The IRS opened Cybersecurity Awareness Month on October 2, 2026 with a warning for employers about phishing, fake invoices, W-2 and payroll-related schemes. If you run payroll or pay vendors, the scam to plan for is a short email asking you to change where the money goes.
The month is the occasion, not the deadline. These schemes run all year, and the fix the IRS points to costs nothing: check every request to change bank details through a channel you already trust. In practice that means one phone call to a number you already have on file.
No change to an employee's direct deposit or a vendor's bank account without a phone call to a number already on file. Never use the number in the email or on the new invoice. Put the rule in writing this week, add multifactor login to payroll and banking, and know who to call if money goes out.
What the IRS told employers about W-2 and payroll scams
In release IR-2026-119, the IRS named three groups: businesses, payroll professionals and human resources offices. They "should remain alert for phishing, fake invoices, W-2 and payroll-related schemes designed to steal employee information, credentials or money."
The next sentence is the one to act on: "Requests to change sensitive employee or payment information should be verified through a trusted channel."
The same release lists basic steps for every business. Use strong, unique passwords and consider a password manager. Turn on multifactor authentication. Keep software updated, encrypt sensitive files and back up records. Avoid public Wi-Fi for financial accounts.
"Criminals continue to look for new ways to steal taxpayer information and exploit trusted partnerships," IRS Chief Executive Officer Frank J. Bisignano said in the release.
How payroll and vendor bank-change scams work
The FBI files these under business email compromise, or BEC. Its Internet Crime Complaint Center (IC3) defines BEC as a scam aimed at businesses and people who regularly send payments. Criminals carry it out by compromising email and other channels, such as phone numbers.
Three versions hit small businesses most directly.
The direct deposit change. Someone emails payroll, posing as an employee, and asks to move their pay to a new account before the next payday. In a 2019 alert, the FBI described payroll staff getting exactly these emails, with the new account information "generally" leading to a prepaid card account. The real employee finds out when the paycheck never arrives.
The vendor bank change or fake invoice. An email that looks like it came from a supplier says its bank account has changed. Or a new invoice arrives with new payment instructions. The FTC warned small businesses in May 2026 about fake invoices for products or services nobody ordered, some sent as phishing emails.
The W-2 request. The IRS describes an email made to look like it came from a company executive. It goes to someone in payroll or human resources and asks for a list of all employees and their Forms W-2. Criminals may use stolen W-2 data to file fraudulent tax returns, the IRS says.
None of these needs to break into your systems. Each one works only if someone in the office says yes.
Those figures cover only what victims reported to IC3. The same report puts Florida third in the country in 2025, with 71,843 complaints and about $1.6 billion in reported losses across all the crime types IC3 tracks.
The one-call rule for direct deposit and vendor bank changes
The FBI's prevention advice starts in the same place as the IRS release. Its 2024 alert on business email compromise says to "use secondary channels and/or two-factor authentication to verify requests for changes in account information."
For a small business, the simplest secondary channel is the phone. Here is the rule written out so it can go in your procedures today.
Write the rule in one sentence
No change to an employee's direct deposit or a vendor's payment details is made without a phone call to a number already on file.
Define what on file means
The number in the employee's personnel record or the vendor's original setup paperwork. Never the number in the request, the email signature or the new invoice.
Call before you change anything
Ask the employee or vendor to confirm the request and the new account. If you cannot reach them, the change waits.
Record the call
Note the date, the person you spoke with and the number you dialed in the payroll or vendor file.
Have a second person approve
Where you have the staff, the person who calls should not be the one who enters the new bank details.
Tell staff and vendors the rule exists
When people know you always call, an urgent request to skip the call stands out as a warning sign.
Urgency is the tell. Slow down on any request that must be done today, comes from a new email address, or asks you to keep it quiet.
| Scam | What arrives | What the rule says to do |
|---|---|---|
| Direct deposit change | Email from an employee asking to move pay to a new account | Call the employee at the number in their personnel file |
| Vendor bank change | Email or letter saying a supplier's bank account changed | Call the vendor at the number from your original setup |
| Fake invoice | An invoice for something nobody ordered, often marked past due | Pay only invoices that match a vendor and an order you approved |
| W-2 request | Email from an executive asking for all employee W-2s | Confirm in person or by phone before sending any employee data |
Other written controls a small business can adopt this week
The call stops the bank change. These controls close the other doors the IRS, the FBI and the FTC point to.
- Multifactor authentication on every payroll, bank and accounting login, as the IRS recommends
- A unique password for each of those accounts, kept in a password manager
- No employee W-2s or Social Security numbers sent by email in answer to a request
- Clear procedures for approving purchases and invoices from vendors you actually work with, in the FTC's words
- Check the full sender address before acting on any payment email, which the FBI says is especially important on a phone
- Ask employees to tell payroll right away if a deposit is missing
- Review new vendors and changed bank details when you reconcile the books each month
For the wider picture, including insider fraud and segregation of duties, see our guide to fraud prevention for small business.
