It may be past tax time, but that doesn’t mean the stress is over. Experts say thieves are stealing W-2 information and selling it on the part of the internet hidden from search engines, known as the dark web.
The risk is real. Just ask Brigham Gonzalez. He recently changed jobs and moved on his own. Everything was great, until he woke up to a shocking call from his sister.
“She had received a letter from my previous employer stating that all of their W2s had been stolen,” Gonzalez says. Or at least the W-2 information.
He rushed to call the company, which verified the troubling news. “Somebody pretending to be upper level management just kind of bluffed their way into getting one of the employees to fax over all of the W2s,” he explains.
The letter explained that names, addresses, Social Security numbers, earnings and deductions were sent before it was realized that it was a con.
Caleb Barlow, VP of Threat Intelligence for IBM Security, says sometimes it’s phone calls, sometimes email scams, but W-2s are being stolen.
He took us into the cyber underground to marketplaces where vendors, complete with approval ratings, are selling stolen 2016 W-2’s in bulk for around thirty-five to forty dollars. Barlow showed us one site selling the tax information along with a date of birth and adjusted gross income, which is something required by the IRS to file a return.
In addition to filing a fraudulent tax return on your behalf, the documents can be used to establish credit, or outright steal your identity.
The IRS tells us that so far it has stopped 1-point-4 million confirmed identity theft tax returns, totaling $8 billion.
“Now, of course, the best protection is, ultimately, prevention, “stresses Barlow.
If your information is compromised: notify the Federal Trade Commission along with credit reporting bureaus, call your financial institutions and fill out all appropriate IRS forms.
No one filed a fraudulent tax return on Brigham, which made him breathe easier in the short term. “Long term,” he says,” I know that all of my information's still out there and anybody could decide to use it against me.”
