Scammers behind the theft of Redmond School District employees’ W-2s have taken steps to use the information to commit tax fraud.
Some school district employees have reported receiving a letter and transcript of their 2016 tax return from the IRS, according to an email Superintendent Mike McIntosh sent Friday to school district employees. These employees reported they had not requested the transcript and had filed their tax returns before the W-2 theft. The IRS told the district this is likely the work of the scammers, who are planning to use the information to commit tax fraud. The transcript is an electronic copy of a tax return, and includes most information on the original tax return.
Scammers representing themselves as McIntosh sent an email to a district employee Feb. 24 requesting copies of all school district employees’ W-2s. The employee sent them, and the breach is believed to affect more than 1,000 people.
The district declined to fulfill a records request sent by The Bulletin requesting the identity of the employee who sent the W-2 copies, saying the information was part of a possible disciplinary action. However, the district did release a copy of the email requesting the information.
While the sender line in the email was “Mike McIntosh,” the actual email address was “email@example.com.” The email read:
“Kindly send over the company W-3 and the list of W-2 copy of employees wages and tax statement for 2016 in PDF format.
Please send as an attachment for review.
Mike McIntosh, Superintendent.”
While the email was signed “Mike McIntosh” it did not match the email signature McIntosh has set up for his work email, which includes his full name, Michael D. McIntosh, in a large, blue font, his phone number, job title, place of work and email address.
In the email to district employees that the real McIntosh sent Friday, the superintendent requested those who received a transcript of their tax returns to contact district spokesman Rainier Butler. The district plans to report each instance to the IRS. According to a Feb. 2 IRS news release, this sort of scam started in 2015 and is on the rise. The release said standard targets are school districts, hospitals and tribal casinos.
The scammers’ goal is to steal tax refunds, IRS spokesman Raphael Tulino said.
In McIntosh’s Friday email to employees, he said those with unlocked mailboxes should be “vigilant” about checking the box immediately after each delivery. The email also stated it is possible victims will receive a false tax refund and asks employees to verify the amount on the check to see if it is different from what was expected, and to not cash it and call the IRS.
No arrests have been made in the case, but the Redmond Police Department has assigned Detective Derek Hicks to the case.
— Reporter: 541-383-0376, firstname.lastname@example.org