Tax Season Awareness: W-2 Forms, Phishing, and Tax Fraud 

The “tax season” commonly refers to the period between January and April. This is because tax forms need to be filed by April for the year before. Students, faculty, and staff receive important tax documents like W-2 forms, which contain sensitive information. For cybercriminals, this is the perfect opportunity for them to send out phishing and identity-theft scams. Cybercriminals will try to trick you into sending them personal information, usually claiming to be a government agency like the IRS.  

The best way to avoid falling into these traps is to understand how they fully work. By doing so, you can better protect your personal identity and Marist. 

Why W-2 Information Is Valuable to Attackers 

W-2 forms contain highly sensitive information, such as your income, Social Security number, and employer information. There are many actions cybercriminals can take with this information. They can file fraudulent tax returns, commit identity theft, or steal refunds. 

There are more tax scams during filing season because people are sharing their financial and personal data with others.  

How Tax and W-2 Phishing Scams Work 

These tax scams are often similar to one another, and usually follow the same format: 

• Attacker emails you claiming to be from an official source 

• They ask you to verify your information or send tax documents 

• You are sent a link that leads to installing malware or a fake login page 

Cybercriminals will try to appear as a familiar company or service to make them seem more trustworthy. In emails or calls, they create a sense of urgency so that you act quickly to give away your personal information.  

Universities are big targets of these scams because criminals are aware that student workers and staff send these types of sensitive information often. 

Warning Signs of a Tax Scam 

• Any unexpected emails about tax refunds or tax issues 

• Suspicious or unknown sender addresses or links 

• Messages asking for your Social Security number or payroll documents 

• Emailer uses urgent or threatening language and advises you to take immediate action 

Any messages that ask for sensitive information through an email should be treated as suspicious and dealt with carefully. Government agencies like the IRS mention that they do not contact you first by email or text to request personal or financial information. They usually contact you by mail. 

What To Do If You Receive a Suspicious Tax Email 

1. Do not reply, click links, or open any attachments 

2. Verify these requests directly, either by going to their office in person or using official contact methods 

3. Report the phishing or suspicious email to phishing@marist.edu  

You should always be cautious when checking your emails, especially if they request sensitive information. Always take your time to go through emails and confirm their legitimacy. You can always ask Marist to confirm whether an email is legitimate or not. 

Sources: 

https://www.hio.harvard.edu/prepare-tax-season 

https://cybersecurity.yale.edu/monthly-tip/march-2025 

https://www.irs.gov/newsroom/common-tax-scams-and-tips-to-help-taxpayers-avoid-them 

https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages 

https://www.irs.gov/help/tax-scams