Quick Review: W-2 and 1099 fraud can begin with a payroll email, an unknown income form, or stolen employee data. Employers should strengthen payroll controls, while employees should review tax records and respond quickly to suspicious notices. IRS monitoring can provide an additional layer of visibility when traditional credit monitoring cannot.
W-2 and 1099 Fraud
How filing season data theft can become tax return theft.
LIMITED-TIME OFFER: GET 3 MONTHS FREE WITH CODE 3 MONTHS FREE
Publication Date: August 20, 2026
SEO Title: W-2 Identity Theft: How W-2 and 1099 Fraud Spreads
Meta Description: Learn how W-2 identity theft and 1099 fraud affect employees and employers, how payroll email scams work, and how to respond during filing season.
Focus Keyword: W-2 identity theft
URL Slug: /w-2-1099-fraud-filing-season
Filing season can be stressful even when every tax document is accurate. When a W-2 or 1099 is stolen, altered, or issued under someone else’s identity, the problem can become far more daunting. Employees may face rejected returns or unexpected notices, while employers may need to investigate compromised payroll systems and notify affected workers.
W-2 identity theft often begins before a fraudulent tax return is filed. Criminals may first target an employer’s payroll or human resources department, obtain sensitive wage information, and then use that information to impersonate employees or create false tax records.
The Problem: W-2 and 1099 Data Is Valuable to Criminals
A Form W-2 reports an employee’s wages and tax withholdings. A Form 1099 reports certain types of nonemployee income, such as payments to independent contractors, interest, dividends, or other reportable income.
Both forms contain information that can help criminals commit tax-related fraud, including:
- Names and Social Security numbers
- Employer or payer information
- Wage, payment, and withholding amounts
- Addresses and other identifying details
- Information that can make a fraudulent return appear legitimate
During filing season, payroll and accounting teams regularly download, review, transmit, and distribute these documents. Employees also expect tax-related emails and portal notifications. This combination of predictable timing and sensitive data creates an attractive environment for phishing and impersonation attacks.
Evidence: How Payroll Email Compromise Leads to Tax Fraud
The IRS warns that criminals use business email compromise, or BEC, to target payroll and human resources employees. BEC is a form of impersonation in which an attacker sends a message that appears to come from an executive, manager, payroll provider, or other trusted person.
A typical attack may involve an email that appears to come from a chief executive officer or finance leader. The message requests a complete employee list and copies of Forms W-2, often using urgency or confidentiality to discourage verification.
The IRS identifies this pattern as a serious source of W-2 and Social Security number data theft in its guidance for businesses and payroll service providers. If criminals obtain the data, they may immediately attempt to file fraudulent returns or sell the information to other criminals.
Other common approaches include:
- Phishing messages that imitate payroll providers or tax software companies
- Fake notices about an “updated W-2” or “revised 1099”
- Login pages designed to steal payroll portal credentials
- Requests to send tax documents to a personal email address
- Malware attachments disguised as tax forms or employee records
Stolen W-2 information can make a fraudulent return appear more credible because it may include real wages and withholding amounts. A criminal may use the information to file in an employee’s name and attempt to direct the refund to an account controlled by the criminal.
W-2 identity theft can also occur through employment-related identity theft. In that situation, a criminal uses another person’s name and Social Security number to obtain employment. The resulting wages may later appear on an unfamiliar W-2 or 1099.
The IRS explains that an unknown W-2 or 1099 may be a sign that someone used an individual’s information for employment purposes. Employees should review the IRS guidance on employment-related identity theft when a tax form lists income they did not earn.
The Consequences: Delayed Refunds, Incorrect Records, and Administrative Burden
The consequences of W-2 and 1099 fraud can extend well beyond a single filing season.
Employees may discover the problem when:
- An electronically filed tax return is rejected because a return was already filed under the employee’s Social Security number
- A W-2 or 1099 arrives from an employer or payer the employee does not recognize
- The IRS sends a notice about unreported wages or self-employment income
- Social Security records show earnings the employee did not receive
- An IRS account contains activity the taxpayer does not recognize
An employee who receives an unknown W-2 or 1099 should not automatically include that income on a tax return. The IRS instructs individuals to contact the Social Security Administration regarding an unknown employer and to follow the instructions in any IRS notice. The IRS Identity Theft Guide for Individuals provides additional steps.
Resolution can involve the IRS, the Social Security Administration, the employer or payer, credit reporting companies, and the Federal Trade Commission. Taxpayers may need to preserve documents, answer notices, verify their identity, and monitor their accounts while records are corrected.
The National Taxpayer Advocate’s 2026 mid-year report also highlights the seriousness of identity theft case delays. Although the 2026 filing season generally processed most returns successfully, the report states that identity theft victims may experience resolution delays that stretch close to two years.
For employers, the consequences may include incident response costs, employee communications, legal review, regulatory obligations, payroll corrections, and loss of employee trust. A single compromised mailbox can create work for HR, payroll, information security, executive leadership, and outside advisors.
Prevention: Safeguards for Employers, Payroll Teams, and HR
Employers should treat requests involving bulk W-2 or 1099 data as high-risk transactions. Standard email authentication is not enough when an attacker has compromised a legitimate account or convincingly impersonates an executive.
Recommended safeguards include:
- Require independent verification. Confirm unusual requests for employee tax data using a known phone number or a separate communication channel. Do not rely solely on the contact information in the suspicious message.
