How to Send a W-9 by Email (If You Have To)

If you have to send a completed W-9 by email, don't attach it as a plain PDF. First confirm the request is real by contacting the requester through a phone number or channel you already trust. Then send the form as an encrypted or password-protected file, give the password by a different channel, keep your TIN out of the message body, and delete your local copies once the requester confirms receipt. If the requester offers a secure upload link, use that instead.

General information, not tax or legal advice.

The short answer

A standard email attachment is usually a poor channel for a document that carries your Social Security number or EIN. Copies sit in your Sent folder, the recipient's inbox, backups and any inbox it's forwarded to, and anyone who later gets into one of those accounts gets your TIN. We cover those risks in detail in is it safe to email a W-9?, and the wider picture in our secure W-9 collection guide.

This post is the harm-reduction version for when the requester can only take email. If you're still choosing a method, see how to send a W-9 to a client, which compares three options.

Why this matters in a real workflow

A business asks for your W-9 because it has to file an information return and must get your correct TIN, which can be an SSN, ITIN, ATIN or EIN (Form W-9, Rev. March 2024). Because the request is routine, it is easy for scammers to imitate.

The IRS's 2026 Dirty Dozen warns that tax professionals and businesses remain targets of "new client" or "document request" emails that deliver malicious links or attachments (IRS Dirty Dozen 2026). The same release notes that scammers who hack an email account can find genuine past messages to a tax professional and use them to make a new request look legitimate. A request can arrive in a real thread, from a real address, and still be fake.

FTC breach guidance warns that thieves with names and Social Security numbers can use them to commit tax identity theft (FTC: Data Breach Response).

What IRS and FTC guidance says

The IRS sources we rely on don't prescribe how a vendor delivers a W-9. The form says to give it to the requester and not to send it to the IRS. The closest guidance is IRS Publication 4557, Safeguarding Taxpayer Data, and the FTC's business guides. Publication 4557 is written for tax professionals, not vendors, but its email advice is a sensible benchmark for anyone sending tax data.

• Encrypt it. The IRS advises encrypting all sensitive files and emails, especially those with taxpayers' personally identifiable information, and using strong passwords (IRS Publication 4557).
• Email only as a fallback. Publication 4557 tells tax pros to send only password-protected, encrypted documents if they must use email, or to use secure file transfer instead of email.
• Watch how you're asked. The same publication says a legitimate business will never ask you to email personal or sensitive information unless it is through a secured mail service.
• Verify first. The FTC advises verifying any email that requests sensitive information through a separate channel, and not using the links, phone numbers or websites in the email (FTC: Protecting Personal Information). It also tells businesses to caution employees against emailing Social Security numbers, passwords and account information.
• Send the password another way. The IRS's sample written information security plan includes a policy that PII won't be emailed unprotected, and that passwords are sent by a different channel than the data (IRS Publication 5708). That is sample text for tax practices, not a rule for vendors.

Recommended workflow

Our recommendations, not IRS procedures. You, the sender, own each step unless noted.

1. Verify the request (sender). Call the requester on a number you already have, from a contract, an earlier invoice or a website address you typed yourself. Don't use the phone number or link in the email. The FTC also tells small businesses to train employees not to send sensitive information by email, even if the request seems to come from a manager (FTC: Scams and Your Small Business).
2. Ask about a better channel (sender). While you're on the phone, ask whether they can send you a secure upload link or accept an encrypted file.
3. Confirm the address (sender). Type the recipient's address yourself or check it character by character. The FBI advises watching for links that misspell the real domain name (FBI IC3 PSA), and a look-alike sender address is the same trick.
4. Protect the file (sender). Use your email provider's encryption option if the requester can open it, or save the W-9 as a password-protected, encrypted PDF or archive. Use a long, unique password.
5. Send the password separately (sender). Text it, or read it out on a call. Never put it in the same email, or in a follow-up email to the same address.
6. Keep the email text clean (sender). Write "Completed W-9 attached, password sent by text." Don't type your SSN or EIN in the body or subject line.
7. Confirm receipt, then clean up (sender, then requester). Once the requester confirms they have it, delete the sent message, empty the Deleted folder, and remove the unprotected copy from Downloads or your desktop. Keep one copy somewhere secure for your own records, and ask the requester to delete the email once the form is saved.

