Keep W-9s Safe: Stop Scams and Protect Tax Data

October is Cybersecurity Awareness Month. Use it as a reminder to keep W-9s safe before year-end tax reporting. Start by reviewing how your team collects, stores, and shares each form.

A W-9 holds a taxpayer’s name, address, and taxpayer identification number (TIN). That number is often a Social Security number (SSN) or Employer Identification Number (EIN). To protect it, use a clear process, verify requests, and limit access.

Why W-9s are a target

Stolen W-9 information can help criminals impersonate a vendor, attempt identity theft, or commit tax-related fraud. An SSN deserves particular care, but an EIN and business details should also be handled responsibly.

A W-9 is not proof that a vendor is legitimate. Treat it as one part of onboarding, alongside verifying the business relationship and independently approving payment instructions.

W-9 requests can arrive throughout the year. As your team prepares for year-end reporting, unexpected requests may blend into normal work. Keep the same verification rules in place year-round.

Where W-9 information can be exposed

• Email attachments: Do not assume ordinary email provides end-to-end protection. Copies can remain in inboxes, sent folders, downloads, and backups. A compromised mailbox or misdirected message can expose them.
• Tax IDs typed into messages: An SSN in an email or chat thread can be forwarded or copied beyond the intended recipient.
• Shared folders with broad access: Employees who do not need tax information may be able to view or download it. Review access when roles change or someone leaves.
• Paper copies: Printed forms can be misplaced, viewed by unauthorized people, or discarded without shredding. If paper is necessary, use locked storage and controlled access.
• Scanners and copiers: Some devices retain scanned documents. Include their storage and disposal settings in your security review.
• Photos sent by text: Images may remain on devices, in message histories, or in cloud backups, depending on the settings.

The goal is to reduce unnecessary copies and protect the copies you must keep. For more guidance, read our article on protecting W-9 and 1099 data.

Four W-9 scams to watch for

1. The fake W-9 request

A scammer may pose as a client, financial institution, or tax authority and ask for an updated W-9. Watch for a lookalike domain, an unexpected request, or pressure to act immediately. Also question demands for login details or information unrelated to the form.

First, check the full sender address. Then confirm an unfamiliar request through a known contact. Even a message from a familiar address deserves scrutiny if the request is unusual.

The IRS does not initiate contact by email or social media to request personal or financial information. Form W-9 goes to the requester, rather than being filed with the IRS. Requesters can include businesses and financial institutions, not just clients who pay you. See the IRS identity protection tips and Form W-9 instructions.

2. The “change my bank details” trick

A criminal may impersonate a vendor or take over its email account, then ask you to redirect payments. An attached W-9 can make the request seem credible, but it does not authorize a bank-account change.

A W-9 is a tax-information form, not a payment-instructions form. Keep changes to payment details separate from updates to tax records. Before changing payment details, call a trusted contact. Use a number already on file or one you verify independently. Do not rely on the number in the change request. The FBI’s business email compromise guidance recommends independently verifying changes to account numbers and payment procedures.

3. The fake vendor

A fraudulent vendor can submit stolen tax information and invoices. Review the vendor’s business relationship, contact information, and the work performed before approving payments.

For eligible payers, IRS TIN Matching can check a name/TIN combination against IRS records. However, a match does not prove the sender owns that identity. It also does not prove an invoice is legitimate. See the IRS instructions for requesters of Form W-9.

4. The phishing link

A message asking you to complete a W-9 may lead to a fake collection page or login screen. Inspect the destination domain and confirm unexpected links with the requester.

A padlock or HTTPS connection means the connection is encrypted; it does not prove that the website or sender is trustworthy. Tell vendors what your real requests look like and how to verify them.

How to keep W-9s safe during collection and storage

1. Use a verified collection portal. Send vendors a link to the service you actually use. Keep tax IDs out of ordinary email and text-message replies.
2. Protect stored forms. Use a system with appropriate encryption and access controls. Protect exported spreadsheets, downloaded PDFs, and any copies in accounting software too.
3. Limit access. Give W-9 access only to staff or advisers who need it. Review permissions regularly and remove access promptly when it is no longer required.
4. Secure the accounts around the process. Use unique passwords, a password manager, and multifactor authentication wherever available, especially for email and accounting accounts. Keep software updated. These steps align with CISA’s small-business cybersecurity guidance.
5. Explain the process to vendors. Tell them who will send the request, which service you use, and how to check a suspicious message. Make clear that you will not ask them to reply with an SSN in plain text.
6. Verify sensitive changes. Independently confirm unexpected changes to vendor identity or tax information. Apply a separate verification and approval process to payment changes.

