From: [email protected]
To: [email protected]
Subject: Immediate Response
Needed Date: February 1, 2017 10:55 AM

Hi Tony,

I need copies of all employees' W-2 wage and tax statements for 2016 to complete a business transaction. I need them in PDF format. You can send them as an attachment.

Regards,

Jim Smith

The email appears to be a completely legitimate request from a legitimate email address, but in reality the email is from somewhere entirely different and has the "REPLY TO" field set to an email address controlled by the criminal. While the email headers would show the email address, they are typically hidden from the end user. Other variations on the content of the W-2 requests can be found in the IRS's alert on the topic issued March 1, 2016.

Criminals were successful in filing fraudulent tax returns within days (and perhaps hours) of obtaining the W-2s. The time and effort it takes to steal this valuable information — a few simple, targeted emails to unsuspecting employees — is significantly less than the time and effort it takes to infiltrate a network. For this reason, this phishing scam was extremely popular during the 2016 tax season, and has already shown signs of increasing during the 2017 tax season.

Actions You Can Take to Prevent Your Company from Becoming a Victim

Companies should remind employees, especially those who handle W-2s and other tax forms, to be aware of the threat. Employees should be advised that email requests for any type of sensitive data should be confirmed as legitimate through direct contact with the apparent sender via a phone call. If the employee is uncomfortable contacting the sender to confirm the request (which may be the case if the sender is purportedly the CEO or CFO), the employee should contact his or her supervisor, and supervisors should advise the employee not to send W-2s until the request is confirmed. Employees should be further advised that, rather than responding directly to the email, they should send a new email where they enter the recipient's email address manually. Employees should also be reminded of any policies and procedures regarding safeguarding personal information.

It is important to note as well that temp employees and contractors may be targeted by the scam because they are newer, lack familiarity with company executives, and may not have been provided the same training as permanent employees. We have seen several successful phishing attacks that targeted temp employees for these reasons. Companies should take care to ensure that all individuals who have access to employee W-2s are aware of the potential threat of phishing emails and are trained on steps they must take to prevent the company from becoming a victim. Employees should also be trained not to click on links or download attachments from unknown emails.

As part of its information security best practices, a company should identify key internal individuals with privacy and security roles who should be notified in the event it learns that an employee has potentially responded to a phishing email. By having this team in place prior to any security incident, including a phishing scam, a company can ensure that it is prepared to respond quickly should an incident occur.

What Your Company Should Do if It Becomes a Victim

Of course, even the most comprehensive training may not prevent a phishing scam from successfully targeting an employee. Companies should additionally advise employees that if they realize that they have become a victim of a phishing scam, they must immediately advise their supervisor. After learning of an incident, there are several steps a company can take to ensure a prompt and effective response:

• Notify key internal individuals with privacy and security roles of the incident and begin an internal investigation to confirm details;
• Identify affected former and current employees whose W-2s were sent to the attacker;
• Ensure that copies of the phishing email and response are preserved for potential forensic analysis and to provide to law enforcement;
• Prepare messaging to employees once the investigation yields accurate information about the incident to ensure a consistent message is communicated;
• Notify the FBI, IRS and state taxing authorities of the incident;
• Consider obtaining credit monitoring and identity theft resolution services; and
• Engage counsel to help determine legal notification duties, including to individuals and regulatory agencies, as applicable.

While companies often want to notify their employees as quickly as possible, it is important to prepare messaging that provides accurate information and does not unnecessarily alarm affected individuals. Further an affected company must keep potential liability issues in mind. While it is a laudable goal to notify employees quickly and provide them with information to protect themselves from tax fraud and identity theft, a company must also ensure that it does not assume blame for an incident that is ultimately the result of a third-party attack.

Conclusion

It is clear that for the above outlined reasons — namely, the relative ease and lack of technical knowledge necessary to perpetuate this scam — that the W-2 phishing scams popular in 2016 will continue in 2017. To avoid falling victim to these frauds, companies can and should provide information to employees to help employees recognize potential phishing emails before responding to them. If, despite best efforts, a phishing email is successful at enticing an employee to send W-2s, companies must prepare a coordinated response with consistent messaging that provides affected employees with enough information to protect themselves.

InsideCounsel