IRS warns about phishing emails in the payroll sector

As a practice, the emails usually impersonate a real company employee, often an executive, and are sent to payroll or human resources personnel, who are asked to change the employee’s deposit for payroll purposes. The fraudster provides a new bank account and routing number which leads to a fake account operated by the scammer.

Another situation sees the emails impersonating a company executive, and they are directed to the company employee responsible for wire transfers. The email requests that a wire transfer be made to a bank account for company purposes, but is actually controlled by the scammer.

In a third version, the emails impersonate a company executive, asking information about forms W-2 from payroll or HR. The information requests in the emails ask for the forms W-2 and earnings summary of all W-2 employees, or an updated list of employees with their personal details, such as Social Security Number, home address, and salary. Through this type of scam, thieves are allowed to file fraudulent tax returns for refunds.

As such, these scams are sometimes referred to as business email compromise (BEC) or business email spoofing (BES) scams, however, they can take other forms as well, including fake invoice payments, title escrow payments, wire transfers or other schemes that result in a quick payoff for the thief.