Every spring, most of us get the same warnings about fake IRS phone calls and texts promising a refund. Those scams are still out there. But if you run HR, finance or IT for a public agency, the bigger risk this tax season is quieter and much more convincing.
This month the IRS released its 2026 Dirty Dozen, its annual list of the tax scams it sees most. Phishing and impersonation made the list again. Writing about it on March 18, CPA Practice Advisor and Thomson Reuters pointed to where the damage is really happening: attacks on employer payroll and W-2 processes that look exactly like routine business.
How the payroll scam works
The playbook is simple, and it works because it borrows trust that already exists.
An employee gets an email that appears to come from HR or payroll. It might ask them to download their W-2, confirm their tax information or reset a password for the payroll portal. The link leads to a login page that looks right. The employee signs in, and the attacker now has their credentials.
From there, the attacker can pull tax documents, collect personal information for identity theft or a fraudulent return, or quietly change the employee's direct deposit to a different account. Many victims don't notice until payday comes and goes without a paycheck.
A second version skips the employee and goes straight to payroll. A message that appears to come from a principal, a department director or the employee themselves asks payroll to update banking details "before the next run." If it gets processed, the next deposit goes to the criminal.
"We're far more likely to trust a request originating from our company's payroll or HR team," Barshishat of fraud-prevention firm BioCatch told the publication. That's the whole trick.
Why public employers are a good target
Schools and local governments have a few traits that make this easier for attackers.
They have a lot of employees. A mid-sized school district can have thousands of staff, many of whom rarely talk directly with payroll. A single convincing email sent to all of them only needs a few clicks to pay off.
Org charts are public. Staff directories, board minutes and department pages make it easy to learn who reports to whom and what the payroll manager's name is. As the article notes, attackers use accurate job titles and reporting lines to make messages more believable.
AI has raised the bar. Generated emails no longer have the typos people were trained to spot, and cloned audio can imitate a supervisor on a voicemail. The same attack can arrive by email, phone and Teams message in a single afternoon.
This isn't hypothetical. Just last month, Dickinson Public Schools in North Dakota disclosed that criminals impersonating a trusted vendor redirected $4.92 million in building fund payments. Different target, same method: a believable request to change where money goes.
Practical steps for HR, payroll and IT
None of these steps require new software. Most are process changes that can be in place before the next pay cycle.
Never change banking details from an email alone. Any request to change direct deposit, whether it comes from an employee or a supervisor, should be confirmed by phone using a number already on file, or completed by the employee inside the official payroll portal. Put this in writing and back the staff who follow it.
Send a confirmation when deposit details change. Many payroll systems can automatically email or text the employee whenever their bank information is updated. If they didn't make the change, they'll know right away.
Tell staff how you will contact them. Let employees know that W-2s are only available in the official portal and that HR will never send a link asking them to log in to "verify" tax information. When people know what normal looks like, the fake stands out.
Turn on MFA for the payroll and HR portals. A stolen password is far less useful if the attacker also needs a second factor. If your payroll platform supports app-based or hardware-key MFA, require it for every employee, not only administrators.
Watch for the three warning signs. O'Neill of 5OH Consulting summed it up well in the same piece: "Employees should be trained to watch for three main warning signs: urgency, unusual requests, and process changes." That's a short enough list to put on a sticky note.
Lock down your email domain. DMARC, SPF and DKIM make it harder for criminals to send messages that appear to come from your own domain. If you haven't set DMARC to enforce, now is a good time.
Make reporting easy. The faster someone reports a suspicious email, the faster IT can pull it from every other inbox. A "Report phishing" button and a quick thank-you go a long way.
A short window, a big payoff
Tax season ends on April 15 for most people, but payroll diversion doesn't follow a calendar. Attackers just know that March and April are when employees expect emails about W-2s and tax forms, so their lures blend in.
vTECH io helps Florida school districts, municipalities and counties lock down Microsoft 365, set up MFA and email authentication, and run security awareness training that reflects how attacks actually look today. If you'd like a quick review of how your payroll change process holds up, call us at 888-277-5918.
Sources
- IRS flags phishing, impersonation in 2026 Dirty Dozen; experts explain why payroll is a prime target, CPA Practice Advisor / Thomson Reuters, March 18, 2026
- North Dakota School District Loses $4.9M to Email Scam, GovTech / The Bismarck Tribune, February 13, 2026