W-9 Phishing: How to Spot a Fake W-9 Request

A fake W-9 request is designed to look like routine paperwork. Before you send a completed W-9, confirm the request with the business through a phone number or channel you already trust, never the links or numbers in the message. AP teams should apply the same check in reverse: confirm any W-9 or bank-account change from a "vendor" on a known number before updating a record or releasing a payment.

General information, not tax or legal advice.

The short answer

A legitimate W-9 request comes from a business that pays you, and the completed form goes back to that business, never to the IRS. W-9-themed phishing borrows that routine; in our view, the risks are a TIN sent to the wrong person, a malicious link or attachment, and a payment redirect. Our recommended defense: verify through a separate channel, compare the form with the official one on IRS.gov, and treat any bank change as a separate request. See our secure W-9 collection guide for the full picture.

Why W-9 requests make good bait

A business sends a W-9 because it has to file an information return and must get your correct TIN, which can be an SSN, ITIN, ATIN or EIN (Form W-9, Rev. March 2024). FTC breach guidance warns that thieves with names and Social Security numbers can use them to commit tax identity theft (FTC: Data Breach Response).

Phishing and spoofing was the most-reported crime type by count in the FBI's 2025 Internet Crime Report, with 191,561 complaints; those are self-reported complaints across all phishing, not W-9-specific, and not a count of every incident (FBI IC3, 2025 Internet Crime Report). The same report logged 24,768 business email compromise complaints in 2025, with more than $3 billion in reported losses.

What the IRS, FBI and FTC say

We found no IRS alert about fake W-9s

As of September 2026, we found no IRS alert specifically about fake W-9 requests. The IRS's fake-form alert is about a different form: it has warned that scammers use altered versions of Form W-8BEN to collect details the real form never asks for, such as passport numbers, PINs and passcodes (IRS: Fake Form W-8BEN). The IRS first warned about modified W-8BEN forms in 2009 (IR-2009-71).

W-9-themed phishing is consistent with the IRS's broader warnings about document requests:

• "Document request" emails. The IRS's 2026 Dirty Dozen warns that tax professionals and businesses remain targets of "new client" or "document request" emails that deliver malicious links or attachments (IRS Dirty Dozen 2026). The top item on that list is IRS impersonation by email and text, and number 11 is spear-phishing and malware aimed at tax professionals.
• Real threads, fake requests. Scammers who hack an email account can find genuine past messages to a tax professional and use them to make a new request look legitimate.
• Don't click. The IRS urges people not to click links or open attachments in unexpected messages, and to report suspicious IRS-related emails, DMs and texts.

How the IRS does and doesn't contact you

The IRS says it never emails or texts without your permission and never sends direct messages on social media (IRS: Report phishing). The W-9 tells payees to forward unsolicited emails claiming to be from the IRS to phishing@irs.gov. A message saying "the IRS needs your W-9" doesn't match how the form works.

Business email compromise and payment redirects

The FBI's IC3 describes BEC as a scam targeting businesses that work with suppliers or regularly make wire transfers; fraudsters compromise email, phone or virtual-meeting accounts to redirect funds. Nacha defines "False Pretenses" as inducing a payment by misrepresenting identity, authority or account ownership, and says this covers business email compromise and vendor impersonation (Nacha: Fraud monitoring, Phase 1). In our view, a new W-9 makes a convenient cover story for new bank details.

The verification advice is consistent across agencies:

• The FBI advises using secondary channels or two-factor authentication to verify requests to change account information, and watching for hyperlinks that misspell the real domain name (FBI IC3 PSA).
• The FTC advises verifying any email that requests sensitive information through a separate channel, and not using the links, phone numbers or websites in the email (FTC: Protecting Personal Information).
• The FTC tells small businesses to train employees not to send sensitive information by email, even if the request seems to come from a manager (FTC: Scams and Your Small Business).
• CISA advises small businesses to turn on MFA across email, file storage and remote access, starting with admin accounts and staff who handle sensitive data, and to aim for phishing-resistant MFA (CISA: Require multifactor authentication).

Red flags

Our list. One flag isn't proof of fraud, but it is a reason to stop and verify.

• It's unexpected, or from a business you haven't agreed to work with.
• It pushes urgency: "payment is on hold until we get this today."
• The sender address or link is slightly off from the real domain.
• It claims to come from the IRS, or asks you to send the W-9 to the IRS.
• It asks you to email your SSN or the form in plain text. IRS Publication 4557, written for tax professionals, says a legitimate business will never ask you to email personal or sensitive information unless it is through a secured mail service (IRS Publication 4557).
• The "W-9" asks for more than the official form, such as a bank login or PIN. Compare it with the form on IRS.gov.
• A vendor's W-9 arrives with new bank details or a request to pay a different account.

