Snapchat and Seagate Employees Fall for W-2 Phishing Scam

It’s easy to think that only small companies get duped into giving out information to hackers. However, it just isn’t true. Recently, two large companies were victims of a scam where hackers convinced employees, via phishing email to give up W-2s for company employees. Those companies may ring a bell. They were the messaging service company, Snapchat and the well-known technology company, Seagate.

Reportedly, fake email messages were sent claiming or appearing to be from executives at the companies asking that W-2s be sent, presumably by email back to them.

Those W-2s include very important tax information and a lot of sensitive data on employees such as social security numbers and wages. These are very valuable to identity thieves and those who wish to file fraudulent tax returns, hoping to have refunds sent to them by the innocent owners of the information on these W-2 forms. In these cases, both companies are offering credit-monitoring services to affected employees. If that’s you, take them up on it.

The email messages in question were sent supposedly from the CEO of Snapchat and the CFO of Seagate asking for these documents. Unfortunately, those with the access who receive the bogus email messages either didn’t know how to detect they were fake, didn’t take the time to look at them closely, or just didn’t stop to ask further questions about why people in such high positions would be asking for individual W-2 forms. That is, after all a somewhat odd request.

This further emphasizes how important it is to not only know how to detect phishing, but also how important it is to train others on how to identify this social engineering tactic.

There are typical giveaways, but the first question one should ask is why would a CEO (or anyone) ask for such information in the first place?

Next, this information should never be sent via email. While it’s easy to think that if it’s just being sent internally that it must be safe, it really isn’t ever secure to send email with sensitive information. At some point, even if it is being sent between co-workers, that message will likely touch a server that is external to the organization. Remember, people pick up email in many ways these days; web clients from home computers, smartphones and tablets, and laptops while sitting at a coffee shop. Email should never be considered a secure way to send sensitive information unless it is certainly, without a doubt encrypted. If you are unsure, ask your supervisor.

Good phishing email will use very legitimate-looking logos and artwork. If they are smudged, not professional, or just look strange, you are probably right to be suspicious.

Check for the language used in the message. If words and phrases are used that you are sure that person would not normally use, question it.

If there are typos, words are not capitalized when they should be or capitalized when they shouldn’t, commas are used where periods should be, or punctuation is missing or misused, question it.

If the answer to any of these is unclear, the best step is to pick up the phone or walk over to his or her desk and ask. If that isn’t possible or reasonable, send a completely new email message or text and confirm that the request is indeed a real one. You will find out very quickly if not and then action can be taken immediately before any real damage is done. Remember that no one should ever be too busy to thwart phishing. It is the number one way information gets breached and because it is such a successful tactic, it’s likely to stay that way for a while. Take some time to make sure it doesn’t hook you.