It’s one of the most common scams reported to Better Business Bureau Northwest & Pacific. We see them year-round, but we fully expect the reports to spike over the next few months.
We’re talking about tax-related scams. They come in all shapes and sizes these days. Maybe you’ve received a phone call from someone claiming to be with the Internal Revenue Service saying you owe back taxes. Maybe it came in the form of an email or even a written letter. Scammers have come up with all sorts of ways to pull this scheme off.
One of the most prolific tactics involves scammers targeting companies in an effort to steal sensitive W-2 information. In fact, the IRS just issued an alert, hoping to warn unsuspecting businesses about the scheme. The IRS says the phishing email scam affected hundreds of companies and thousands of employees in 2017. The IRS and BBB are working hard to prevent the same thing from happening again this year.
So how does it work? The IRS says scammers send out fake emails to unsuspecting employees who handle payroll duties and trick them into disclosing sensitive W-2 information. The IRS says they do this by targeting executives or high-level employees. They then use a technique known as business email compromise or business email spoofing to send fraudulent emails which appear to be from those executives. They send the emails to payroll personnel to obtain copies of the W-2. These forms contain all sorts of personal information. Once that data is breached, it can cause a lot of problems for the victim.
BBB and the IRS urge you to educate yourself now to avoid this scheme down the line. Businesses should keep this advice in mind:
• Educate staff. Warn them about this scam and others like it. Urge employees to double-check any email requests for sensitive information by calling or speaking with the person to confirm it is a legitimate request.
• Limit access. The IRS is urging companies to limit the number of employees who have access to this type of sensitive information. The more people involved, the greater the risk.
• Be transparent. If your company does fall victim to this sort of attack, alert employees and customers right away. They need to know so they can check their accounts and take the proper steps to protect themselves.
• Report it. Alert the IRS to an attack by emailing email@example.com and file a BBB Scam Tracker report. If your data was compromised, notify the IRS by emailing firstname.lastname@example.org .
For more tips and scam alerts, download the BBB app at bbbapp.org. Anyone who feels they may be a victim of any scheme should report it to local law enforcement and BBB Scam Tracker at bbb.org/scamtracker.
— Stephen Mayer is the Better Business Bureau marketplace manager for Oregon. He can be reached at 971-201-8528 or email@example.com .