Authorities Warn Of Tough-To-Spot Tax Scam Targeting Your W-2

NEW YORK (CBSNewYork) -- Authorities warned Tuesday of a new tax scam that may be the slickest one yet. It isn't a call demanding money, and nobody is impersonating the IRS.

Officials say thieves are impersonating someone from your workplace and going after the sensitive information on your W-2.

The scammers send an email pretending to be someone you work with. If you work in human resources or payroll, you're the biggest target because you handle so many W-2s.

Caitlin Driscoll of the Better Business Bureau warns the scam is tough to spot.

"Spoofing techniques are being used to impersonate an executive or a payroll provider," Driscoll said.

You can easily be fooled into thinking it's from someone at work. Once the thieves get a hold of your information, they can then file a false tax return to steal your refund.

"Really, tax ID theft is the primary goal, to obtain the social security number and information contained in the W-2," Driscoll said.

The ID bandits could even take it a step further by selling your personal information on the dark web.

"They can sell that information for quite a profit, depending on the information they were able to obtain," Driscoll said.

CBS2 showed an example of a spoofing email you might receive that had almost everyone fooled. Since there are no tell-tale signs for the scam, you have to closely examine it.

"Even if it's an email from a contact you recognize, look closely at the email address that it's coming from," Driscoll recommends. "Sometimes, these emails are spoofed where it's just a slight variation in the email address."

Also, compare the reply address with the sender's address.

"When you click reply to, see if who it's replying to is actually where it's coming from," Driscoll said.

If someone appears to be copied on it, don't let that fool you either.

"There are ways scammers can actually modify and spoof the entire email address to appear that it's coming from that legitimate representative," Driscoll said.

Finally, it's important to verify the email independently. Call the sender and look up their number on your own. Don't trust any numbers included on the email.