Security

W-2 Phishing, Wire Transfer Scam Targets School Districts

• By Sri Ravipati
• 02/13/17

The Internal Tax Revenue Service (IRS) earlier this month issued an urgent alert to all employers that an extensive W-2 e-mail phishing scam has permeated the corporate sector and spread to school districts, nonprofits and others.  

“This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns,” IRS Commissioner John Koskinen said in the alert. “We need everyone’s help to turn the tide against this scheme.”

How the scam works: Cyber criminals use spoofing techniques to disguise an e-mail to make it look like it comes from an executive at the employee’s company or organization. “The e-mail is sent to an employee in the payroll or human resources departments, requesting a list of all employees and their Forms W-2,” the alert said. This strategy — sometimes referred to as business e-mail compromise (BEC) or business e-mail spoofing (BES) — first appeared during last year’s tax season. This time around, however, the cyber criminals are asking payroll employees to wire transfer funds to a certain account, which has resulted in job loss and thousands of dollars lost.

The latest “State of the Phish” report from Wombat Security Technologies found that while phishing attacks lowered 10 percent overall last year, users in the education industry were still twice as likely to fall for phishing e-mails (clicking through these e-mails 30 percent of the time compared to the national average of 15 percent). These findings suggest that e-mail phishing continues to be a highly effective cyberattack that results in serious damage to a company’s and employee’s critical data and information.

The Consortium for School Networking (CoSN), which is closely monitoring the situation, has issued its own alert, directing its members to the EdTech Strategies web page with real-time updates on the situation. A list of school districts that have been impacted by the W-2 phishing and wire transfer scam is available on the web page here. For more information, watch the video report from ABC Action News below.