Company W-2 Payroll Phishing Leak or CPA Tax-Preparer Breach: Protecting Every Employee's SSN and Tax Return¶

Discovering that a human resources or payroll specialist just emailed a .pdf, .csv, or .zip archive of every current and former employee's IRS Form W-2 (Wage and Tax Statement) or Form 1099 (or Canadian T4, UK P60, or Australian PAYG summary) to a cybercriminal who spoofed the CEO's or outside CPA's email address - or learning that your accounting firm's tax preparation server (Intuit ProSeries, Lacerte, Drake Tax, CCH Axcess, or UltraTax CS) was breached via a remote desktop or infostealer intrusion - is a five-alarm identity emergency for every person on that roster. Unlike a retail credit card breach (which is solved in 3 minutes by canceling a 16-digit plastic card), a leaked Form W-2 or Form 1040 hands criminals the permanent master keys to an individual's financial life: Full Legal Name, Unmasked 9-Digit Social Security Number (SSN), Home Street Address, Exact Annual Gross Wages (Box 1), Exact Federal and State Income Tax Withheld (Boxes 2 & 17), and the Employer's 9-Digit Federal Employer Identification Number (EIN). Criminal syndicates monetize stolen W-2 batches within hours of receipt: they feed the exact EIN, Box 1 wages, and Box 2 withholding directly into automated e-file bots to pass the IRS return-matching filters and steal massive fraudulent tax refunds before the real employees have even filed their taxes. For broader enterprise email compromise recovery, also consult corporate Business Email Compromise (BEC) and wire fraud recall; if an employee's individual identity or child's SSN is already being used for loans, see identity theft response and synthetic identity theft and child SSN credit freeze. If this breach involves physical extortion or an immediate life-safety emergency, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) or consult our directory of emergency numbers.

Do this now¶

1. IF YOU ARE THE EMPLOYER, HR DIRECTOR, OR PAYROLL ADMIN (Hour 1): Report the W-2 / SSN loss directly to the IRS W-2 Data Loss Unit at dataloss@irs.gov IMMEDIATELY:
2. Do not wait days for outside legal counsel to draft employee notification letters before alerting the IRS. Every hour you wait allows criminals to e-file hundreds of fraudulent Form 1040 tax returns using your company's EIN and your employees' leaked W-2 boxes.
3. Send an email right now to dataloss@irs.gov with the exact subject line "W2 Data Loss" containing your company name, Employer Identification Number (EIN), contact name/phone number, a brief summary of how the leak occurred, and the approximate number of employees affected (NEVER attach the employee SSN list to this initial email - an IRS Stakeholder Liaison will contact you with an encrypted transmission channel so the IRS can flag every affected employee's SSN against fraudulent e-filing).
4. IF YOU ARE A CPA, ENROLLED AGENT, OR TAX PREPARER (Hour 1): Contact your local IRS Stakeholder Liaison AND lock your EFIN / PTIN in your IRS e-Services account immediately:
5. Under IRS Publication 4557 (Safeguarding Taxpayer Data) and the FTC Safeguards Rule (16 CFR Part 314), tax professionals must report any suspected client data theft or unauthorized e-filing under their Electronic Filing Identification Number (EFIN) to their IRS Stakeholder Liaison within hours so the IRS can block fraudulent returns transmitted using your firm's EFIN and CAF number.
6. IF YOU ARE AN AFFECTED EMPLOYEE OR TAXPAYER (Minute 1): Go to irs.gov/ippin right now and obtain your 6-digit IRS Identity Protection PIN (IP PIN):
7. An IRS Identity Protection PIN (IP PIN) is a secret 6-digit code known only to you and the IRS. The moment you enroll at irs.gov/ippin, the IRS computer system automatically rejects any electronic Form 1040 tax return filed under your Social Security Number (SSN) that does not include that exact 6-digit IP PIN - even if the criminal has your exact W-2 PDF in front of them.
8. If a criminal ALREADY beat you to it and your e-filed tax return was just rejected with IRS Error Code IND-031-04 or R0000-902-01 ("A return with this SSN has already been filed"):
9. You cannot e-file a second return online once a scammer's return has been accepted. You must print your legitimate Form 1040 on paper, attach a completed IRS Form 14039 (Identity Theft Affidavit) and a copy of your real W-2, and mail the paper packet to the IRS filing center for your state (or submit Form 14039 online at irs.gov/dmaf while mailing your paper return).
10. Freeze your 3 Primary Credit Bureaus (Equifax, Experian, TransUnion) PLUS the 3 Secondary Bureaus (ChexSystems, LexisNexis, and The Work Number):
11. Because a W-2 leak exposes your SSN, exact salary, and employer EIN, criminals use W-2 data not only for tax fraud, but also to open bank accounts (ChexSystems), auto loans, and fake unemployment claims (State Workforce Agency).
12. Create your personal my Social Security account (ssa.gov/myaccount) and your state tax portal account before the criminals register them in your name:
13. Identity thieves who possess your W-2 routinely rush to ssa.gov and your state Department of Revenue / Unemployment portal to claim your uncreated online profile using your W-2 wage history as the "knowledge-based verification" answers. Register your own accounts immediately so the criminals are locked out.

