Tax season scams that target small businesses and their staff

Why tax season scams are so effective

Tax season is a prime time for cybercrime because it combines two powerful motivators: fear and greed. People are afraid of the IRS and the consequences of a filing error, and they are often excited about the prospect of a tax refund. Scammers exploit these emotions to bypass a person's normal skepticism. For small businesses, the risks are even higher, as an attacker can target the entire company's payroll data or business bank accounts.

According to the FBI's Internet Crime Complaint Center (IC3), tax-related scams result in millions of dollars in losses every year. These attacks are not limited to the weeks leading up to the April deadline; they often start as early as January when W-2 forms are being issued.

The W-2 phishing scam: a major threat to HR

One of the most dangerous tax season scams targets HR and payroll departments. The attacker sends an email that appears to be from the CEO or a senior executive, asking for a list of all employees and their W-2 forms. The email often claims the information is needed for an 'urgent audit' or a 'new tax preparer.'

If the employee complies, the attacker receives the Social Security numbers, home addresses, and income details of every person in the company. This information is then used to file fraudulent tax returns in the employees' names or is sold on the dark web for future identity theft.

Fake IRS calls and emails

Another common tactic involves impersonating the IRS directly. You might receive a call from someone claiming to be an IRS agent, telling you that you owe back taxes and will be arrested if you don't pay immediately. They often demand payment via wire transfer, prepaid debit cards, or even gift cards.

It is important to remember that the IRS almost always initiates contact through regular mail delivered by the United States Postal Service. They do not leave pre-recorded, urgent, or threatening messages. They also do not demand payment over the phone without giving you the opportunity to question or appeal the amount they say you owe.

The 'Refund Adjustment' lure

In this scenario, you receive an email or text stating that your tax refund has been recalculated and you are owed more money. To claim the 'extra' refund, you are asked to click a link and provide your bank account details or log in to a fake IRS portal. These sites are designed to steal your credentials and gain access to your financial accounts.

How to protect your business during tax season

Protecting your business requires a combination of technical safeguards and employee education. Everyone in the company, from the front desk to the executive suite, should be aware of these threats.

1. Implement a strict policy for handling PII (Personally Identifiable Information) that forbids sending W-2s or tax data through unencrypted email.
2. Train employees to recognize the signs of executive impersonation, especially during the first quarter of the year.
3. Use the IRS Identity Protection PIN (IP PIN) program if you or your employees have been victims of identity theft.
4. Educate staff that the IRS will never use text messages or social media to discuss tax issues.

What to do if you suspect a scam

If you receive a suspicious tax-related email, do not click any links or open any attachments. You can report the email directly to the IRS by forwarding it to 'phishing@irs.gov'. If you receive a threatening phone call, hang up immediately. If you think your business has been targeted by a W-2 scam, you should also notify the FBI and the state tax agencies where your employees live.