Is It Safe to Email a W-9? 7 Risks and Safer Options
Emailing a W-9 exposes a vendor's TIN, often an SSN, to mailbox breaches and misdirected mail. Seven risks, what IRS guidance says, and safer options.
General information, not tax or legal advice.
Quick answer
Emailing a W-9 isn't illegal, but it isn't a safe default. Email is usually encrypted between servers, yet the attachment sits readable in both mailboxes, gets copied into backups, and can be sent to the wrong person. A W-9 carries a taxpayer identification number (TIN), which for many sole proprietors is a Social Security number. IRS guidance for tax professionals says to send sensitive files password-protected and encrypted, or by secure file transfer instead of email (IRS Publication 4557).
Form W-9 holds a legal name, an address and a TIN. That combination is exactly what an identity thief needs, so it's worth understanding where email falls short.
Seven risks of emailing a W-9
Risk 1: Email protects the trip, not the mailbox
Major email providers generally encrypt messages while they move between servers. That protection ends on arrival. The attachment is stored in the sender's sent folder and the recipient's inbox, where anyone who gets into either account can open it. Encryption in transit doesn't help once a mailbox is compromised.
Risk 2: Compromised inboxes
Business email compromise
The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with more than $3 billion in reported losses (FBI IC3, 2025 IC3 Annual Report).
An attacker inside a mailbox can search it for words like "W-9," "SSN" or "EIN" and download every matching attachment. Your vendor's mailbox security is outside your control.
Risk 3: Not every hop is guaranteed
An email passes through several systems between sender and recipient. Encryption between mail servers is common but depends on both sides supporting it, and the sender usually can't see whether every hop was protected. For a routine note that's fine; for a document with a Social Security number, it's a gamble you don't need to take.
Risk 4: Password-protected PDFs are only as good as the process
IRS Publication 4557 does allow sending "password-protected and encrypted documents" by email when you must use email. The weak point is usually the process, not the encryption:
- The password gets sent in the same email thread, so a compromised inbox has both.
- Short, guessable passwords defeat the protection.
- There's no expiry: the file stays in both mailboxes indefinitely.
If you use this method, choose a strong password and share it by phone or text, never in the same thread.
Risk 5: Shared and unmanaged devices
Vendors often read email on personal phones, shared computers or public Wi-Fi. A lost or unlocked device with an open mail app exposes every W-9 in it.
Risk 6: Copies that never expire
Email keeps messages until someone deletes them, and backups keep them longer. Deleting your copy doesn't remove the vendor's sent copy, their provider's backups, or any forwards. The FTC Safeguards Rule, which covers firms that prepare tax returns, requires securely disposing of customer information no later than two years after last use unless it's needed for business or required by law (FTC: Safeguards Rule). That's hard to do when copies are scattered across inboxes.
Risk 7: Human error
Security Warning
Verizon's 2026 Data Breach Investigations Report found that 62% of breaches involved a human element, and phishing was the initial access vector in 16% of breaches (Verizon DBIR).
Common mistakes include a mistyped address, autocomplete picking the wrong contact, "Reply All," and forwarding a thread with an old W-9 still attached. Once an email is delivered, you can't reliably pull it back.
Phishing that uses W-9s as bait
Because W-9 requests are routine, scammers use them as cover: fake "please send your W-9" emails, spoofed client addresses and malicious attachments named "W9.pdf." The Emotet malware campaign, for example, used fake IRS W-9 attachments in 2022.
IRS Publication 4557 puts it simply: "A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service." The FTC advises verifying any email that asks for sensitive information through a separate channel, without using the links or phone numbers in the email (FTC: Protecting Personal Information).
What the IRS says
The IRS doesn't prohibit emailing a W-9. Its guidance for tax professionals, Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024), sets the expectation:
Compliance Requirement
- "Protecting taxpayer data is the law."
- Encrypt all sensitive files and emails, especially those with a taxpayer's personally identifiable information.
- "Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email."
IRS instructions also require payers to keep W-9 identity information, including SSNs and EINs, confidential and to use it only to comply with the tax laws (General Instructions for Certain Information Returns).
If a breach does happen, the consequences come from other rules: every state has a breach-notification law, and firms covered by the FTC Safeguards Rule must notify the FTC within 30 days of discovering an event involving 500 or more consumers.
