It’s 5:00 on a Friday evening in a human resources division. An employee receives an email from his supervisor demanding that W2 “Wage and Tax Statements” forms for all executives and managers be sent to her immediately. The email’s urgent tone is not typical of the supervisor. But mindful of upcoming performance reviews and thinking about weekend plans, the employee dutifully sends the W2s anyway.
Not long after, the company’s CEO and general counsel attempt to file their personal taxes, only to learn from the Internal Revenue Service (IRS) that tax returns have already been filed in their name. An urgent investigation reveals that the email from the “supervisor” was actually a phishing email with a spoofed email address from an untraceable IP address. Worse, unknown assailants are now filing fraudulent tax returns on behalf of senior executives, and collecting inflated refunds in their names.
