United States

Cyber criminals unleash new schemes to get taxpayer information

Even upper management requests may need to be scrutinized


The IRS is warning consumers and employers about sophisticated email schemes designed to trick taxpayers into thinking that the email is an official communication from the IRS, a tax software company or even a corporate executive. Some of the phishing emails request information related to a refund or for confirmation of personal information such as filing status, dependents, personal identification number (PIN) information, etc. Taxpayers have been tricked into providing transcripts of their tax accounts or providing tax information (address, social security numbers and other details from a filed tax return) to the scammers.

Recent scams reported by the IRS include:

An email that appears to be coming from the IRS Taxpayer Advocacy Panel about a tax refund

This is a scam that tries to trick unsuspecting individuals into providing information. Clicking on an email link takes the victim to a scam website designed to trick him or her into providing personal or financial information including social security numbers, PINs, etc.

Authentic looking emails targeting human resource professionals or payroll departments requesting W-2 information for the company’s employees

The email appears to come from a corporate executive, such as the CEO or CFO, and is designed to steal employee W-2 information so that authentic-looking, fraudulent tax returns showing a refund can immediately be filed. Alternately the data may be sold to identity thieves who use it to obtain credit cards or loans from legitimate lenders. The “spoofing” scam has caught a number of sophisticated companies off guard and some HR or payroll department employees have unknowingly provided employee W-2 information to scammers.

Aggressive and threatening phone calls by criminals impersonating IRS agents

The scam caller informs the victim that they are trying to verify a few details to process the return showing a refund and tries to get the victim to give up personal or financial information such as bank numbers or credit cards.

Aggressive phone calls requiring prompt payment of overdue or underpaid taxes

Scam callers claim to be IRS employees and inform victims that they owe money to the IRS that must be paid promptly through a pre-loaded debit card or wire transfer. The scammers often leave an “urgent” callback request threatening the victim with arrest, deportation or suspension of a business license or driver’s license.

What you should know:

The IRS does not communicate with taxpayers by email. If there are questions about a refund or tax return, a letter will be sent to the taxpayer requesting a response. The IRS mailing address on the letter should be verified before responding. Service Center addresses are posted on the IRS website.

The IRS does not call taxpayers on the phone to collect a debt without first informing them by letter of the details of the amount owed, the type of tax and the years involved. The IRS does not ask for credit or debit card numbers over the phone or require taxpayers to pay taxes using a particular method (such as a wire transfer or prepaid debit card.)

The IRS will also not threaten to bring in the police or other agencies to arrest a taxpayer for not paying tax due. Do not respond to the phone call threats and do not give out any information. Instead, hang up immediately.

What you should do if you or your company falls victim to these scams:


Individual victims should report the scam to the Treasury Inspector General for Tax Administration (TIGTA) by calling 800-366-4484 or by using the IRS Impersonation Scam Reporting page on TIGTA’s website.

If you receive a letter from the IRS requesting that you verify certain information on a filed tax return, and you have not yet filed your return, you are likely the victim of a false return filed using your information. You should inform the IRS of this by responding to the letter and by filing an identity theft affidavit with the IRS using Form 14039.

The IRS will begin an investigation of the return and may send you an IP PIN for the next filing season. You should also contact the credit rating agencies to freeze any new credit applications filed without your direct instruction and approval. The IRS also recommends that you file a report with the Federal Trade Commission.

Note that scammers can file fraudulent state returns too. See your state revenue department’s website to learn about scams impacting states and how to file a report. Be skeptical of communications you receive from sources you are not expecting and verify the authenticity of phone calls, mail, faxes or emails before responding.


If your company has fallen victim to a scam and has unknowingly provided employee personal and financial data to a scammer, you should take immediate action to prevent the payment of fraudulent refunds.

  1. Instruct your employees to file Form 14039 to report the scam and indicate the potential impact on their returns
  2. Advise employees to establish a “My Social Security” account on the Social Security website to monitor any unauthorized use of the employee’s SSN to claim benefits or issue fake W-2s as a part of a tax refund fraud scheme
  3. Report the scam to the IRS and preserve the fraudulent email so that the IRS can begin an investigation
  4. Contact your state revenue department and request that your employee’s data be flagged to catch fraudulent returns as soon as they are filed

Companies who have fallen victim to these schemes may want to offer further protection to their employees in the form of identity theft protection services through various reputable vendors.

To prevent the most recent email scam attacking human resources and payroll departments, companies should inform their departments to verify any requests for employee data via live conversation with the requester or through secure company channels other than email.

Access the IRS website for updates on the latest scams and share this information with others.