W-2 phishing: verify any executive request for employee W-2s, and report data loss to dataloss@irs.gov

The IRS warns of email scams in which a spoofed executive asks payroll or HR staff for every employee’s Form W-2. Businesses that lose W-2 data should email dataloss@irs.gov, contact the Federation of Tax Administrators and file with IC3, and businesses that only receive the email should forward it with headers to phishing@irs.gov.

Source facts

The IRS page on Form W-2 data theft describes a scam in which cybercriminals spoof an email to appear to come from an organization executive and ask an employee in payroll or human resources for a list of all employees and their Forms W-2, a scheme sometimes called business email compromise. It says criminals who steal W-2s immediately try to file fraudulent refund returns or sell the data, and that if notified quickly the IRS may be able to help protect employees from tax-related identity theft.

To report a loss, the IRS asks businesses to email dataloss@irs.gov with the subject W2 Data Loss, giving the business name, EIN, contact, a summary of how the loss occurred and the number of employees affected, without attaching employee personal data. It also directs them to email statealert@taxadmin.org about state reporting and to file a complaint with IC3, and businesses that received the email without falling victim should save it as a file so its headers are kept and send it as an attachment to phishing@irs.gov with the subject W2 Scam.

The IRS says it does not initiate contact with taxpayers by email, text or social media to request personal or financial information, and suggests sharing IRS Publication 5027 with affected employees, including steps such as a fraud alert or credit freeze and a complaint to the Federal Trade Commission.

Applicability

Use this for any employer or payroll provider that holds Forms W-2 or Social Security numbers. State breach-notice laws can also apply after a loss, so involve counsel.

DSE recommendation

DSE recommends requiring a call-back on a known number before anyone sends W-2s or employee lists, and preparing the IRS reporting steps before tax season. Limit who can export payroll reports, tag email from outside the organization, brief payroll and HR staff on this scam each January, and keep the IRS, state and IC3 reporting steps in the incident plan.

Verification

Test the call-back rule with an internal exercise, confirm only named staff can export W-2 data, and check that the incident plan lists each reporting address and the details the IRS asks for.

Official reference

Internal Revenue Service — Form W-2/SSN data theft: Information for businesses and payroll service providers. Reviewed October 19, 2026.