Cybersecurity
Tax season is business email compromise season
Attackers read the calendar. April is when money moves, deadlines close in, and nobody wants to be the person who held things up by asking an awkward question.
That last part is the actual attack surface. Not your firewall. Your reluctance to be annoying.
The W-2 request
An email that appears to come from an owner or executive asks payroll or HR to send over employee W-2s. It’s brief. It’s slightly impatient. It arrives at 4:40pm.
Those forms contain names, addresses and Social Security numbers — everything needed to file fraudulent returns in your employees’ names. The damage lands on your staff, and they find out months later, when their real return bounces.
The change of bank details
Your accountant, your bookkeeper, a vendor — someone writes to say their banking information has changed. The email thread looks right. Sometimes it is the right thread, because the attacker is already inside their inbox and simply replying to a real conversation.
The only defense that works: payment details are never confirmed by the channel that requested the change. Pick up the phone and use the number you already had. Not the one in the signature.
The fake IRS notice
Urgent. Threatening. A link to “resolve” it. Worth knowing plainly: the IRS does not initiate contact by email, text or social media to demand payment or personal information. If it arrives that way, it isn’t them.
Why April, specifically
Because urgency is the weapon, and in April you supply it yourself. Every one of these attacks is a bet that you’re too busy to verify — and in tax season, that bet is very well-priced.
Two rules. Say them out loud before April.
- We verify any change to payment details by phone, using a number we already had, every time, no exceptions.
- We never send tax documents or personal data because an email asked us to — no matter who it appears to be from.
A rule with an exception isn’t a rule. And “but it was from the boss” is precisely the exception these attacks are built to manufacture.
Want to know where you actually stand? We do free, no-pressure security checks for small businesses across the East Bay — backups, accounts, defenses. We tell you plainly what to fix first.
The IRS publishes guidance confirming it does not initiate contact by email, text or social media to request personal or financial information — see IRS Tax Scams / Consumer Alerts.