February means tax season preparations are underway.
W 2s are being processed. Finance teams are busy. Administrators are stretched thin.
It also means scammers are getting to work.
One of the first and most dangerous tax season scams hits schools every year, and it usually looks harmless.
The W 2 Scam. How It Works.
Someone in your school, often the business manager or payroll contact, receives an email that appears to come from the principal or head of school.
It’s short and urgent.
Can you send me copies of all staff W 2s for a meeting with our accountant? I need them ASAP.
The timing feels normal.
The request sounds reasonable.
The sender looks legitimate.
So the files get sent.
Except the email wasn’t real.
Now a criminal has access to every staff member’s information.
Full name
Social Security number
Home address
Salary information
Everything needed for identity theft.
How Schools Find Out
Weeks later, staff members try to file their taxes and get rejected.
Someone already filed using their identity.
Now the school is dealing with employee trust issues, IRS involvement, potential legal exposure, and reputational damage.
This isn’t just a cybersecurity issue. It’s a governance issue.
Why This Scam Works So Well
It works because the timing makes sense.
The request feels routine.
Staff want to be helpful.
Urgency overrides verification.
Schools are especially vulnerable because authority-based requests are common and often unquestioned.
How to Protect Your School
This scam is preventable with clear rules.
No W 2s via email, ever.
Verify sensitive requests in a second channel.
Train staff now, not later.
Use multi factor authentication on payroll and HR systems.
Reward verification instead of punishing it.
Strong schools build verification into their culture.
The Bigger Picture
The W 2 scam is just the beginning.
Between now and April, expect fake IRS notices, phishing disguised as accounting software, spoofed emails from accountants, and fraudulent invoices.
Prepared schools don’t rely on luck. They rely on policy and awareness.