Recommended workflow

Our recommendations, not IRS procedures.

If you're a vendor receiving a W-9 request

1. Pause (vendor). Don't click, reply or open attachments yet.
2. Verify on a known channel (vendor). Call the business on a number from your contract or an earlier invoice.
3. Check the form (vendor). Download the W-9 from IRS.gov yourself rather than using an attached copy.
4. Return it securely (vendor). Use a secure upload link if offered; otherwise see how to send a W-9 by email.
5. Report IRS impersonation (vendor). Forward it to phishing@irs.gov.

If you're an AP team receiving a W-9 or bank change from a "vendor"

1. Separate the two requests (AP clerk). A W-9 updates tax information; a bank change moves money.
2. Call the vendor on the number in your vendor file (AP clerk). Not the number in the email or on the new letterhead.
3. Check the details (AP clerk). A payee must give you a new W-9 if the name or TIN on the account changes, so an unexplained change deserves a question.
4. Approve with a second person (AP manager). Bank changes get a second approver before the next payment run.
5. Log it (AP manager). Record who verified, how and when.

Exception path: if you can't reach the vendor on a known number, don't change the record and don't release the payment. If money has already gone to a suspicious account, the FBI says time is of the essence. We recommend contacting your bank right away.

For new-vendor setup, see our vendor onboarding checklist.

The FTC notes that credit freezes are free to place and lift and block new accounts, and that an initial fraud alert tells businesses to check with you before opening an account (FTC: What to know about identity theft).

Example scenario

Example scenario: Northgate Supply, a made-up distributor, gets an email that appears to come from a long-time cleaning contractor. It carries a new W-9 and a letter asking Northgate to pay a different bank account starting this month. The sender's domain has one extra letter. The AP clerk calls the contractor on the number in the vendor file, and the owner confirms they sent nothing. The AP manager logs the attempt and keeps the original record.

Common mistakes

• Replying to the suspicious email to ask whether it's real.
• Updating bank details because the email came from a thread you recognize.

Checklist

• Request verified on a phone number or channel we already had
• Sender domain checked character by character
• Form compared with the official W-9 on IRS.gov
• No SSN or EIN typed into email
• Bank changes handled separately, with a call-back and a second approver
• IRS-impersonation emails forwarded to phishing@irs.gov
• Staff trained not to send sensitive data by email on request

How W9Vault supports this workflow

With W9Vault, you send a vendor a secure upload link that expires after 7 days; the vendor uploads the completed W-9 as a PDF, JPG or PNG up to 20 MB. Files are encrypted in the vendor's browser before upload, so the server never receives the plaintext file, and uploaded files are automatically deleted 30 days after upload for completed requests. One request can also ask for several documents at once, such as a W-9 and an ACH form, and your dashboard shows whether each request is sent or completed.

A secure link doesn't replace verification: tell vendors to expect it, and still call on a known number before acting on any bank change. W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations. Once a W-9 arrives, see how to store W-9 forms securely.

Frequently Asked Questions

Has the IRS warned about fake W-9 forms?

We found no IRS alert specifically about fake W-9 requests. The IRS has warned about altered W-8BEN forms, and its 2026 Dirty Dozen warns businesses about document request emails that deliver malicious links or attachments.

A vendor sent a new W-9 and new bank details. What should we do?

Handle them as two requests. Call the vendor on the number already in your vendor file, have a second person approve any bank change, and log how it was verified.

Official resources

• Form W-9 (PDF), Rev. March 2024
• IRS Dirty Dozen 2026 (IR-2026-30)
• IRS: Report phishing and online scams
• IRS: Fake Form W-8BEN used in IRS tax scams
• IR-2009-71, fake W-8BEN (PDF)
• IRS Publication 4557, Safeguarding Taxpayer Data
• FBI IC3, 2025 Internet Crime Report
• FBI IC3 PSA on business email compromise
• CISA: Require multifactor authentication
• Nacha: Fraud monitoring, Phase 1
• FTC: Protecting Personal Information, A Guide for Business
• FTC: Scams and Your Small Business
• FTC: Data Breach Response, A Guide for Business
• FTC: What to know about identity theft