News release: Department of Revenue warns Minnesota businesses of phishing scheme targeting HR and payroll employees

FOR IMMEDIATE RELEASE
March 10, 2016

Contact: Ryan Brown
ryan.brown@state.mn.us

 

 Department of Revenue warns Minnesota businesses of phishing scheme targeting HR and payroll employees

ST. PAUL, Minn. – The Minnesota Department of Revenue is warning payroll and human resources professionals to beware of a phishing email scheme appearing to come from company executives requesting personal information on employees. Businesses across the country are being targeted; several companies have already fallen victim to the scheme.

“The stolen W-2 information can be used to file fraudulent tax returns and commit other identify fraud,” said Revenue Commissioner Cynthia Bauerly. “Each time a business falls victim to this scheme, personal taxpayer information and tax refunds are put at risk. We want businesses to know that they are being targeted by these criminals.”

This scheme is part of a surge in phishing emails seen this year. In several cases, payroll and human resource offices have mistakenly sent payroll data—including W-2 information containing Social Security numbers (SSNs) and other personal information—to cyber-criminals posing as company executives.

Criminals often use fake email addresses to make messages look like they are from real businesses or government agencies. Using a fake email address is a common way for criminals to try to steal personal information. One phishing variation is known as a “spoofing” email. It may contain the actual name of a company executive, such as the chief executive officer. In this scam, the cyber-criminal sends an email posing as the CEO to the company payroll office requesting a list of employees and information including their SSNs.

Payroll and human resources professionals should be wary of suspicious requests and should verify that any email asking for payroll data, including W-2 information containing SSNs or other personal information, is legitimate before sending the information. Do not reply to the email to verify its accuracy. Speak directly with the person who is requesting the information—face-to-face, if possible—to confirm that it is a valid request.

More information about these types of scams can be found on the IRS website. Learn more about scams, steps to prevent identity theft, and the Minnesota Department of Revenue’s fraud prevention efforts on our website.

Get the latest news and updates from the Minnesota Department of Revenue by following the department on Facebook and Twitter or by signing up for our email subscription list.

###