If your business sends ACH payments, the bank rules changed in 2026
Nacha writes the operating rules for ACH, the bank network behind direct deposit and business-to-business ACH payments. Its fraud monitoring rule now covers businesses of every size that send ACH payments.
Since March 20, 2026, the rule has applied to the largest senders, those with 6 million or more ACH payments in 2023. Phase 2 took effect June 19, 2026 for every other business that originates ACH payments. Because June 19 is a federal holiday, Nacha says the practical date was Monday, June 22.
The rule requires those businesses to "establish and implement risk-based processes and procedures reasonably intended to identify ACH Entries initiated due to fraud." It applies to the extent relevant to the role each business plays, and the procedures must be reviewed at least annually.
The rule is risk-based and does not list specific steps. Whether a written one-call rule is enough for your setup depends on your bank agreement and how you send payments. Ask your bank how the rule applies to you.
What to do if money already went out
Speed matters. In 2025, the FBI's Recovery Asset Team helped freeze about $679 million of roughly $1.16 billion in attempted theft, a 58% success rate. The FBI says complaints filed as quickly as possible help that process.
Call your bank right away
The FBI says to contact your financial institution immediately and request a recall of the funds, along with any indemnification documents it needs.
File a complaint at ic3.gov
File regardless of the amount and include the full transaction details. The FBI says IC3 may be able to help banks and law enforcement freeze funds.
Report a W-2 data loss to the IRS
Email dataloss@irs.gov with the subject W2 Data Loss and your business name, EIN, contact name, phone, a summary and how many employees were affected. Attach no employee data.
Alert the states
The IRS tells businesses to email the Federation of Tax Administrators at statealert@taxadmin.org for how to report to state tax agencies.
Report a scam you caught in time
Got the W-2 email but did not fall for it? Save it as a file and attach it to an email to phishing@irs.gov, subject W2 Scam. Report fake invoices at ReportFraud.ftc.gov.
Who absorbs a loss depends on your bank agreement and the facts. Confirm with your bank and your attorney before you assume either way.
Where SMAART fits
SMAART Company runs payroll for Florida businesses, including setting up employee direct deposits, and handles monthly bookkeeping and reconciliation. If you want a second set of eyes on how bank changes and vendor payments move through your office, we can talk it through.
Frequently asked questions
Someone posing as an employee asks payroll to move that employee's pay to a new account. The FBI files it under business email compromise. The real employee learns about it when the paycheck does not arrive.
If the email account was taken over or faked, a reply goes to the scammer. A number in the request or on a new invoice can belong to the scammer too. Only a number you had before the request reaches the real person.
Phase 2, effective June 19, 2026, covers businesses that originate ACH payments and were below the Phase 1 threshold of 6 million ACH payments in 2023. How it applies depends on your role and your bank agreement, so ask your bank.
Call your bank immediately and ask for a recall of the funds, then file a complaint at ic3.gov with the transaction details. If employee W-2 data was sent, email dataloss@irs.gov with the subject W2 Data Loss.
This article reports what the IRS, FBI, FTC and Nacha have published. It is not legal or tax advice. Confirm with your CPA, your bank or your attorney before acting on your own facts.
Sources
- IRS, IR-2026-119, "IRS reminder: Cybersecurity Awareness Month offers simple steps to protect tax data," October 2, 2026. https://www.irs.gov/newsroom/irs-reminder-cybersecurity-awareness-month-offers-simple-steps-to-protect-tax-data
- IRS, "Form W-2/SSN Data theft: Information for businesses and payroll service providers," last reviewed May 12, 2026. https://www.irs.gov/individuals/form-w2-ssn-data-theft-information-for-businesses-and-payroll-service-providers
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- FBI Internet Crime Complaint Center, "Business Email Compromise: The $55 Billion Scam," I-091124-PSA, September 11, 2024. https://www.ic3.gov/PSA/2024/PSA240911
- FBI Internet Crime Complaint Center, "Business Email Compromise: The $26 Billion Scam," I-091019-PSA, September 10, 2019. https://www.ic3.gov/PSA/2019/PSA190910
- Federal Trade Commission, "Run a small business? Pay your bills, not scammers," consumer alert, May 14, 2026. https://www.consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers
- Nacha, "Risk Management Topics (Fraud Monitoring Phase 2)," effective June 19, 2026. https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-2
- Nacha, "Risk Management Topics (Fraud Monitoring Phase 1)," effective March 20, 2026. https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-1
Discussion
Comments
Leave a comment