How to Collect W-9s From Vendors Securely (No Email)
A requester's guide to collecting W-9s without email attachments: what IRS and FTC guidance says, and a secure upload workflow for vendor forms.
General information, not tax or legal advice.
If you're the one collecting W-9s (a bookkeeper, accountant or AP team), the easiest request is "just email it back." The problem is what comes back: a form with a name, address and taxpayer identification number, which for many sole proprietors is a Social Security number. This guide covers what official guidance says about sending that kind of data and a safer way to collect it.
Emailing a W-9 isn't illegal, and the IRS doesn't specifically prohibit it. But IRS guidance for tax professionals is clear that sensitive files shouldn't travel as plain email attachments.
What official guidance says
IRS Publication 4557
IRS Publication 4557, Safeguarding Taxpayer Data, is written for tax professionals, and its advice fits anyone handling W-9s:
- "Protecting taxpayer data is the law."
- Encrypt all sensitive files and emails, especially those containing a taxpayer's personally identifiable information.
- "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email."
- "A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service."
Source: IRS Publication 4557 (Rev. 6-2024).
IRS instructions also require payers to keep the identity information on a W-9, including SSNs and EINs, confidential, and to use it only to comply with the tax laws (General Instructions for Certain Information Returns).
The FTC Safeguards Rule
The FTC Safeguards Rule treats an accountant or other tax preparation service that is in the business of completing income tax returns as a "financial institution." If your firm prepares tax returns, the rule applies to you. If you only do bookkeeping, check with counsel.
For covered firms, the rule requires:
- Encryption of customer information both in transit over external networks and at rest. If that's infeasible, your Qualified Individual must approve effective compensating controls.
- Secure disposal of customer information no later than two years after you last used it to serve the customer, unless you need it for business or the law requires you to keep it.
- FTC notification as soon as possible, and within 30 days of discovery, for a security event involving the information of 500 or more consumers.
Source: FTC: Safeguards Rule, what your business needs to know.
Why email attachments are a weak spot
Attachments don't go away
A W-9 sent by email doesn't live in one place. Copies sit in the vendor's sent folder, your inbox, both providers' systems and any backups or archives. Most email is encrypted between servers in transit, but once it arrives it's readable by anyone who gets into either mailbox. Deleting your copy doesn't delete theirs.
Inboxes are a target
Business email compromise is one of the costliest online crimes the FBI tracks. Its Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with more than $3 billion in reported losses (FBI IC3, 2025 IC3 Annual Report). A compromised mailbox full of W-9s gives an attacker names, TINs and the vendor relationships needed to impersonate them.
The FTC warns that thieves with names and Social Security numbers can commit tax identity theft, and notes that every state has a breach-notification law (FTC: Data Breach Response).
A safer workflow for collecting W-9s
A Safer Workflow for Collecting W-9s
Send a secure upload link, not an attachment request
The request email carries a link, never the form itself
Encrypt the file before it leaves the vendor's device
Use a tool that encrypts in the browser
Limit how long files and links exist
Short-lived links and scheduled deletion reduce exposure
The FTC also advises making it office policy to independently verify any email that asks for sensitive information, without using the links, phone numbers or websites in that email (FTC: Protecting Personal Information).
Email attachment vs secure upload link
Email Attachment vs Secure Upload Link
Email attachment
- Readable by anyone with access to either mailbox
- Copies persist in sent folders, inboxes and backups
- Easy to misaddress or forward
- No record of who opened the file
Secure upload link
- File encrypted in the vendor's browser before upload
- Link expires after a set period
- Files deleted on a schedule
- Upload and download activity logged
How W9Vault handles this
W9Vault sends each vendor a secure upload link that expires after 7 days. Files are encrypted in the vendor's browser with TweetNaCl (XSalsa20-Poly1305) before upload, so our server never receives the plaintext file. Vendors don't need an account. Uploaded files for completed requests are automatically deleted 30 days after upload, so download the W-9 into your own records system.
W9Vault is designed to support a secure collection workflow; you remain responsible for your own tax, recordkeeping and security obligations. See how it works and our security page.
Frequently asked questions
Is it legal to email a W-9?
Yes. No IRS rule prohibits it. But IRS Publication 4557 advises sending sensitive files only password-protected and encrypted, or by secure file transfer instead of email, and firms covered by the FTC Safeguards Rule must encrypt customer information in transit over external networks.
Is a password-protected PDF good enough?
It's better than a plain attachment, and IRS Publication 4557 lists it as an option if you must use email. Send the password through a different channel, such as a phone call or text, not in the same email thread.
What about ACH forms and bank details?
Treat them at least as carefully as a W-9. Bank-change requests are a common fraud route, so confirm any new or changed bank details by calling the vendor at a number you already have on file.
How long should I keep collected W-9s?
That's a records-retention question for your own policy and your tax adviser. For firms under the Safeguards Rule, customer information must be securely disposed of within two years of last use unless you need it for business or the law requires you to keep it.
