data-loss-reporting-dataloss-irs/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.