Be on the Watch for W-2 Phishing Scams!

With tax season just around the corner, this simple, yet effective social engineering theme is perfect to get users to respond to phishing attacks exactly the way the bad guys want.
Every successful phishing attack starts with the premise of creating an email that will be sufficient to get the emotional buy-in from the reader enough to get them to interact. This has been shown to be something either positive or negative – doesn’t make much difference, as long as it gets the recipient to click the link, open the attachment, reply, etc.

W-2s have already begun to be delivered to employees – some the old-fashioned way via mail, and most via email as an invitation to download the PDF version. Scammers know this and can easily impersonate your organization’s HR department asking the employee to review and/or download their W-2, offering up either a malicious attachment or link that will be used to infect the recipient’s endpoint, attempt to capture their logon credentials to Office 365, etc.

Never Miss a Tip!
Security Tip of the Week Delivered to Your Inbox