W-2 scams are not new to the business world, so why are criminals sticking with this same basic scam? Because it works. Employees are falling for this and many other 
scams all across the US and the failure rate is going up, not down. Criminals are going to continue to cash in on this scam until it stops yielding fruit.
What makes this W-2 scam a bit different from most of the others is that once the first scam works, they then hit up the compromised employee to set up a fraudulent wire transfer. So the criminal is getting paid immediately with the wired funds and then later on down the road when they sell the W-2 data or use it themselves to steal the identities of the employees.
Business email compromises (BEC) are successful due to the care a criminal will take to set them up. Instead of sending the email from a generic email address, they will spoof the email to make it look like an employee. It doesn’t take a cyberthief very long to acquire the name and email of a company CEO or CFO. It takes only a bit longer to get the email addresses of most, if not all of the targeted employees. Once they have this information, they can purchase a domain that looks very similar to the company domain, set up an email using a very real looking email address, and send it out the door.
The criminals are counting on the targeted employees to be busy and just want to take care of the CEO or CFO as fast as possible. If so, they will bypass any internal policies requiring the employee to place a verification call to ensure the wire is legitimate. Cybersecurity expert Jim Stickley commented on this type of scam on ABC News saying, "There's really nobody left anymore that is not a potential victim to this type of attack. When they (the scammers) send the email, they're referencing specific things about the company and about the actual sender to make it look very real."
Having an employee wire funds to a thief is terrible, but nowhere near the damage the leaked W-2 information can cause. Social Security Numbers (SSN) are yours for life. So criminals can resell and reuse that information for the rest of your life and beyond. That information is literally the gift that keeps on giving.
If your SSN has been compromised or you just want to play it safe, call one of the bureaus and set up a "credit freeze." This will freeze your credit so it cannot be used by anyone, including you, to acquire a credit card, a loan to buy a car, a house, or anything else. When you need your credit unfrozen for your purposes, all you have to do is call them again and get it back in action.
Experian
888-397-374
www.experian.com
TransUnion
800-680-7289
www.transunion.com
Equifax
800-525-6285
www.equifax.com
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