Exception path: if you can't verify the request, don't send anything. If the requester insists on a plain attachment and won't accept a password-protected file, ask for a secure upload link, or offer to return the form by mail or in person.

Red flags that mean stop

• The request arrived unexpectedly, from someone you haven't agreed to work with, or with pressure to send it "right now."
• The link or sender address is slightly off from the real domain.
• The message claims to be from the IRS. The W-9 goes to the requester, not the IRS, and the IRS says it never emails without your permission (IRS: Report phishing).
• The "W-9" asks for more than the official form does. The IRS has warned that scammers use altered versions of Form W-8BEN to collect details the real form never asks for, such as passport numbers, PINs and passcodes (IRS: Fake Form W-8BEN). Treat a W-9 request the same way: compare it to the form on IRS.gov.

If the file wasn't password-protected, consider protecting your credit. The FTC notes that credit freezes are free to place and lift and block new accounts, and that an initial fraud alert tells businesses to check with you before opening an account (FTC: What to know about identity theft).

Example scenario

Example scenario: Harbor Line Design, a made-up one-person studio, gets an email from a new client's office manager asking for a W-9 before the first invoice is paid. The owner doesn't reply to it. She calls the client on the number in their signed contract and confirms the request. The client can only take email, so she saves her completed W-9 (EIN shown here as XX-XXXXXXX) as a password-protected PDF, emails it with a one-line note, and texts the password to a mobile number confirmed on that call. Once the office manager confirms it's saved, she deletes the sent email, empties her Deleted folder and removes the unprotected PDF from Downloads.

Common mistakes

• Replying straight to the request email without verifying it.
• Putting the password in the same email thread as the file.
• Typing the SSN or EIN in the email body.

Checklist

• Request verified by phone or a channel I already trust
• Recipient address typed or checked character by character
• Form compared against the official W-9 on IRS.gov
• File encrypted or password-protected with a strong password
• Password sent by text or phone, not email
• No SSN or EIN in the subject or body
• Receipt confirmed, then Sent, Deleted and Downloads cleaned up

How W9Vault supports this workflow

If you request W-9s, you can spare vendors all of this. W9Vault lets you send a vendor a secure upload link that expires after 7 days. The vendor uploads the completed W-9 as a PDF, JPG or PNG up to 20 MB, and files are encrypted in the vendor's browser before upload, so the server never receives the plaintext file. Your dashboard shows whether each request is sent or completed, and uploaded files are automatically deleted 30 days after upload for completed requests.

W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations. For wording to use when you ask, see how to request a W-9 from a vendor. If a vendor pushes back, see what to do when a vendor won't send a W-9.

Frequently Asked Questions

Is it okay to email a W-9 as a regular attachment?

We do not recommend it. A standard attachment can sit in several inboxes, sent folders and backups, and it carries your TIN. If email is the only option, send an encrypted or password-protected file and give the password by phone or text.

How can I tell if a W-9 request is a scam?

Contact the requester using a phone number you already have, not the details in the email. Be wary of unexpected or urgent requests, misspelled domains, messages claiming to be from the IRS, and forms that ask for more than the official W-9.

Should I send my W-9 to the IRS?

No. The form itself says to give it to the requester and not to send it to the IRS.

Official resources

• Form W-9 (PDF), Rev. March 2024
• IRS Publication 4557, Safeguarding Taxpayer Data
• IRS Publication 5708, Creating a Written Information Security Plan
• IRS Dirty Dozen 2026 (IR-2026-30)
• IRS: Report phishing and online scams
• IRS: Fake Form W-8BEN used in IRS tax scams
• FTC: Protecting Personal Information, A Guide for Business
• FTC: Scams and Your Small Business
• FTC: Data Breach Response, A Guide for Business
• FTC: What to know about identity theft
• FBI IC3 PSA on business email compromise