Decision tree: immediate Day-1 response for Employers/CPAs vs. Affected Employees¶

Follow the branch matching your role (Organization/HR/CPA vs. Individual Employee/Client) to execute every mandatory containment step in the first 24 hours:

flowchart TD
    Start["W-2 Payroll Phishing Leak or CPA Tax Server Breach Discovered"] --> RoleCheck{"Are You the Employer / CPA Firm, or Are You an Affected Employee / Taxpayer?"}

    RoleCheck -->|"Employer, HR Director, Payroll Provider, or CPA Firm"| OrgBranch["PHASE 1A: Mandatory Organizational & IRS Containment (Hours 1 to 24)"]
    RoleCheck -->|"Affected Employee, Contractor (1099), or CPA Client"| EmpBranch["PHASE 1B: Individual SSN & Tax Lockdown (Minutes 1 to 60)"]

    OrgBranch --> IRSNotify["1. Email dataloss@irs.gov (Subject: 'W2 Data Loss') & Notify Federation of Tax Administrators (StateAgencies@taxadmin.org)"]
    IRSNotify --> CPACheck{"Was a CPA Tax Software Server (Drake / Lacerte / ProSeries / CCH) Breached?"}
    CPACheck -->|"Yes: CPA Firm"| CPASteps["2. Call IRS Stakeholder Liaison -> Audit EFIN Transmission Counts in e-Services -> Report to FTC (Safeguards Rule) if >= 500 Clients"]
    CPACheck -->|"No: Corporate W-2 BEC Phish"| BECSteps["2. Check If Phisher Had Actual Mailbox Access (M365/Google Audit Logs) vs External Display-Name Spoof -> File FBI IC3 Report"]

    CPASteps --> NotifyStaff["3. Notify All Affected Employees/Clients Within 24-72 Hours so They Can Lock IRS IP PINs Before Scammers E-File"]
    BECSteps --> NotifyStaff

    EmpBranch --> LockIPPIN["1. Enroll in IRS Identity Protection PIN Immediately at irs.gov/ippin (Blocks Fraudulent 1040 E-Filing)"]
    LockIPPIN --> AlreadyFiled{"Did Scammer Already E-File Under Your SSN (Reject Code IND-031-04 / R0000-902-01)?"}

    AlreadyFiled -->|"Yes: Return Rejected as Duplicate"| File14039["2A. Submit IRS Form 14039 Online (irs.gov/dmaf) AND Mail Signed Paper Form 1040 + W-2 + Form 14039"]
    AlreadyFiled -->|"No: Not Yet Filed"| ClaimPortals["2B. Claim Your Account at ssa.gov/myaccount, irs.gov, and State Tax / Unemployment Portal"]

    File14039 --> FreezeAll["3. Freeze Equifax, Experian, TransUnion, ChexSystems, LexisNexis, and Equifax 'The Work Number'"]
    ClaimPortals --> FreezeAll

Phase 1: Emergency Playbook for Employers, HR Directors, and CPA Firms (Hours 1 to 24)¶

When a payroll department falls for the classic CEO W-2 spear-phishing email ("Hi [Name], I'm in a board/audit meeting and need PDF copies of all employee W-2s for 2025 right away, please send as an attachment"), or when a CPA firm discovers an unauthorized remote-access tool (ScreenConnect, AnyDesk, Splashtop) exported client .tax files, speed determines how many employees suffer actual tax return theft.

