Security Notice: Beware of Phishing Campaigns Targeting W-2 Information

While individuals and businesses must remain vigilant for increasingly sophisticated cyber threats year-round, cybercriminals often ramp up their activities during tax season. In particular, security professionals see an uptick in malware and credential theft attempts through phishing scams targeting W-2s and other sensitive information.

What does tax fraud look like?

Attempts vary, but often those targeted receive a fraudulent email appearing as if it comes from a trusted source, telling recipients that their W-2 forms are available. The message then prompts users to click a malicious link, which redirects the victim to a website designed to look like the login page of the trusted source. That link can be used to deliver malware, steal user credentials, or both.

How to protect your data

Before you click a link in any email, download a file, or respond to a request for sensitive information, you should be 100% confident the sender and request are legitimate. The following are simple, but important tips to help protect your Paychex account and all your online accounts from cyber threats:

• When in doubt, don’t follow hyperlinks. Use a trusted, bookmarked link or app as a rule when accessing a system that stores your sensitive data.
• Hover over links to see the destination and compare that to the legitimate, trusted site.
• Confirm the source by verifying the email address is one you know and trust.
• Strengthen and regularly change passwords.
• Use the highest level of MFA (multi-factor authentication) available.
• Protect your PII and PHI (Personally Identifiable Information & Protected Health Information).
• Keep your software up to date and apply software security patches to your computer operating system and applications.
• Use anti-virus, anti-spam, and anti-spyware software, as well as a personal firewall.

Learn more about how to protect your information and please read our security FAQs for more information.