Written by Kelsey Beauchamp
It’s February. W-2s, 1099s, and filing deadlines are on everyone’s radar. Your accountant is busy, your bookkeeper is buried in paperwork—and your inbox is starting to heat up.
But before April even comes into view, there’s a tax season threat targeting small/medium businesses across North Dakota, Minnesota & South Dakota: a scam that preys on trust, urgency, and your company’s internal processes.
If your business is based in Fargo, Grand Forks, Moorhead, Jamestown, Wahpeton—or anywhere within 200 miles of Fargo—this one’s for you.
The W-2 Scam: How It Works
This scam hits payroll and HR departments first. Here’s the playbook:
Someone in your company—usually whoever handles payroll—gets an email that appears to come from the CEO or business owner.
It reads something like:
“Hey, I need copies of all employee W-2s for a quick meeting with the accountant. Can you send them over ASAP?”
It’s short. It’s urgent. It sounds legit. And during a chaotic tax season, it doesn’t raise alarms.
So your employee sends the W-2s.
Only… the email wasn’t from you. It was a scammer using a spoofed or lookalike email domain.
Now the attacker has everything needed to commit identity theft:
- Employee names
- Social Security numbers
- Home addresses
- Salary info
In other words: a goldmine.
What Happens Next
You don’t find out until it's too late.
One of your employees tries to file their taxes and gets an error:
“A return has already been filed using this Social Security number.”
The scammer beat them to it—using your data.
Now you’ve got an employee dealing with:
❌ IRS disputes
❌ Identity theft recovery
❌ Months of stress and paperwork
Multiply that across your entire payroll—and now your business is in crisis.
This isn't just an IT problem. It’s an HR disaster, a reputation hit, and a serious legal risk.
Why This Scam Works So Well (and Why Fargo-Area Businesses Are Prime Targets)
This isn’t your typical spam email. It’s targeted and timely.
Here’s why it slips through:
✅ Perfect timing – February is prime time for W-2 requests.
✅ Believable urgency – Everyone’s moving fast. No one wants to slow down tax prep.
✅ Looks legit – Scammers often know your CEO’s name. Some even mimic your accountant.
✅ Employees want to help – Especially when they think the boss is asking.
5 Ways to Protect Your Business—Today
You don’t need expensive tech to block this scam. You need a few smart rules and a culture of caution:
- No W-2s via email. Ever.
No exceptions. Period. Make this a company-wide policy. - Verify sensitive requests with a second channel.
Call. Walk over. Use chat. Just don’t hit “reply.” - Have a tax scam huddle now.
Pull in your HR, payroll, and admin staff. It takes 10 minutes. Awareness is your best firewall. - Use MFA (multi-factor authentication) on payroll systems.
If credentials get stolen, MFA can stop attackers from logging in. - Reward double-checking.
If someone questions an urgent request, praise them. Make caution part of your culture.
The Bigger Picture: This Is Just the Beginning
This W-2 scam is only the start. Between now and April, expect:
• Fake IRS notices demanding payment
• Phishing emails disguised as QuickBooks updates
• Spoofed emails from “your accountant”
• Fraudulent invoices tied to tax prep expenses
Criminals love tax season because small/medium businesses are distracted and rushed. But this doesn’t have to be your story.
Is Your Business Prepared?
If you’re a business owner in Fargo, Moorhead, West Fargo, or beyond, ask yourself:
- Do we have a policy for handling W-2s and sensitive requests?
- Are we using MFA on our HR systems?
- Would my team know this scam if they saw it?
If you’re not sure—or if you know your current IT support hasn’t covered this—now’s the time to tighten things up.
Book a Free 10-Minute Call with IMS
At Information Management Systems (IMS), we’ve helped local businesses stay secure and scam-free for over 20 years.
Schedule a free, no-pressure discovery call, and we’ll walk you through:
✔️ Your payroll/HR access & MFA
✔️ W-2 protection policies
✔️ Email protections that block spoofing
✔️ One critical security step most small/medium businesses miss
📞 Book your 10-minute discovery call here
Because tax season is stressful enough—without adding identity theft to your to-do list.
FAQ: W-2 Email Scams & Small/Medium Business Cybersecurity
- What should I do if an employee already sent W-2s to a scam email?
Act fast. Immediately notify your IT provider (or contact IMS). Report the breach to the IRS and affected employees. Offer identity theft monitoring, and file a report with the FTC. The quicker you respond, the better your chance to contain the damage.
- How can I tell if an email is spoofed or fake?
Spoofed emails often look nearly identical to legitimate ones. Look for small changes—like misspelled domains or unusual phrasing. If the email asks for sensitive data, verify it by phone or in person before responding. When in doubt, don't click or reply.
- Is multi-factor authentication (MFA) really necessary for a small/medium business?
Absolutely. MFA is one of the simplest, most effective tools for preventing unauthorized access. Even if login credentials are stolen, MFA acts as a final roadblock. It’s especially critical for payroll, HR, and accounting systems.
- What are some signs we might be vulnerable to tax-season scams?
If your team shares documents via email, lacks clear data-handling policies, or doesn’t receive regular cybersecurity training—you’re at risk. Scammers look for weak links, and small businesses are common targets because they're often less protected.
- How can IMS help protect my business during tax season and beyond?
We help local businesses implement practical, affordable safeguards—like email filtering, MFA, and employee training. We’ll review your current setup, recommend policy improvements, and monitor for threats before they become problems. One call covers it all.