Step 1: Notify the IRS W-2 Data Loss Unit (dataloss@irs.gov) in Hour 1¶

The Internal Revenue Service maintains a dedicated rapid-response pipeline with the Security Summit (IRS, state revenue departments, and tax software providers) specifically to place bulk systemic fraud filters on every SSN associated with a breached employer EIN. 1. Send an immediate unencrypted plain-text email to dataloss@irs.gov: - Subject Line: W2 Data Loss - Body text must include: - Business / Organization Legal Name - Business Employer Identification Number (EIN) (all affected EINs if multiple subsidiaries were included) - Contact Person's Name, Title, Direct Phone Number, and Email Address - Date the W-2 leak occurred and Date discovered - How the leak occurred (for example, "CEO email spoofing to payroll manager" or "Unauthorized access to payroll portal") - Total number of employees / forms affected (W-2, 1099-NEC, etc.) - CRITICAL: Do NOT attach the spreadsheet or PDF of employee SSNs to this initial email. Within hours, an IRS investigator will reply with secure instructions to upload the masked/encrypted list of affected SSNs so the IRS Return Integrity and Compliance Services (RICS) engine can place an immediate fraud marker on every employee's tax account.

Step 2: Notify ALL State Tax Agencies in a Single Email via the Federation of Tax Administrators (FTA)¶

Employees also have their State Income Tax refunds stolen using Box 15/16/17 of the leaked W-2. Instead of looking up 50 separate state Department of Revenue phone numbers: - Email StateAgencies@taxadmin.org (maintained by the Federation of Tax Administrators FTA in partnership with the IRS Security Summit). - Provide your company name, contact details, Which states you have employees in (Do not include SSNs in the email), and the FTA will immediately coordinate the state-level W-2 block with every affected State Department of Revenue.

Step 3: Additional Mandatory Actions If You Are a CPA Firm or Tax Preparer¶

If a tax preparation firm (CPA, EA, Tax Attorney, or bookkeeping service) suffers a breach of client tax files (Drake, Lacerte, ProSeries, UltraTax, CCH, TaxSlayer Pro, ATX): 1. Log into IRS e-Services (irs.gov/e-services) immediately and check your EFIN status: Check the number of returns transmitted under your firm's Electronic Filing Identification Number (EFIN). Attackers who breach CPA workstations silently transmit hundreds of modified client Form 1040 returns overnight (changing only the direct deposit routing and account numbers on Form 1040 / Form 8888 to the attacker's Green Dot / Chime / prepaid mule accounts). 2. Contact your local IRS Stakeholder Liaison immediately: Find your state's Stakeholder Liaison at irs.gov/businesses/small-businesses-self-employed/stakeholder-liaison-local-contacts. The Stakeholder Liaison will coordinate with IRS Criminal Investigation (IRS-CI) and issue a replacement EFIN if yours was compromised. 3. Comply with the FTC Safeguards Rule (16 CFR Part 314) 30-Day Breach Notification Mandate: All professional tax preparers in the United States are legally classified as " non-banking financial institutions" under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule. Under the amended FTC Safeguards Rule (effective May 2024), any breach involving the unencrypted nonpublic personal information of 500 or more consumers must be reported electronically to the Federal Trade Commission (FTC) within 30 days of discovery.

