W-2 week is one of those times where normal, legitimate business activity creates perfect conditions for security mistakes.
You’ve got sensitive employee data moving quickly. You’ve got urgent “can you resend that?” requests. You’ve got more printing, more email, more portals, more logins, more pressure. And when finance is moving fast, attackers move faster.
This guide is the practical, no-drama version of what to tighten so you can get W-2s out the door without creating a mess you’ll be cleaning up for weeks.
Why this week is higher risk
From a security standpoint, W-2 week is a “high-traffic intersection”:
- More sensitive data is handled (SSNs, addresses, wage info, employer IDs)
- More one-off requests happen (“resend,” “update address,” “new email,” “lost access”)
- More urgency is introduced (deadlines, employee questions, managers pushing)
- More people get involved (finance, HR, ops, managers, sometimes IT)
- More systems are used (payroll portal, HRIS, email, printers, scanners, shared drives)
That combination increases the odds of:
- sending sensitive info to the wrong person,
- approving a bad request,
- or getting tricked by impersonation.
Top scam patterns to watch for
Attackers don’t need sophisticated exploits to win during W-2 week. They win by sounding believable.
1) Executive or HR impersonation (“Send me the W-2s / employee list”)
A spoofed email that looks like it’s from an owner, CFO, or HR leader requesting W-2s, payroll reports, or employee info “ASAP.”
Red flags:
- unusual urgency,
- new or slightly different email address/domain,
- request for bulk employee data.
Rule: No bulk W-2 or employee data is ever sent by email based on an email request alone.
2) Bank detail change requests (“Update my direct deposit”)
An attacker impersonates an employee and asks payroll to change bank details, sometimes with a “new bank” story or “lost access” claim.
Red flags:
- request comes from a personal email,
- employee is “traveling” or “can’t take calls,”
- pressure to do it immediately.
Rule: Bank detail changes require verification through a known channel (not the email thread).
3) Resend requests (“Can you resend my W-2?”)
This one is subtle because employees legitimately request it. Attackers exploit that normal workflow.
Red flags:
- request comes from a new email address,
- request includes “send it here instead,”
- request tries to bypass the portal.
Rule: Resends happen only through the approved method (portal or verified secure delivery), never as an attachment to an unverified address.
4) Payroll portal phishing (“Your account is locked / sign in here”)
Finance/HR staff get fake login prompts that look like payroll or Microsoft 365.
Red flags:
- unexpected password reset prompts,
- links that don’t go to your known domain,
- login pages that look “almost right.”
Rule: Never log in from an email link. Navigate directly to the known site.
Safe W-2 delivery options (and what to avoid)
Best: Employee self-service portal
If your payroll provider supports employee access, this is usually the cleanest and safest method.
Do:
- require MFA if available,
- provide a simple “how to access your W-2” note to staff,
- route “lost access” requests through a verified process.
Avoid:
- emailing PDFs because “it’s faster.”
Acceptable: Secure file sharing link with controls
If a portal isn’t available and you must provide documents digitally, use a secure sharing method.
Do:
- share a link, not an attachment,
- restrict access to the specific recipient,
- set an expiration date,
- disable forwarding/download where feasible.
Avoid:
- attachments to email,
- sending to personal emails without verification,
- leaving W-2 PDFs on shared drives with broad access.
Last resort: Physical pickup or mailed delivery
Sometimes the simplest approach is also the safest, especially for high-risk cases.
Do:
- verify identity at pickup
- confirm addresses before mailing
Avoid:
- handing documents to coworkers “to give to them later.”
Access controls, MFA, and offboarding (the controls that prevent incidents)
These controls are your “prevent the preventable” layer.
1) Enforce MFA on payroll/HR/finance systems
If payroll or HRIS credentials are compromised, everything else is downstream damage control.
Minimum standard: MFA enforced for finance/HR admins and any account that can export employee data or change bank details.
2) Least privilege access
Many SMBs give “finance” or “HR” broad permissions because it’s easier. During W-2 week, that’s risky.
Minimum standard:
- only the people who must process W-2s have access,
- admin permissions are limited and documented,
- access is time-bound if temporary.
3) No shared accounts
Shared logins remove accountability and make containment harder.
Minimum standard: individual accounts for payroll access; shared credentials are eliminated.
4) Offboarding is non-negotiable
If a former employee can still access email, payroll, or shared drives, you are one mistake away from a breach.
Minimum standard offboarding checklist:
- disable user account immediately,
- remove payroll/HRIS access,
- revoke MFA tokens/app sessions,
- transfer ownership of finance documents and shared resources.
Backup/recovery note: don’t let a finance incident halt operations
W-2 week is a finance/HR event, but the fallout can become a business-wide outage if:
- email is compromised and spreads internally,
- ransomware hits a file share containing finance docs,
- payroll systems are locked out or hijacked,
- a mailbox rule silently forwards sensitive info externally.
Two practical recovery moves:
- Know what must be recoverable (finance docs, payroll exports, key file locations, critical email accounts).
- Test restores - even a small restore test is better than “we think we’re backed up.”
Backups are not about “having copies.” They’re about knowing your recovery time and being able to keep operating.
The tight W-2 week checklist (copy/paste)
Before distribution
- Confirm W-2 delivery method (portal preferred; secure link if needed; avoid attachments)
- Enforce MFA for payroll/HRIS and finance admin accounts
- Verify who has access to payroll exports and employee data (least privilege)
- Confirm offboarding is current (no stale accounts)
During the week
- Treat all “resend” and “update bank details” requests as verification-required
- Do not fulfill bulk data requests via email
- Navigate to payroll sites directly (no email links)
- Monitor for suspicious login alerts and mailbox forwarding rules
After distribution
- Remove any temporary access granted
- Verify sensitive files are stored only in approved locations
- Document any incidents/close calls and update the process
If W-2 week has you thinking, “We’re probably fine, but I’m not 100% sure,” that’s the right moment to validate the fundamentals.
Start with a Security Review and we’ll give you a findings call so you can reduce risk without slowing the business down.