The IRS has warned taxpayers for some time about scams and fraud that can appear to come from the agency. Callers who demand immediate payment or identity thieves who file fake tax returns in other people’s names are just two of the more rampant forms of tax scams.

But tax scams can target businesses just as readily as they affect consumers. One common scam that has affected countless companies and organizations is the boss phishing scam that seeks W-2 forms and payroll records. In those attacks, a scammer often posing as a CEO sends an email to someone within the company requesting copies of the tax forms for every employee. The recipient of the email willingly complies, believing that the email was a direct order from their superiors.

This year, the IRS issued an alert about a new twist on the W-2 scam. The basic premise is simple: if the recipient of the phishing email sends back the W-2 forms as requested, then the scammer knows the victim is unaware that this request is fraudulent. After taking the W-2 forms and saving them in order to commit tax return fraud, the scammer sends another email, ordering the employee to transfer company funds into the bank account they include in the email.

It’s a new twist on simply stealing the identities and running away with them. If the employee believes the emails are genuine, why not keep stealing more and more information or funds?

In order to fight back against this kind of scam, companies should train all employees on how to spot a scam immediately. No one is safe from this kind of attack, as companies of every size and industry, medical facilities, and even schools have already been targeted. By ensuring that every single employee within the company knows how to avoid a phishing scam, businesses can help secure their employees’ personal information and their bottom line.

How much information are you putting out there? It’s probably too much. We are here to help you stop sharing Too Much Information. Sign up for the TMI Weekly.