Step 4: File an FBI IC3 Report and State Attorney General Breach Notices¶

1. File a W-2 Business Email Compromise report at ic3.gov (FBI Internet Crime Complaint Center): Include the complete RFC 5322 original email headers (Authentication-Results, Received: from IP addresses, Reply-To: domain) of the phishing email that tricked your payroll employee.
2. Verify whether your employee's email account was actually hacked vs. externally spoofed:
3. Inspect Microsoft Entra ID / Google Workspace audit logs: did an external domain (ceo-companyname.com or a gmail.com reply-to address) simply spoof the CEO's Display Name, or did an attacker actually log into the CEO's or HR employee's real mailbox? If an attacker logged into the HR/Payroll mailbox directly, every historic W-2, direct-deposit voided check, and I-9 passport scan in their Sent Items and Inbox is also compromised. Follow email account hacked, forwarding rules, and recovery.
4. Send an urgent "Day-1 Heads-Up" alert to all affected employees immediately: Even if your formal state-law breach letter (including 12 to 24 months of paid identity monitoring such as IDX, Experian IdentityWorks, Norton LifeLock, or Kroll) takes 3 to 5 days to provision, send an internal alert to your employees on Day 1 instructing them to obtain an IRS Identity Protection PIN (irs.gov/ippin) and freeze their credit bureaus today before the criminals file returns in their names.

Phase 2: Complete Protection Playbook for Affected Employees & Taxpayers¶

If you just received an email or letter stating that your employer's W-2 files or your CPA's tax server was breached, do not simply sign up for the free 1-year credit monitoring code and relax. Credit monitoring only sends you an alert after a loan is opened, and credit monitoring has zero visibility into IRS tax returns, unemployment claims, or payroll direct-deposit changes.

Compare what a W-2 leak exposes and the exact lock required to close each vulnerability:

Step-by-Step Employee Lockdown Sequence (Takes 35 Minutes Total)¶

Step 1: Lock Your IRS Tax Account with an Identity Protection PIN (IP PIN)¶

1. Go directly to the official IRS portal: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin (irs.gov/ippin).
2. Click "Get an IP PIN" and sign in with your existing ID.me / IRS account (or verify your identity to create one).
3. Tip: By creating your IRS.gov / ID.me account right now, you also prevent the criminals from creating a fake ID.me account under your SSN to download your old tax transcripts.
4. Once verified, the screen will immediately display your 6-digit IP PIN. Save this number in your password manager.
5. How the IP PIN works: When you (or your CPA) file your real federal tax return this year, you enter this 6-digit number in the Identity Protection PIN box next to your signature on Form 1040. If any criminal tries to e-file a tax return using your SSN without that exact 6-digit code, the IRS e-file server rejects their submission in 1 millisecond. (Note: Every January, the IRS generates a fresh 6-digit IP PIN inside your online account for the new filing season.)
6. If you are married and file Married Filing Jointly: Have your spouse also obtain an IP PIN for their SSN, even if only your employer was breached, because a joint tax return lists both SSNs.

Step 2: File IRS Form 14039 (Identity Theft Affidavit) ONLY If Needed¶

Do not mail a paper Form 14039 if you successfully got an IP PIN online and no fraudulent tax return has been filed yet - the IRS explicitly advises that obtaining an IP PIN online is faster and avoids paper processing delays. However, you MUST file IRS Form 14039 (Identity Theft Affidavit) immediately if: - Your e-filed tax return was rejected because someone already filed a return using your SSN (IND-031-04 / R0000-902-01), OR - You cannot verify your identity online at irs.gov/ippin, OR - You received an IRS notice (CP01E, 5071C, 4883C, 5747C, or CP2000) referencing a tax return you did not file or wages from an employer you never worked for. - How to submit Form 14039: You can submit it online via the IRS Document Upload Tool at irs.gov/dmaf (if filing before a duplicate rejection) or attach the signed paper Form 14039 directly behind your signed paper Form 1040 and mail it to the IRS center for your state.

