That email from the boss asking for personal data on employees could be a fraudulent attempt to steal their identities. That’s the warning from the Internal Revenue Service (IRS) on the latest online “spoofing” scam to rear its ugly head. The IRS issued an alert to human resources and payroll professionals to warn them about a scheme that uses email – purportedly from company executives, but actually from cyber criminals posing as executives – to request employees’ personal information. The data requested often includes payroll records, including W-2 forms, which include employee Social Security numbers. Stolen Social Security numbers can be used to file fraudulent tax returns and claim refunds that rightfully belong to the taxpayer whose identity was appropriated. “Spoofing” is a type of phishing, a term used to describe the devious methods used by online criminals to steal private personal data, including sensitive details such as bank account numbers and Social Security numbers. In spoofing, a cyber thief uses an email address captured from a legitimate company officer to send what appears to be a genuine request for information “for review.” The request often requests specific data such as Social Security number, date of birth, home address, etc., which can all be used to create a new identity or file a fraudulent tax return. HR and payroll people who receive such a request from an executive should contact the individual directly, either in person or by telephone (not via return email) in order to confirm that the inquiry is valid. The IRS reports an approximate 400 percent surge in phishing and malware incidents so far this tax season, making it more important than ever to protect your personal – and personnel – data from online thieves. For more information and suggestions on how to protect yourself online, contact Gray, Gray & Gray at (781) 407-0300.
