Friday, January 12, 2018

It's W2 scam season


Time for a short Friday afternoon social engineering‍ discussion. If you work in HR / finance / benefits, you'll want to stick with me.

It's January, the beginning of tax season in the US (and I presume, other countries as well). Employers in the US are required to provide W2 statements documenting pay and tax to their employees by the end of his month.

Scammers know this, and love to exploit this annual ritual. The common schemes I see are an email or phone call pretending to be from either a company executive (often the CEO or CFO), or from the taxing authority, with an urgent request for employee records.

Urgent because, a sense of urgency can short-circuit skepticism and get an employee to respond before thinking.

Oddly, even though employers must provide this data by January 31, W2 scams have tended to peak around March for the last few years. Perhaps there's a psychological element since individual tax returns are due by April 15 so it remains top of mind for the HR/finance/benefits/payroll employee.

If you work in HR / finance / payroll / benefits, or otherwise have access to employee personal data, stay vigilant over the next 90 days or so. Be suspicious of any request for employee records, especially if it comes in an unusual manner.

Take the time to verify the request through a trusted channel. Depending on your organization size, that might mean in person, over the phone, or via an established business process.

DON'T ship a CSV or XLS of employee data simply because someone - even the CEO - sends an email requesting such.

If you own or manage a business, or manage those that have access to employee records, be sure they know how employee records are handled, and know the appropriate process for requesting and approving transfer of that data.

If there is no established process for handling employee records - make one, and stick to it.

Do you have something to add? A question you'd like answered? Think I'm out of my mind? Join the conversation below, reach out by email at david (at) securityforrealpeople.com, or hit me up on Twitter at @dnlongen

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.

Whois David?

My photo

I have spent the better part of two decades in information technology and security, with roots in application developer support, system administration, and network security. My specialty is cyber threat intelligence - software vulnerabilities and patching, malware, social networking risks, etc. In particular, I strive to write about complex cyber topics in a way that can be understood by those outside the infosec industry.

Why do I do this? A common comment I get from friends and family is that complex security topics give them headaches. They want to know in simple terms how to stay safe in a connected world. Folks like me and my peers have chosen to make a profession out of hacking and defending. I've been doing this for the better part of two decades, and so have a high degree of knowledge in the field. Others have chosen different paths - paths where I would be lost. This is my effort to share my knowledge with those that are experts in something else.

When not in front of a digital screen, I spend my time raising five rambunctious teens and pre-teens - including two sets of twins. Our family enjoys archery, raising show and meat rabbits, and simply enjoying life in the Texas hill country.

For a decade I served as either Commander or a division leader for the Awana Club in Dripping Springs, Texas; while I have retired from that role I continue to have a passion for children's ministry. At the moment I teach 1st through 3rd grade Sunday School. Follow FBC Dripping Springs Kids to see what is going on in our children's ministries.