Step 3: Place Free Permanent Security Freezes Across All 7 Bureaus (Primary + Secondary)¶

Under federal law (Economic Growth, Regulatory Relief, and Consumer Protection Act), freezing and unfreezing your credit is 100% free at every bureau. Do not let the bureaus upsell you into a $19.99/month paid "Credit Lock" product; always select the statutory "Security Freeze":

1. Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 1-888-298-0045.
2. Experian: experian.com/freeze/center.html or call 1-888-397-3742.
3. TransUnion: transunion.com/credit-freeze or call 1-800-916-8800.
4. Innovis (The 4^th Consumer Credit Bureau): innovis.com/personal/securityFreeze or call 1-866-712-4546.
5. ChexSystems (Stops scammers from opening fraudulent checking/savings accounts in your name): chexsystems.com/security-freeze/place-freeze or call 1-800-428-9623.
6. LexisNexis Risk Solutions (Used by auto insurers, mortgage lenders, and government portals): consumer.risk.lexisnexis.com/freeze or call 1-800-456-1244.
7. Equifax The Work Number (Used for employment/salary verification and payday loans): Call 1-800-367-2884 or visit employees.theworknumber.com and request an Employee Data Freeze on your SSN.

Step 4: Claim Your my Social Security (ssa.gov) and Employee Payroll Portal (ADP / Workday / Gusto)¶

1. Visit https://www.ssa.gov/myaccount/ and make sure your Social Security account is registered to your own email and Authenticator/Login.gov 2FA. Once your ssa.gov account is claimed by you, no criminal can register an online Social Security account under your SSN or divert future benefits.
2. Log into your employer's self-service payroll portal (ADP, Workday, Paychex, Gusto, Rippling, Paylocity, UKG). Because a W-2 contains the exact dollar figures that some legacy payroll helpdesks ask for when resetting a password ("What was your Box 1 YTD gross pay on your 2025 W-2?"), enable Authenticator App or Passkey 2FA on your payroll login immediately and verify that your bank routing/account number for Direct Deposit has not been altered.

Phase 3: What to Do If You Receive a Fake State Unemployment (1099-G) or IRS Balance-Due Notice Months Later¶

Because W-2 databases are resold on dark-web markets for years after the initial phishing leak, watch for these two delayed attacks:

1. Fraudulent State Unemployment Claim (You receive a debit card, PIN mailer, or Form 1099-G in the mail, or your HR department receives a "Request for Separation Information" while you still work there)¶

• Step 1: Immediately notify your HR department and your State Workforce Agency (SWA) Fraud Hotline (dol.gov/general/topic/unemployment-insurance lists every state fraud portal).
• Step 2: Do NOT report fraudulent 1099-G unemployment income on your federal tax return. Under IRS guidance (IR-2021-24), even if your state agency has not yet sent you a corrected $0 Form 1099-G by April 15, only report the real income you actually received on your Form 1040; reporting the scammer's fake unemployment payout on your return will wrongly tax you on money you never touched.

2. Employment-Related Identity Theft (Someone uses your stolen SSN on an I-9 / W-4 to work at another job, and the IRS sends you a CP2000 notice saying you underreported wages from an unknown company)¶

• Respond to the CP2000 notice by checking the box stating you never worked for that employer, attach IRS Form 14039 (checking Box 2: "Someone used my information to earn income"), and review your annual earnings history inside ssa.gov/myaccount every spring to make sure no stranger's wages are posted to your Social Security record.

Phase 4: Organizational Prevention Checklist - Stopping W-2 Phishing and CPA Breaches¶

