Maine Revenue Services Warns of W-2 Phishing Scams

Detected March 17th, 2026

Summary

Maine Revenue Services is warning employers and financial professionals about a phishing scam targeting W-2 information. The notice advises recipients to stop, connect, and confirm requests for sensitive data and outlines steps to take if targeted or victimized.

View original document View source feed page

What changed

Maine Revenue Services has issued a warning regarding a phishing scam targeting human resources and financial professionals in Maine. The scam involves fraudulent emails requesting employee W-2 or other private information. The notice emphasizes the importance of verifying the legitimacy of such requests before sending data and provides instructions for reporting suspected phishing attempts to the IRS, IC3, and Maine Revenue Services.

Regulated entities, particularly those in HR and finance, should be aware of this scam and implement internal controls to verify email requests for sensitive employee data. Employees who believe they have been targeted or victimized should follow the recommended steps, including forwarding suspicious emails to phishing@irs.gov, filing complaints with IC3, and contacting Maine Revenue Services, the IRS, and the FTA if W-2 data has been compromised. Failure to verify requests could lead to the exposure of sensitive personal and financial information.

What to do next

Verify the legitimacy of all email requests for W-2 or other sensitive employee data before sending.
Report suspected phishing attempts to phishing@irs.gov, IC3, and Maine Revenue Services.
Contact Maine Revenue Services, the IRS, and the FTA if W-2 data has been compromised.

Source document (simplified)

If you think you’ve been targeted by this scam: • Forward the email to phishing@irs.gov and place W-2 Scam in the subject line. • File a complaint with the Internet Crime Complaint Center (IC3), operated by the FederalBureau of Investigation.If you’ve been a victim of this scam and your W-2 has been stolen: • Review the recommended actions by the Federal Trade Commission at www.identitytheft.gov or the IRS at www.irs.gov/identitytheft.• File a Form 14039, Identity Theft Affidavit if your tax return gets rejected because of aduplicate Social Security number or if instructed to do so by the Internal Revenue Service.Emailing W-2 or private individual data? Stop. Connect. Confirm. Stop. If you get an email asking you to send employee W-2 or other private/sensitive information, stop to conﬁrm if the request is legitimate before you hit send. Connect. Confirm. Criminals have perfected techniques to trick you into thinking an email is coming from a person you work with. Don’t fall victim to this scam. Connect with the person who you believe sent you the request by phone or by walking over to see them. Do not respond to the email to conﬁrm the sender’s request. The sender could be a criminal, disguising their identity with a fake email address. If you conﬁrm a legitimate request, take steps to protect the information before you send it. If you’ve been targeted… Criminals are targeting human resources and ﬁnancial professionals across Maine with a new phishing scheme. Don’t fall victim. If you sent W-2 or private individual data to an unauthorized third party, contact Maine Revenue Services by phone at (207) 624-7658 or by email at fraudalert.mrs@maine. gov, the IRS at DataLoss@IRS.gov and the FTA at StateAlert@taxadmin.org.