How getW9 supports a safer W-9 workflow

getW9 helps reduce the need to pass completed W-9s around as email attachments. Its published features include:

• Online collection: Send a request by email or text with a secure link. The completed W-9 PDF and its details are saved in your account.
• Encryption: getW9 states that your information and data are encrypted using AES-256 encryption.
• Secure sharing: Share your own W-9 through a secure link.
• Additional users: Invite up to two other users, such as a bookkeeper or accountant, and revoke access when needed.
• Less printing and scanning: Online storage reduces the need for paper handling.
• USPS address validation on the Giga plan: Address standardization helps catch mailing errors and reduce returned mail. It does not verify a vendor’s identity or ownership of a tax ID.

Protect your account and any downloaded or shared copies as part of the same workflow.

For freelancers and contractors: protect your own W-9

• Verify the requester. Confirm the business relationship or other legitimate reason for the request before sharing tax information.
• Use the correct taxpayer name and TIN. A sole proprietor who has an EIN may generally enter either their SSN or EIN. For a single-member LLC treated as a disregarded entity, use the owner’s SSN or EIN, if the owner has one. Do not assume the LLC’s own EIN is the correct number. Follow the IRS Form W-9 instructions for your tax classification.
• Share through a verified secure process. Avoid sending an SSN in a plain-text message.
• Investigate an unfamiliar Form 1099. Contact the issuer using independently verified details and ask about a correction. A surprise form can result from an error or identity theft; do not assume either without checking.

Clean up old W-9 copies this month

1. Search approved business mailboxes and storage locations for “W-9,” “W9,” and “tax ID.” Avoid creating another uncontrolled collection of sensitive files.
2. Move needed forms into your approved storage system and verify that they remain complete, readable, and accessible to authorized users.
3. Before deleting anything, confirm your retention policy. The IRS advises keeping an independent contractor’s W-9 for four years. Ask your tax professional how that guidance applies to your records and whether other requirements call for longer retention.
4. Remove unnecessary duplicates once retention requirements are met. Check downloaded files, sent mail, deleted-item folders, and shared drives. However, deleting an email may leave archived or backup copies. Ask your IT provider how to handle those copies.
5. Shred paper forms that are no longer needed, subject to your retention policy and any legal hold.

Your Cybersecurity Awareness Month W-9 checklist

• Use verified secure links for routine W-9 collection and sharing.
• Keep forms in approved storage and protect exports and downloads.
• Review access and remove permissions that are no longer needed.
• Enable multifactor authentication wherever available.
• Require independent verification of payment-detail changes.
• Explain your real W-9 request process to vendors.
• Remove unnecessary copies under an agreed retention policy.
• Train staff to recognize and report phishing attempts.

Common questions

Is it illegal to email a W-9?

The method alone does not determine compliance. Privacy laws, security rules, contracts, and industry requirements may apply. Because ordinary email attachments can expose tax data, use an approved secure method. Ask your adviser which requirements apply to your business.

What should I do if W-9 information is exposed?

Act promptly. Contain the incident, secure affected accounts, and preserve evidence. Next, involve your IT or security provider and legal adviser. They can help assess the incident and identify any notice requirements or deadlines. Follow the FTC’s data breach response guidance.

If you sent a fraudulent payment, contact your financial institution immediately and report the incident to the FBI’s Internet Crime Complaint Center.

Affected individuals can use IdentityTheft.gov for recovery guidance. An IRS Identity Protection PIN can help protect against fraudulent federal tax returns; it does not protect every use of an exposed SSN.

How does a getW9 request work?

The recipient receives a secure link to complete the W-9 online. After the recipient submits the form, getW9 saves the PDF and details in the requesting business’s account.

Keep W-9s safe this October and beyond

Use Cybersecurity Awareness Month to improve how your team handles tax information. A consistent collection process, limited access, and independent verification can reduce unnecessary exposure and help staff spot suspicious requests.

Ready to simplify collection and storage? Explore getW9 and start a 7-day free trial.

This guide provides general information, not individualized tax or legal advice. Review the current IRS instructions and consult your advisers for your situation. Reviewed October 5, 2026.