• Establish an Ironclad "Zero Email W-2" Corporate Rule: Make it written corporate policy - signed by the CEO, CFO, and every HR/Payroll employee - that no employee W-2, 1099, or payroll census file may EVER be sent via email attachment to anyone, including the CEO or Board of Directors, without an in-person or live video multi-person verification and an encrypted portal transfer.
• Configure Outbound Data Loss Prevention (DLP) Rules in Microsoft Purview (M365) or Google Workspace: Create an automated outbound DLP transport rule that blocks any external outbound email containing more than 3 U.S. Social Security Number (SSN) regex patterns (\b\d{3}-\d{2}-\d{4}\b) or Form W-2 templates. When an HR employee tries to attach a 50-page W-2 PDF to an external email address, the mail server blocks transmission automatically before a single byte leaves the building.
• Add an External Sender Warning Banner ([EXTERNAL EMAIL - SPOOF WARNING]) Specifically Flagging Executive Display Names: Configure an Exchange Online / Google Workspace anti-impersonation rule (VIP / Executive Spoof Protection) that quarantines or slaps a bright red warning banner on any inbound email from outside the organization whose From: Display Name matches the exact First and Last Name of your CEO, CFO, or General Counsel.
• For CPA Firms: Isolate Tax Software Servers (Drake, Lacerte, ProSeries) Behind Phishing-Resistant FIDO2 MFA and Written WISP Controls: Every US tax practice is required by IRS Publication 4557 (and the annual PTIN renewal checkbox) to maintain a written Written Information Security Plan (WISP), enforce Multi-Factor Authentication (MFA) on all local and cloud tax software logins, and ban unauthenticated Remote Desktop Protocol (RDP port 3389) exposure.

Regional emergency numbers and agency protocols¶

If your organization or personal tax identity was compromised in a payroll or tax-preparer breach, report to the statutory tax and data-protection authorities in your jurisdiction:

• United States: Employers email dataloss@irs.gov (Subject: W2 Data Loss) and StateAgencies@taxadmin.org. Taxpayers call 1-800-908-4490 (IP PIN: irs.gov/ippin; Online Form 14039: irs.gov/dmaf). Report W-2 phishing at FBI IC3 (ic3.gov) and IdentityTheft.gov (1-877-438-4338).
• Canada (T4 / SIN Breaches): Call the CRA Identity Protection Services (1-800-959-8281) to place a Security PIN on your SIN, and report organizational breaches under PIPEDA to the OPC (priv.gc.ca / 1-800-282-1376).
• United Kingdom (P60 / NINo Breaches): Report to HMRC (0300 200 3300 / phishing@hmrc.gov.uk), notify the ICO (0303 123 1113) within 72 hours under UK GDPR, report to Action Fraud (0300 123 2040), and enroll in Cifas Protective Registration (cifas.org.uk).
• European Union: Notify your national Data Protection Authority (DPA) within 72 hours under GDPR Article 33 and notify affected employees under Article 34.
• Australia and New Zealand (TFN / IRD Breaches): In Australia, call the ATO Client Identity Support Centre (1800 467 033) to lock your TFN, report under the OAIC NDB scheme (oaic.gov.au), and call IDCARE (1800 595 160). In New Zealand, call Inland Revenue (0800 227 774).
• India and Asia-Pacific (Form 16 / PAN Breaches): Report to CERT-In (incident@cert-in.org.in) within 6 hours, call 1930 (cybercrime.gov.in), and enable Aadhaar Biometric Lock (myaadhaar.uidai.gov.in).

Frequently asked questions¶

Does freezing my credit at Equifax, Experian, and TransUnion stop a criminal from filing a fake IRS tax return with my leaked W-2?¶

No, not at all. A credit freeze at Equifax, Experian, and TransUnion only blocks banks and lenders from pulling your consumer credit report to open new credit cards, auto loans, or mortgages. The Internal Revenue Service (IRS) and State Departments of Revenue never pull your consumer credit report when you file a tax return. The only lock that stops a criminal from e-filing a fraudulent Form 1040 tax return with your leaked W-2 is an IRS Identity Protection PIN (IP PIN) obtained directly at irs.gov/ippin.

How long will my real tax refund be delayed if a scammer already e-filed a fake return under my SSN before I got an IP PIN?¶

If your electronic tax return was rejected as a duplicate (`IND-031-04`) and you had to mail a paper Form 1040 with Form 14039 (`Identity Theft Affidavit`), the IRS Identity Theft Victim Assistance (`IDTVA`) unit must manually investigate the two competing returns, purge the criminal's fraudulent return from your master tax transcript, and process your paper return. Depending on current IRS IDTVA inventory backlogs, resolving a duplicate identity-theft tax return typically takes between 120 days and 360+ days (though the IRS pays statutory interest on legitimate refunds delayed past 45 days after April 15, and once resolved, the IRS automatically mails you a new 6-digit IP PIN every January for life).

