W-2 & Payroll Scams

Tax season can be stressful, and scammers know it. They combine fake job offers with fraudulent payroll requests to target your W-2, SSN, and other personal information.

How W-2 Scams Operate

Scammers often start by posting enticing job offers, promising remote work or high salaries. Once you apply, the fake employer asks for your W-2, Social Security number, or banking details early in the process, claiming it’s necessary to set up payroll, verify employment, or “process your first paycheck.”

With this information in hand, attackers can file fraudulent tax returns in your name, redirect refunds to accounts they control, and steal your identity to launch additional scams. These forms contain all the data needed for identity theft, making them highly valuable targets.

Real Cases You May Not Know

Some documented cases show how widespread W-2 scams can be. Between 2020 and 2023, scammers impersonated HR staff at large U.S. companies, sending emails requesting W-2 forms from employees. Using this data, they filed thousands of fraudulent tax returns. Many victims only realized the theft months later, when attempting to file their own taxes.

Freelancers and remote workers have also been targeted. Scammers offered high-paying remote jobs, collected W-2 or payroll forms, and then used that information to open credit accounts, take out loans, or steal tax refunds. Even experienced professionals can fall for these scams because the job offers appear legitimate.

Local government employees have not been immune. Fake HR emails instructed workers to submit payroll forms under “urgent payroll adjustments,” sometimes accompanied by phone calls to confirm submission. In several cases, dozens of municipal employees were affected simultaneously, resulting in stolen identities and complicated recovery processes.

Red Flags to Watch For

These scams rely on subtle manipulation rather than obvious threats. Warning signs include unexpected requests for W-2 or payroll information via email, messages framed as urgent like “Submit immediately to get paid,” generic greetings such as “Dear Employee” instead of your name, and instructions that bypass official company systems. Any message that creates pressure or deviates from normal HR procedures should be treated with suspicion.

Even well-trained employees can fall victim if the request seems urgent and comes from what appears to be an official source. Scammers exploit trust, remote workflows, and distributed HR teams to make their requests appear legitimate.

How to Protect Yourself

The most effective defense is verification. Always confirm requests with your HR or finance department using official contact information, never respond to emails you weren’t expecting, and submit sensitive forms only through company-specific portals rather than email attachments. Enable multi-factor authentication on work accounts, monitor credit and tax accounts regularly, and stay alert to anything unusual.

Steps to Take if Targeted

If you suspect a W-2 or payroll scam, act immediately. Report the incident to your company’s HR department, notify the IRS through identitytheft.gov, and consider freezing or monitoring your credit reports. Do not respond to follow-up requests from the scammer, and save all emails and communications for investigation. Quick action can prevent further damage and help authorities track the perpetrators.

Why These Scams Are So Effective

Payroll and W-2 scams succeed because they target moments of trust. Employees expect communications from HR to be official, forms contain sensitive information needed for identity verification, and attackers exploit normal processes to create urgency without raising immediate suspicion. Even minor mistakes can have significant consequences if the scam is treated as routine, which is why awareness, caution, and direct verification are essential.