The Internal Revenue Service is warning employers about a new phishing e-mail scheme that purports to be from company executives and requests personal information on employees.
The scheme, unfortunately, has already seen some success, amid a surge in phishing e-mails so far this year.
Several have already fallen victim to e-mails that get payroll and HR offices to mistakenly e-mail payroll data, including Forms W-2 that contain Social Security numbers and other personally identifiable information, to cybercriminals posing as company executives.
The e-mail will typically contain the actual name of the company’s chief executive officer, and will on the surface come from the “CEO” to a company payroll office employee requesting a list of employees and information including SSNs.
According to the IRS, these e-mails will also contain some of the following statements, or variations on them:
“Kindly send me the individual 2015 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review.”
“Can you send me the updated list of employees with full details (Name, Social Security Number, Date of Birth, Home Address, Salary).”
“I want you to send me the list of W-2 copy of employees wage and tax statement for 2015, I need them in PDF file type, you can send it as an attachment. Kindly prepare the lists and email them to me asap.”
“This is a new twist on an old scheme using the cover of the tax season and W-2 filings to try tricking people into sharing personal data,” John Koskinen, IRS commissioner, said in a statement. “Now the criminals are focusing their schemes on company payroll departments.
“If your CEO appears to be emailing you for a list of company employees, check it out before you respond. Everyone has a responsibility to remain diligent about confirming the identity of people requesting personal information about employees.”
About the Author
Larry spent 16 years with Century Casino’s and was instrumental in the start-up and growth of the company through expansions in Canada, South Africa, the Czech Republic, Poland and on several cruise ships as well as in Colorado. He was most recently the SVP, Principal Finance Officer and COO of North American operations for Century Casinos Inc., a multinational, Nasdaq-traded gaming company. Earlier in his career, Larry worked at the Johns Manville Corp. Larry spent 13 years in various accounting and finance functions in the company’s fiberglass manufacturing division and was key in the start-up of a molding plant in Indiana. Larry and his wife Kathy and three children live in Colorado. He enjoys four-wheeling, motorcycling, golfing, skiing and brewing beer.