Tax and W-2 Protection

Tax season is a prime time for scammers attempting to steal your personal information. Scammers have no shortage of tricks up their sleeve, from fraudulently posing as the Internal Revenue Service (IRS) or another government agency on a call, to sending a work email that appears to be from a "colleague," and these are just some examples. The fraudulent practice of obtaining information through intentional misrepresentation is called social engineering, and when conducted by email, “phishing.”

It’s important to stay alert for phishing and social engineering scams and to always be suspicious of any request for personal information or requests for money transfers, regardless of how a request is sent (call, email or text) until you are successfully able to independently confirm the request. In addition to monetary losses, victims of social engineering scams may suffer from identity theft as well, which can lead to serious consequences. Here are a few red flags to watch for:

  • The sender's name is vague, and the sender’s email address is long or convoluted
  • The email’s subject line is attention-grabbing or alarmist
  • The URL does not exactly match the name of the company or person in the message, but looks like a close replacement (e.g., “Amazn” or replacing the m in microsoft with “rn” rnicrosoft)
  • The email urges immediate action of some kind
  • An offer dangles a major discount
  • The email cites some pretense for seeking your personal information, including log-in information to a website
  • The email urges you to click hyperlinked text
  • A corporate executive or colleague who is requesting urgent, sensitive information such as tax forms, earnings summaries, employee or client lists and fund transfers
  • An email states that unless you take urgent action, an account will be shut off or terminated  

If you receive a suspicious social engineering message or phishing email, we strongly suggest that you immediately follow these steps:

  • Do not click on any links or open any attachments within the message. Do not reply to the suspicious email or use a phone number or other contact information in the email.
  • If you already replied to a suspicious email, clicked on an attachment or link, or provided personal information, contact your company’s IT team and report it immediately or go to your country’s/region’s applicable agency (e.g.,  IdentityTheft.gov in the U.S.) for more information and guidance.
  • Enable two-factor authentication (i.e., MFA) on your personal email program (if available).
  • Forward the email to your personal email provider (check with your email provider for instructions). You can also report the issue to the U.S. Federal Trade Commission at www.ftc.gov/complaint or local fraud authority and forward the email to reportphishing@apwg.org.
  • If the email is falsely pretending to be from an ADP employee or an official email from ADP, forward the email to abuse@adp.com.

For more information on how to avoid being a victim of a tax scam, review the IRS’s tax fraud alerts or your local country’s/region’s fraud authority to stay updated on the latest scams.

5 Ways to Prevent Tax Refund Theft

Even if you change your password daily and even if the password is complex, it is still possible for hackers to gain access to your personal information, like your Social Security number and birthdate. It is critical to take extra precautions to further protect your identity and your tax return.

Below are 5 ways to prevent tax refund theft:

  • File ASAP: As soon as you have everything you need to file, make sure you do. This way, if someone tries to file a return in your name later, it'll be automatically denied as a duplicate.
  • Keep your online information secure: With the amount of information that you share online, you must make it a priority to adequately secure it.
    • Do not use the same password across multiple accounts
    • Use strong, lengthy passwords that are unique and consist of numbers and symbols. Use phrases or groups of words.
    • Consider using an online password manager
  • Stay vigilant for phishing emails and texts: If you get an email or text that seems suspicious, asks you for information, or wants you to click on a link – don’t click or open attachments. Even if the email seems to be from a legitimate organization or a friend, hover over links to view the URL before you proceed.
  • Be alert to tax scams: Neither the IRS, other government institutions, nor ADP will ever call to threaten you or to demand immediate payment with a specific payment method. Nor will they demand you pay taxes with no questions asked or the right to appeal. If you get such a call from someone claiming to be an IRS agent, someone from ADP or a tax preparation firm, it's likely a scam. Hang up and call the IRS for example in the U.S. or your local region’s/country’s fraud authority and report it to your HR Department or contact the business in question to confirm.
  • Due Diligence: When choosing a tax preparer or online tax service, make sure you choose a reputable service that makes information security a priority. Ask for personal recommendations from people you trust.

In the U.S., check out the IRS’s Identity Theft Central for updated information on recent scams, how to protect yourself from identity theft and what to do if you are a victim.