Skip to main content

Tax season · Finance and HR

W-2 request?Verify first.

Scammers pose as district leaders to ask for W-2s, staff data or bank changes. An executive title never skips verification.

  • 2-minute lesson
  • Free · no sign-in
Español

  1. 1Why it matters

    Verify through a separate path

    Open the service from a saved bookmark or type its known address instead of using the message's link. For an unusual request from a colleague, use the directory phone number or an established conversation. Do not call a number supplied only in the suspicious message. If you cannot verify an urgent request, contact the district's designated support team. Hover previews and spelling clues help, but a convincing appearance is not proof of safety.

    Keep the approval path intact

    For payment, account access, sensitive records or policy exceptions, use the district's documented approval and verification controls. An executive title does not remove those steps. Verify changes to bank or vendor details using existing records and a separate contact path. Never approve an authentication prompt you did not initiate, even if someone claims to be support.

  2. 2Do this

    • W-2s by email

      A message “from a leader” asks for all employees' W-2s or a staff list? Treat it as a red flag.

    • Direct-deposit changes

      Change bank details only through the approved payroll process, never from an email link.

    • The IRS writes first

      The IRS normally makes first contact by mail. It texts or emails only if you opted in.

    • NO / NOT SUREStop and verify

      Don't send W-2s, employee data or bank changes. Call the requester at a directory number, not one in the message.

    • CONFIRMEDFollow the approved process

      Use the documented payroll steps and a second review before anything is sent or changed.

    Red flags
    • “Send all W-2s”
    • New direct-deposit info
    • “Pay the IRS now”
    • Leader in a rush

    Already sent data? Tell the district right away. Leaders can then follow the IRS W-2 data-loss steps, including dataloss@irs.gov.

  3. 3Quick check

    How should you verify an unusual payroll request?
    A familiar voice asks you to bypass payment verification. What should you do?

    Choose an answer for each question.

Want credit for this?

Sign in to Cyber Academy to take the full course, record your progress and earn a completion certificate.

Full course: Verify the request, not the voice: AI and impersonation · 10 min

Sign in for credit
Sources

We count visits to this page in aggregate only. No cookies, no accounts, no personal data.