How to Securely Send W-9s, W-8BENs and ACH Forms
How accountants and AP teams can collect W-9s, W-8BENs and ACH forms without email attachments: IRS and FTC guidance, and a step-by-step workflow.
General information, not tax or legal advice.
Vendor onboarding usually means collecting three sensitive documents: a W-9 from U.S. vendors, a W-8BEN or W-8BEN-E from foreign ones, and an ACH form with bank details. Between them they carry taxpayer identification numbers (often Social Security numbers), addresses and bank account numbers. This guide covers the risks of collecting them by email and a safer workflow.
Why email is a weak channel for these forms
Attachments stay readable in the mailbox
Most email is encrypted while it moves between servers, but the attachment is stored readable in the sender's and recipient's mailboxes and backups. Anyone who gets into either account can open it. IRS Publication 4557, written for tax professionals, advises encrypting sensitive files and sending them by secure file transfer instead of email, or password-protected and encrypted if email must be used (IRS Publication 4557).
Business email compromise targets payments
In business email compromise (BEC), criminals hijack or spoof an email account and send a plausible request to redirect a payment. The FBI's Internet Crime Complaint Center logged 24,768 BEC complaints in 2025, with more than $3 billion in reported losses (FBI IC3, 2025 IC3 Annual Report).
The typical AP scenario: someone posing as a vendor emails a "new" ACH form or updated bank instructions. If your team updates the vendor record without checking, the next payments go to the fraudster. Nacha, which sets the rules for the ACH network, defines "False Pretenses" as inducing a payment by misrepresenting identity, authority or account ownership, and says this covers business email compromise and vendor impersonation (Nacha: Fraud Monitoring Phase 1).
Tax forms are phishing bait
Because W-9 requests are routine, scammers use them as cover. The Emotet malware campaign, for example, sent fake IRS W-9 attachments in 2022. IRS guidance puts it plainly: "A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service."
Misaddressed email can't be recalled
A mistyped address, an autocomplete slip or "Reply All" can send a contractor's Social Security number to a stranger. Once delivered, the email can't reliably be pulled back.
The rules that apply
- IRS confidentiality. Payers must keep W-9 identity information, including SSNs and EINs, confidential and use it only to comply with the tax laws (General Instructions for Certain Information Returns).
- FTC Safeguards Rule. Firms that prepare tax returns are "financial institutions" under the rule. Covered firms must encrypt customer information in transit over external networks and at rest, or use compensating controls approved by their Qualified Individual. Bookkeepers who don't prepare returns should check with counsel (FTC: Safeguards Rule).
- Nacha fraud monitoring. Since 2026, Nacha requires business originators of ACH payments to have risk-based processes to identify ACH entries initiated due to fraud. Phase 1 took effect March 20, 2026 for the largest originators; Phase 2 took effect June 19, 2026 (practically June 22) for all remaining non-consumer originators (Nacha: Fraud Monitoring Phase 2).
Form by form
- W-9 (U.S. vendors). Collect it before the first payment. If a vendor doesn't provide a TIN, backup withholding at 24% applies to reportable payments, which for 2026 means payments at or above the $2,000 threshold (Instructions for Forms 1099-MISC and 1099-NEC). Penalties for incorrect or missing 1099s due in 2027 are $60 per return if corrected within 30 days, $130 if corrected by August 1, and $340 after that or if never filed (Rev. Proc. 2025-32).
- W-8BEN / W-8BEN-E (foreign vendors). Like the W-9, it goes to you as the requester, never to the IRS (Instructions for Form W-8BEN). A W-8BEN generally stays valid through the last day of the third calendar year after it's signed, unless circumstances change, so track renewal dates.
- ACH authorization. Treat any new or changed bank details as a fraud checkpoint. The FBI advises using secondary channels or two-factor authentication to verify requests to change account information.
What to look for in a collection tool
Security features for tax and payment form collection
Encryption before upload
Files are encrypted on the sender's device before they're uploaded
Expiring links
Request links stop working after a set period
Access controls
Only your team can download what vendors upload
Activity log
A record of uploads and downloads
Scheduled deletion
Files are removed from the collection tool on a schedule, after you've saved them to your records system
Your options
- E-signature platforms. Useful if you already send contracts for signature and want the vendor to complete the form online. Check how long completed documents are retained and who can access them.
- Your accounting software's vendor portal. Some accounting packages can request W-9 details from vendors directly. Check which form types it supports; W-8BENs and ACH forms are often not included.
- General file-sharing services. Workable if configured carefully: file-request links, expiry and access logging. The security depends on those settings being on.
- Purpose-built collection tools. Designed around a request, an upload link and deletion, with little setup for the vendor.
Whichever you choose, the process around it matters as much as the tool.
A step-by-step workflow
Secure workflow for tax and payment forms
Keep forms out of email
Request emails carry a link, never the form
Encrypt before upload
Choose a tool that encrypts files on the vendor's device
Verify bank details on a second channel
Call the vendor at a number you already have on file
Limit lifetimes
Use expiring links and scheduled deletion
Track renewals and changes
Keep forms current
Document your process
Write it into your information security program
How W9Vault fits
W9Vault for vendor document collection
Encrypted in the browser
Files are encrypted in the vendor's browser with TweetNaCl (XSalsa20-Poly1305) before upload, so our server never receives the plaintext file.
No vendor account
Vendors click a link and upload; no account or password needed.
7-day links, 30-day deletion
Upload links expire after 7 days. Files for completed requests are deleted 30 days after upload.
Several forms in one request
Ask for a W-9, W-8BEN and ACH form together, as PDF, JPG or PNG up to 20 MB each.
W9Vault is designed to support a secure collection workflow; you remain responsible for your own tax, recordkeeping and security obligations. Verifying bank details is still your team's job; no collection tool replaces a call-back.
Key takeaways
- Email attachments stay readable in both mailboxes; IRS Publication 4557 recommends encryption and secure file transfer instead.
- Bank-detail change requests are a prime fraud route: verify them on a second channel.
- W-8BENs expire; W-9s don't, but need replacing when a vendor's name or TIN changes.
- Firms covered by the FTC Safeguards Rule must encrypt customer information in transit and at rest.
Start free with W9Vault: the Starter plan includes 3 requests a month.