What stolen W-9 data is used for
Tax identity theft
The FTC warns that a stolen name and Social Security number can be used to commit tax identity theft
New accounts in the victim's name
The same data can be used to sign up for new accounts
Vendor impersonation
Knowing who you pay makes fake bank-change requests more convincing
Source for the first two: FTC: Data Breach Response, a guide for business.
Safer alternatives
Option 1: Password-protected PDF, password sent separately
How it works: The vendor encrypts the PDF with a strong password, emails the file, and shares the password by phone or text.
Pros: No new software; accepted by IRS Publication 4557 when email must be used.
Cons: Relies on the vendor choosing a strong password and not sending it in the same thread; no expiry or deletion; copies still sit in both mailboxes.
Option 2: Encrypted upload link
How it works: You send the vendor a unique upload link. The file is encrypted in their browser before upload, stored encrypted, and deleted on a schedule.
What to look for in an upload tool
Encryption before upload
The file is encrypted in the vendor's browser before it leaves their device
No plaintext on the server
The service stores only the encrypted file
Expiring links and scheduled deletion
Links stop working after a set period, and files are removed on a schedule
Activity log
A record of uploads and downloads
No vendor account
The vendor clicks the link and uploads; no login needed
File checks
File-type validation and basic malware checks on upload
Pros: Nothing sensitive in the email thread; limited lifetime; a record of activity.
Cons: A subscription tool and a small change to your process.
Option 3: Secure file transfer your firm already uses
How it works: Many firms already have a client portal or secure file-transfer system (IRS Publication 4557 mentions SFTP). If yours accepts uploads from outside parties, use it for W-9s too.
Pros: No new vendor; fits existing controls.
Cons: Some systems require outside parties to create accounts, which slows vendors down.
Comparison
| Feature | Plain email | Password PDF | Encrypted upload link |
|---|---|---|---|
| File readable in a compromised mailbox | Yes | Only if the password is there too | No file in the mailbox |
| Expires or deletes automatically | No | No | Yes |
| Activity log | No | No | Yes |
| Vendor effort | Low | Moderate | Low |
How W9Vault handles W-9 collection
Collecting a W-9 with W9Vault
Create a request
Enter the vendor's email; W9Vault creates a unique upload link that expires after 7 days
Vendor gets the link by email
The email contains the link and instructions, not the form
Encryption in the browser
The W-9 is encrypted in the vendor's browser with TweetNaCl (XSalsa20-Poly1305) before upload, so our server never receives the plaintext file
You're notified
You get an email when the vendor uploads
Download from your dashboard
Download and decrypt the W-9 from your account and save it to your records system
Automatic deletion
Files for completed requests are deleted 30 days after upload
W9Vault is designed to support a secure collection workflow; you remain responsible for your own tax, recordkeeping and security obligations. It reduces email risk but doesn't remove every risk: a vendor can still mistype your details or have a compromised device.
Frequently asked questions
W-9 Email Security Questions
It isn't illegal, but it isn't a safe default. The attachment stays readable in both mailboxes and backups, and a W-9 often carries a Social Security number. IRS Publication 4557 advises sending sensitive files password-protected and encrypted, or by secure file transfer instead of email.
Interception in transit is less common than people think, because most mail servers encrypt between each other. The bigger risk is a compromised mailbox on either end, where the attachment sits readable, and misaddressed email.
Use the requester's secure upload link or portal if they have one. Otherwise, send a password-protected, encrypted PDF and share the password by phone or text, which IRS Publication 4557 allows when email must be used.
No IRS rule prohibits it. IRS Publication 4557, written for tax professionals, recommends encrypting files with personal information and using secure file transfer instead of email where possible.
It can be, if the password is strong and shared through a different channel. The common failure is sending the password in the same email thread.
Delete it from your sent folder and trash, and ask the recipient to save it to their records system and delete the email. Watch for unexpected tax or credit activity, and use a secure method next time.
Key takeaways
Best Practice
- Emailing a W-9 isn't illegal, but the attachment stays readable in both mailboxes and backups.
- IRS Publication 4557 recommends encrypted files and secure file transfer over plain email.
- A password-protected PDF is acceptable if the password is strong and sent separately.
- An encrypted upload link keeps the form out of email entirely and limits how long it exists.
- Verify any unexpected W-9 or bank-detail request through a separate channel.
Stop sending W-9s via email
Start free with 3 secure uploads per month. No credit card required.
Start free with W9Vault: the Starter plan includes 3 requests a month.
