Tax Season Scams: Protect W-2s and Payroll at Your Small Business

If you run a small business in Monterey County or anywhere else on the Central Coast, the weeks before tax filing are when scammers go after your payroll and HR staff. They want employee tax forms, bank details, and paychecks, and a single convincing email can hand over all three.

This guide covers the scams to expect, how to spot them, and the habits that stop them.

1. The scams that spike every tax season

These attacks are simple and cheap, which is why they keep working.

• W-2 phishing. An email that looks like it comes from the owner asks payroll to send every employee's W-2 "for an audit." One reply exposes names, addresses, and Social Security numbers. It is a close cousin of business email compromise.
• Payroll diversion. A message from a "staff member" asks to move their direct deposit to a new account. Payroll updates it, and the next paycheck vanishes.
• IRS and tax agency impersonation. Emails, texts, and calls claim you owe money or must "verify" your account. Many arrive as text message scams or phone calls.
• Fake tax software and portals. A lookalike login page captures your payroll or accounting password. See our notes on lookalike domains.

2. How to spot a tax season scam

The details change, but the pattern does not.

• Urgency and secrecy. "Send it today" and "keep this between us" are red flags. Real requests can survive a two-minute phone call.
• A request that skips the normal process. Tax forms are normally delivered through your payroll system or accountant, not as email attachments on demand.
• Small sender oddities. A reply-to address that differs from the sender, or a domain one letter off. Our guide to email authentication explains how to make spoofing harder.
• Pressure on one person. Scammers research who handles payroll and write to them alone. Make sure no single person can be rushed into releasing data.

The IRS generally begins contact by mail, not by email or text. Treat any message demanding instant payment or login details as suspect, and go to the official site yourself instead of clicking.

3. Habits that stop them

You do not need expensive tools. You need a few rules that everyone follows.

• Call back on a known number. For any W-2 request or bank change, phone the person using a number you already had, never one from the email.
• Add a waiting period. Hold new direct deposit details until the next pay cycle, and send a confirmation to the employee's old details.
• Protect the logins. Use multi-factor authentication on email, payroll, and banking, and a password manager for the rest.
• Limit who can see tax data. Keep W-2s and payroll files in a restricted folder. Our post on data loss prevention shows how to block risky sharing.
• Practice and plan. Run a short phishing drill before filing season, and keep a one-page incident response plan so a mistake gets reported within minutes. If employee data does leave, review California's breach notification rules.

The takeaway

Tax season scams work because they look routine. A phone call and a rule that no one can bypass defeat most of them. If you want help locking down payroll and email before filing season, see our cybersecurity and managed IT services, or check current pricing.

Frequently asked questions

What is a W-2 phishing scam?

A scammer emails someone in payroll or HR, often posing as the owner, and asks for copies of employee W-2 forms. Those forms hold names, addresses, and Social Security numbers, which criminals use to file fake tax returns. Always confirm the request by phone first.

What is payroll diversion fraud?

An attacker pretends to be an employee and asks payroll to change their direct deposit to a new bank account. The next paycheck goes to the criminal. A call-back to the employee at a known number, plus a waiting period, stops most attempts.

How can I tell if an IRS message is real?

The IRS generally starts contact by mail, not by email, text, or social media. A message that demands instant payment, gift cards, or login details is a warning sign. Do not click. Go to irs.gov directly or call a number you looked up yourself.

What should I do if I sent employee W-2s to a scammer?

Act the same day. Tell your IT provider, contact your payroll and tax professionals, and notify the affected employees so they can place a fraud alert or credit freeze. California also has breach notification rules that may apply.

Can multi-factor authentication stop tax season scams?

It helps a lot, because many of these scams start with a stolen email or payroll login. Turn on multi-factor authentication for email, payroll, and banking. It will not stop an employee from being tricked into sending data, so pair it with a call-back rule.

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.