September 18, 2020

Volume X, Number 262

September 18, 2020

Subscribe to Latest Legal News and Analysis

September 17, 2020

Subscribe to Latest Legal News and Analysis

September 16, 2020

Subscribe to Latest Legal News and Analysis

W-2 Phishing Scams Likely to Resurface After the New Year

W-2 phishing season is just a few weeks away.  For the past several tax seasons, cyber criminals have duped hundreds of payroll departments into providing W-2 information on their employees, which results in the filing of fraudulent tax returns and other identity theft issues.  These attacks are incredibly disruptive to employees, extremely expensive for employers and are completely avoidable with some training. 

The typical W-2 phishing email purports to be from a high-level executive and asks the payroll employee to provide W-2 or other tax-related information either by replying to the phishing email or by sending the information to another email address.  In many instances, the request for the information appears to be urgent, which forces the employee to act quickly.  These messages can be very convincing.  The emails often contain the actual signature block of the executive or a different indicator that makes the employee believe that the email is authentic.

Employees should be trained to examine emails carefully for signs of phishing and to think twice before sending any sensitive information.  Some tell-tale signs can include an unfamiliar email address (e.g. instead of the president’s actual email address: or the use of odd or overly formal language.  Companies should also implement a policy that either no W-2 information will be requested via email or require that employees verify any email request for W-2 information regardless of the apparent urgency in the message.  Verification could include contacting the sender via telephone or by starting a new email thread to confirm the validity of the request.  Finally, any such sensitive information that is emailed in response to a verified request should be sent through a new message created by the sender to ensure that the appropriate recipient receives the message (i.e., do not reply to the emailed request).

The IRS has instructed organizations receiving W-2 scam emails to forward them to and indicate “W2 Scam” in the subject line and also to file a complaint with the FBI’s Internet Crime Complaint Center (IC3) at

In the unfortunate event that your company falls prey to a W-2 or other phishing attack, you should contact legal counsel immediately to assist in implementing strategies to minimize damage and to determine legal obligations.  Immediate action is the key to minimizing damage in W-2 phishing attacks as well as all other data breach situations. 

© Copyright 2020 Murtha CullinaNational Law Review, Volume VII, Number 347


About this Author

Dena Castricone, Murtha Cullina Law Firm, Privacy and Cybersecurity Attorney

Dena M. Castricone is a member of the Long Term Care and Health Care practice groups.  She is the Chair of the Privacy and Cybersecurity practice group and the Chair of the firm’s Pro Bono Committee.  Prior to joining Murtha Cullina, Dena served as a law clerk to the Chief Justice of the Rhode Island Supreme Court, Frank J. Williams.

Dena’s long term care and health care clients compete in a constantly evolving industry, facing both rising administrative and regulatory burdens and shrinking reimbursement rates. She helps skilled nursing centers, physician groups, home health and...

Daniel Kagan, Murtha Cullina, health care attorney, regulatory compliance lawyer, reimbursement issue legal counsel

Mr. Kagan is an associate in the Health Care Group of Murtha Cullina.  He represents hospitals, physicians and other health care clients with a wide range of regulatory, compliance, risk management and reimbursement issues.

Prior to joining Murtha Cullina, Mr. Kagan clerked for the Honorable Lubbie Harper, Jr. and the Honorable Joseph H. Pellegrino of the Connecticut Appellate Court. 

Mr. Kagan received his J.D. with honors from the University of Connecticut Law School where he was a Notes and Comments Editor for the Connecticut Insurance Law Journal.  He earned his Bachelor of Arts in Economics from McGill University.