- Limit access. Restrict W-2, 1099, payroll, and employee files to personnel who need them for a specific business purpose.
- Use multifactor authentication. Protect email accounts, payroll portals, file-sharing systems, and administrative tools with multifactor authentication.
- Train employees before filing season. Explain BEC, phishing, fake payroll notices, and the dangers of sending tax forms through unapproved channels.
- Establish a reporting process. Employees should know exactly how to report suspicious emails, mistaken disclosures, or unusual payroll activity.
- Prepare an incident response plan. The plan should address internal investigation, access revocation, employee notification, IRS reporting, state tax agency reporting, and law enforcement coordination.
The IRS also provides two identity verification tools for specific reporting purposes. TIN Matching allows eligible payers to compare a payee’s taxpayer identification number and name combination against IRS records before filing certain information returns, including Forms 1099.
SSN Verification Service, operated by the Social Security Administration, allows registered employers and certain submitters to verify employee names and Social Security numbers against SSA records before preparing and filing Forms W-2.
These tools can help identify mismatches and reduce reporting errors. They do not prove that a person is legitimate, detect every stolen identity, or replace access controls, employee training, or cybersecurity monitoring. Employers should review the IRS explanation of TIN Matching and SSN Verification Service to understand eligibility and proper use.
Prevention: Steps Employees Should Take
Employees can reduce risk by treating tax documents and payroll communications as sensitive information. Practical steps include:
- Review every W-2 and 1099 for unfamiliar employers, payers, amounts, or addresses.
- Do not click unexpected links or open attachments involving tax documents.
- Confirm payroll or HR requests through an established internal channel.
- Use a unique password and multifactor authentication for email and financial accounts.
- Secure paper tax forms and avoid sending them through unencrypted email.
- Consider requesting an IRS Identity Protection PIN, which helps authenticate a taxpayer filing a federal return.
- Review IRS Online Account activity and Social Security earnings records.
- Respond promptly to legitimate IRS notices and retain copies of all correspondence.
If an employee receives an unknown W-2 or 1099, the employee should not report income that was not earned. The employee should contact the employer or payer if the document may be an administrative error, contact the Social Security Administration to review earnings records, and follow IRS instructions if a tax notice is received.
If a business confirms that W-2 information was lost, the business should follow the IRS W-2 data theft reporting instructions. The IRS advises businesses not to include employee personally identifiable information in the initial email report.
Where Tax Guardian Fits
Employer and employee safeguards remain essential, but they may not reveal suspicious IRS activity after a Social Security number has been exposed. Traditional credit monitoring also may not show a fraudulent tax return, income mismatch, or IRS account change.
Tax Guardian continuously monitors IRS activity for suspicious activity tied to a taxpayer’s records. Depending on the protection plan, the service can send alerts by text or email and provide recovery support when a potential issue is identified.
Tax Guardian does not prevent identity theft. Instead, it provides tax-specific visibility that can help taxpayers recognize suspicious activity sooner and understand what steps may be necessary. Details about the monitoring process are available on the Tax Guardian How It Works page.
A More Informed Filing Season
W-2 and 1099 fraud is not limited to forged tax forms. It can begin with a compromised payroll mailbox, an unexpected employment record, or a stolen file containing employee Social Security numbers.
Employers can streamline response by verifying sensitive requests, restricting access, using appropriate identity matching tools, and preparing a clear incident plan. Employees can strengthen their position by reviewing tax records, protecting account credentials, and acting quickly when a form or notice does not make sense.
Questions About W-2 Identity Theft
What is W-2 identity theft?
W-2 identity theft occurs when a criminal obtains or misuses W-2 information, often including a taxpayer’s name, Social Security number, wages, or withholding data. The information may be used to file a fraudulent return, commit employment-related identity theft, or facilitate other fraud.
How can stolen W-2 information be used in a fraudulent return?
A criminal may use real wage and withholding information to make a fraudulent tax return appear credible. The criminal can then attempt to file before the legitimate taxpayer and direct the refund to an account under the criminal’s control.
What should an employee do after receiving an unknown W-2 or 1099?
The employee should not include income that was not earned on the tax return. The employee should contact the employer or payer if an error is possible, contact the Social Security Administration to review earnings records, and follow any IRS notice instructions.
Do TIN Matching and SSN Verification Service prevent W-2 and 1099 fraud?
No. These services help eligible payers verify name and identification number combinations for specific reporting purposes. They can reduce mismatches and errors, but they do not replace cybersecurity controls, identity theft monitoring, or an incident response program.
Sources
- IRS: Form W-2/SSN Data Theft Information for Businesses and Payroll Service Providers
- IRS: Guide to Employment-Related Identity Theft
- IRS: Identity Theft Guide for Individuals
- IRS: Taxpayer Identification Number Matching Tools
- IRS: National Taxpayer Advocate Issues 2026 Mid-Year Report to Congress
Disclaimer: Tax Guardian Software Solutions provides access to legal services offered by the Tax Guardian Network. None of the above corporate entities, nor its officers, employees, or sales associates directly or indirectly provide legal services, representation, or advice. Any forms provided are not legal advice and should not be construed as such. Readers should consult with a qualified attorney or tax professional to confirm that any form or action meets their needs. Use of this website and its services is subject to the Tax Guardian Software Solutions Terms of Service and Data Protection Addendum.
© 2025-2026 Tax Guardian. America’s First Tax Identity Protection Suite™.
