Tax season is almost here and along with it comes a warning from the Internal Revenue Service (IRS) to watch for fake payroll direct deposit and W-2 related emails. According the IRS, all types of industries, employers and tax preparers are being targeted by business email spoofing tactics.
These email scams are often masked to look like they are coming from a company employee–often someone in a leadership role. The fake employee will request a change in his/her direct deposit information or W-2 information, and sometimes even provide a new account number (which, in reality, belongs to the spammer).
You already know your business isn’t immune to fraud, so you need to be prepared. Email fraud could cost your company thousands of dollars and potentially cost you your job. So what can you do?
Examples from the IRS
Below are two fraudulent email examples straight from the IRS (with information removed). Take a look.
Example One:
From: [REMOVED]
To: [REMOVED]
Subject: ACH Payment Attention
[REMOVED],
Please confirm the receipt of my message, Authorized can you handle domestic transfer payment now?
Thanks you.
[REMOVED]
Sent from my iPhone
Example Two:
From: [REMOVED]
To: [REMOVED]
Subject: (no subject)
Hello [REMOVED],
I changed my bank and I will like my paycheck DD details changed. Do you think this change be effective for the next pay date?
[REMOVED]
Sent from my iPhone
What to Look For
While emails like the IRS examples may initially look legit, they will have two very scammy elements that should raise red flags: wrong email address and improper grammar.
- First, you’ll notice the email coming from a sender you recognize, but the email address doesn’t match up. Most of the time a fake email address will read as a bunch of gibberish and will go to a general account that the hacker monitors from afar.
- Second, you’ll see misspelled words, choppy phrases, and strange capitalization within the email body itself. According to the IRS, these are a common theme across email scams, so be sure to watch out for them.
What We Recommend: Do Not Reply
The best way to make sure the information is coming from the right person is take the conversation offline. Instead of replying to the email, pick up the phone or walk over to their workspace to confirm any account changes. If they don’t know what you’re talking about, you’ve most likely received a scammer’s email. Be sure to notify your team that fraudulent emails are going around and block the sender.
If you can’t get a hold of the person offline and need to reach out digitally, try instant messaging them or starting fresh with an entirely new email to an address you recognize.
Did you know? You could avoid scares like this altogether with payroll and tax filing software that allows your employees to securely make changes to their direct deposit and other personal information.
Share these tips with your colleagues. The more informed you and your team are, the harder it will be for scammers to win!
