The IRS recently warned employers to put their Payroll folks on high alert this tax season for phishing scams that have caught many of companies off-guard.
The most recent warning centers around a W-2 scam that impacted “hundreds of organizations and thousands of employees last year.”
Claims skyrocketed in 2017
Reports of a Form W-2 scam skyrocketed last year (900 reports in 2017 compared to a little over 100 in 2016) and cybercriminals have easily been able to trick scores of payroll pros – and other staffers with access to payroll info – into disclosing sensitive info from the entire workforce.
In general, the scam involves an email appearing to come from a company exec, asking payroll pros for a list of employees and their W-2s.
With its warnings, the IRS is hoping to prevent another record year for scammers. For more details or what to do if you’ve fallen victim to the scam, visit.
The convincing I-9 request
If you get a very convincing email from the U.S. Citizenship and Immigration Services (USCIS) about info on your employees’ I-9s, don’t follow the instructions.
The I-9 info request is the latest in a series of sophisticated scams targeting employers. And the scam appears to working.
Employers aren’t required to submit Forms I-9 to the USCIS,so such a request may raise some red flags for some folks. But the request is tripping up employers because the emails look very authentic. In fact, the emails actually come from a uscis.gov address. Plus, they even contain labels from both USCIS and the Office of Inspector General.
As if that’s not enough to fool some time-strapped HR pros, many of the emails also contain other details designed to make the messages appear legitimate — like your company’s mailing address.
The USCIS, however, has made it abundantly clear it’s not sending any emails to employers about their I-9s. It’s also warning firms not to click on any links in the email or respond to the sender.
Employers may also be tripped up because the feds recently announced they are ramping up I-9 audits, and firms want to respond as quickly as possible to any I-9-related requests. Again, the USCIS will never email about an I-9 audit.
As Alliance 2020, a background screening and information services provider, reminds employers:
“Audits of I-9’s are conducted by the Immigration and Customs Enforcement or the Department of Labor and notification of an upcoming audit is always done by a written notice from the agency. USCIS never requires employers to submit Forms I-9 to USCIS unless they are being audited….never requires an employer to email copies to them. At this time, the Officials will choose where they will conduct a Form I-9 inspection. For example, officials may ask that an employer bring Form I-9’s to a U.S. Immigration and Customs Enforcement field office. Sometimes, employers may arrange for an inspection at the location where the forms are stored.”
What to do if you’re targeted
To prevent your company from falling victim to this I-9 scam, there are several preemptive steps you should take ASAP.
First, make sure your employees are aware of the I-9 scam email and what the phony email will look like.
If workers do receive an I-9 info request, they should forward those messages to the Federal Trade Commission via the ftccomplaintassistant.gov site.
Also, if you receive an email from the USCIS and aren’t sure it’s legit, you can always double-check by forwarding it to uscis.webmaster@uscis.dhs.gov.