My employer offered 12 or 24 months of free Experian IdentityWorks / LifeLock / IDX monitoring after the W-2 leak. If I accept it, do I waive my right to join a lawsuit?¶

In almost all standard statutory data-breach notification letters in the United States, enrolling in the complimentary 12-to-24-month identity monitoring code provided by your employer or CPA firm does not waive your legal rights against the breached company - state attorneys general strongly discourage or prohibit tying mandatory statutory breach remediation to liability releases. However, read the fine print on the enrollment webpage carefully: occasionally, the third-party monitoring vendor's own Terms of Service includes an arbitration clause governing disputes with the monitoring vendor itself, which is separate from your employer.

What if I cannot pass the online ID.me verification at irs.gov/ippin to get my IRS Identity Protection PIN?¶

If the online tool at irs.gov/ippin cannot verify your identity (or if you prefer not to use facial recognition on ID.me, where you can also request a live video chat agent instead of automated selfie matching), you have two official alternatives: (1) If your adjusted gross income (`AGI`) is below the threshold ($84,000 for individuals or $168,000 for married filing jointly), you can file IRS Form 15227 (`Application for an Identity Protection Personal Identification Number`) and an IRS assister will call you to verify your identity over the phone; or (2) regardless of income, you can schedule an in-person appointment at your nearest IRS Taxpayer Assistance Center (`TAC`) by calling 1-844-545-5640 and bring two forms of government identification.

Can a criminal use my W-2 to change my bank account on file with the IRS or steal my home title?¶

Once you obtain an IRS IP PIN and claim your online account at irs.gov, a criminal cannot log into your IRS profile or submit a new return to change your refund direct-deposit bank account. As for home title or mortgage fraud, while a W-2 provides your SSN and home address, county property recorders require notarized deed signatures; you can sign up for your county clerk/recorder's free Property Fraud Alert email notification service (offered free by most US county recorders and HM Land Registry Property Alert in the UK) so you receive an email the day any document is recorded against your parcel.

Should our company reissue new "Corrected" W-2s (Form W-2c) to employees after a W-2 phishing leak?¶

No. IRS Form W-2c (`Corrected Wage and Tax Statement`) is only used when the dollar amounts, name, or SSN printed on the original W-2 were mathematically or clerically wrong. You cannot change an employee's Social Security Number or your company's `EIN` via a `W-2c`. Employees must still use their original, accurate W-2 to file their taxes, while your company's immediate notification to dataloss@irs.gov and the employees' enrollment in irs.gov/ippin protect the filing process.

Related guides¶

• Corporate Business Email Compromise (BEC) and wire fraud recall
• Identity theft response
• Synthetic identity theft and child SSN credit freeze
• Email account hacked, forwarding rules, and recovery
• Data breach response and password leaks
• Fake job offer scam, equipment check fraud, and onboarding identity theft
• Emergency numbers by country

Sources and official guidance¶

• Internal Revenue Service (IRS) & Security Summit (United States): Form W-2 / SSN Data Loss Incident Response Protocol (dataloss@irs.gov), Publication 4557 (Safeguarding Taxpayer Data: A Guide for Your Business), and Publication 5293 (Data Security Resource Guide for Tax Professionals).
• Internal Revenue Service (IRS) Taxpayer Advocate Service: Identity Protection PIN (IP PIN) Enrollment Procedures and Form 14039 (Identity Theft Affidavit) Instructions.
• Federal Trade Commission (FTC) (United States): Standards for Safeguarding Customer Information (FTC Safeguards Rule, 16 CFR Part 314) & IdentityTheft.gov Tax Identity Theft Recovery Steps.
• Federation of Tax Administrators (FTA): State Department of Revenue W-2 Data Breach Coordination Protocol (StateAgencies@taxadmin.org).
• Federal Bureau of Investigation (FBI IC3): Public Service Announcements on Payroll W-2 Business Email Compromise (BEC) Spear-Phishing and Direct Deposit Diversion.