Tax-filing season is turning into a nightmare for thousands of employees whose companies have been duped by email fraudsters.
A major phishing scheme has tricked several major companies - among them, the messaging service Snapchat and disk-drive maker Seagate Technology - into relinquishing tax documents that exposed their workers' incomes, addresses and Social Security numbers.
The scam, which involved fake emails purportedly sent by top company officials, convinced the companies involved to send out W-2 tax forms that are ideal for identity theft.
For instance, W-2 data can easily be used to file bogus tax returns and claim fraudulent refunds.
The embarrassing breakdowns have prompted employers to apologise and offer free credit monitoring to employees. Such measures, however, will not necessarily shield unwitting victims from the headaches that typically follow identity theft.
"This mistake was caused by human error and lack of vigilance, and could have been prevented," Seagate's chief financial officer Dave Morton wrote in a March 4 email to the company's employees about the breach.
The swindlers behind the tax scam are exploiting human gullibility rather than weaknesses in computer or internet security.
They have targeted company payroll and personnel departments, in many instances with emails claiming to be requests from the company CEO asking for copies of worker W-2s.
The schemes are so widespread the IRS sent a March 1 notice alerting employers' payroll departments of the fake emails.
The agency said the scheme had so far claimed "several victims" but declined to disclose how many other employers had reported releasing W-2s to unauthorised parties.
The IRS said it's seen a 400 per cent increase in phishing and computer malware incidents this tax-filing season.
The federal alert did not come soon enough for Snapchat, which on February 28 revealed its payroll department had been duped by an email impersonating its chief executive, Evan Spiegel.
Seagate acknowledged surrendering the W-2s for its current and former employees who worked at the company last year. The Cupertino, California, company said "several thousand" people were affected, but declined to be more precise.
It's unclear how many other employers have been sucked into the tax scam though hundreds of companies appear to have been targeted.
