W-2 phishing

W-2 phishing uses a spoofed executive request to persuade payroll or HR to send employee tax records to an attacker. No money moves. What leaves the organisation is the wage and identity data of the entire workforce, which is then used for fraudulent tax filings and identity theft.

This library records 5 cases, all from 2016 and all following an almost identical script.

How the attack runs

1. Timing. Requests arrive during tax season, when such a request is plausible.
2. Impersonation of an executive, usually the chief executive or finance chief, by display-name spoofing.
3. A simple, bounded ask. A single file, framed as routine reporting, which is easier to comply with than a payment.
4. Persistence. In at least one case the employee pushed back and the attacker simply asked again.
5. Exfiltration by reply. The data leaves as an ordinary email attachment, so no security control is bypassed.

Documented cases

• Main Line Health (2016): roughly 11,000 employee W-2s sent to criminals after a spoofed executive request.
• GCI, the Alaska telecom (2016): a scammer posing as the finance chief obtained W-2s for more than 2,500 staff. The employee initially objected, then complied.
• Seagate (2016): every 2015 W-2 emailed to a scammer.
• Snap Inc. (2016): payroll data for around 700 current and former employees.
• Pivotal Labs (2016): US workforce tax data returned to a fraudster impersonating the chief executive.

How it differs from related techniques

Mechanically this is CEO fraud with a different objective: data rather than a transfer. It is a subtype of business email compromise, and the harvested identities frequently feed synthetic identity fraud downstream.

The control that would have stopped it

• Bulk employee data must never be sent by email. Route every such request through a system with logging and access control.
• A verification step for HR and payroll equivalent to the one finance uses for payments. These teams are frequently outside payment-fraud training entirely.
• Protect the employee who pushes back. GCI shows initial resistance is common and is then overcome by persistence; the process, not the individual, has to hold.
• Seasonal alerting. Because the timing is predictable, a scheduled reminder before tax season is unusually effective.