By Editor’s Note: This blog post is a joint submission with BakerHostetler’s Data Privacy Monitor blog.
Last year we saw an unprecedented number of companies of all sizes fall victim to a W-2 spear phishing scam. The scam usually began with a “spoofing” email that appeared to have been sent by a company’s CEO or CFO to one or more employees in the human resources or payroll department. The email typically requested that all of the company’s employees’ W-2s be sent in PDF format via return message or uploaded to a file sharing site. Unbeknownst to the human resources or payroll department employees, the email did not come from the CEO or CFO but a criminal who had conducted some research to, at the very least, identify the names and email addresses of the CEO or CFO as well as the targeted human resources or payroll department employees. Here is an example:
_______________________________________________________________________
From: Jim.Smith@company.com
To: Tony.Adams@company.com
Subject: Treat as Urgent
Date: March 7, 2016 10:55 AM
________________________________________________________________________
Hi Tony,
I need copies of all employees’ W-2 wage and tax statements for 2015 to complete a business transaction. I need them in PDF format. You can send them as an attachment.
Regards,
Jim Smith
_________________________________________________________________________
The email appears to be a completely legitimate request from a legitimate email address, but in reality the email is from somewhere entirely different and has the “REPLY TO” field (that is typically hidden from the end user) set to an email address controlled by the criminal; for example, ceo@mail.com. The email headers would show this. Other variations on the content of the W-2 requests can be found in the IRS’s alert on the topic issued March 1, 2016.
Criminals were successful in filing fraudulent tax returns within days (and perhaps hours) of obtaining the W-2s. The time and effort it takes to steal this valuable information – a few simple, targeted emails to unsuspecting employees – is significantly less than the time and effort it takes to infiltrate a network. Given this, it is highly likely that this scam will continue during the 2016 tax season.
Now is a good time to remind employees, especially those who handle W-2s and other tax forms, to be aware of the threat. Employees should be advised that email requests for any type of sensitive data should be confirmed as legitimate through direct contact with the apparent sender via a phone call. Employees should be further advised that, rather than responding directly to the email, they should send a new email where they enter the recipient. Employees should also be reminded of any policies and procedures regarding safeguarding personal information.
You can review a compilation of IRS alerts as well as further information on how to avoid tax fraud in general on the IRS’s website.
2017 BakerHostetler Data Security Incident Response Report
For a more in-depth look at other data breach trends, be on the lookout for the 2017 BakerHostetler Data Security Incident Response Report to be published in the near future. To be one of the first to receive a copy, sign up here.
The IRS recently issued 
It can, at times, seem like a fool’s errand to focus too closely on specific provisions contained in proposed legislation. As any casual observer of Congress can attest, committee proposals frequently die unenacted or undergo significant change before they are considered by the full House or Senate. Joint conference committees provide yet further opportunities for additional changes, as competing bills are melded together for consideration by both houses.
The IRS resolved an important issue when it issued 
The IRS has issued final regulations clarifying the definitions of “spouse,” “husband,” “wife,” and “husband and wife” for federal tax purposes. The final regulations now define “spouse,” “husband” and “wife” as any individual lawfully married to another individual, and “husband and wife” as any two individuals lawfully married to each other, regardless of the individuals’ sex.
Republicans in the House of Representatives and the Senate have introduced bills to derail the 
On Aug. 2, 2016, the Treasury Department and the Internal Revenue Service released proposed regulations under Internal Revenue Code (Code) section 2704 (the “Proposed Regulations”). The Proposed Regulations, if finalized in their proposed form, would eliminate most valuation discounts on redemptions and transfers of family business interests among family members when a single family “controls” the business both before and after the transfer.
There are several gifting vehicles that provide donors and their families with the opportunity to participate in their philanthropy on an ongoing basis. Frequently, families will consider creating and funding a private family foundation or, in special circumstances, an organization that supports one or more public charities. A cost-efficient option for many families is to coordinate their charitable giving through a donor advised fund (DAF) sponsored by a reputable public charity.
On August 24, 2016 the IRS published Revenue Procedure 2016-47, which simplifies the steps for correcting a missed rollover from a qualified plan or IRA to another qualified plan or IRA. Amounts distributed from a qualified plan or IRA will be taxable unless they are rolled over into another plan or IRA within 60-days of the original distribution.
