{"success":true,"data":{"id":"w2-tax-document-phish","label":"Fake employer or payroll provider claiming W-2 tax documents are ready for download and requiring SSN or employee ID verification via email link to access them — PII-harvest fraud; real W-2 forms are distributed through authenticated payroll portals (ADP, Workday, Paychex, Gusto) or mailed, never via cold email credential requests.","description":"Fake employer, HR system, or payroll provider claiming the recipient's W-2 tax documents are ready for download and requiring SSN or employee ID verification via email link to access them — PII-harvest fraud. Real W-2 forms are distributed through authenticated payroll portals (ADP Workforce Now, Workday, Paychex Flex, Gusto) or mailed to the address on file under IRS requirements; cold emails demanding SSN or employee ID submission via link to access W-2 documents are credential-harvest attacks. Distinct from irs-direct-file-2026-amendment-lure (IRS refund narrative) and irs-cp2000-response-phish (IRS underreporter) — this targets the W-2 download / employee ID verification pretext. Detection: W-2 tax document ready/download/available + verify SSN/employee ID to access vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R26; IRS W-2 distribution requirements (Publication 15); FTC payroll phishing advisory 2025; CISA payroll credential-harvest alert.","tier":"danger","category":"phishing","isThin":false}}