STRS Ohio has been notified by the Internal Revenue Service that cybercriminals, posing as company executives, are emailing payroll and human resource professionals requesting lists of employees and their personal information. Two specific groups being targeted are schools and universities. These emails look legitimate because they appear to be sent from an internal administrator or supervisor requesting payroll data such as W-2 forms and Social Security numbers.
The IRS has established a process that allows employers to quickly report any data losses related to this W-2 scam. If notified in time, the IRS can take steps to prevent employees from being victimized by identity thieves filing fraudulent tax returns. You can also report receiving W-2 phishing emails even if you did not fall victim. View instructions for reporting data losses and phishing emails to the IRS.