February has a familiar feeling.
Payroll is busy. W-2s are being prepared. Your accountant is asking for documents. Your HR or business office is already juggling deadlines.
And here’s the part no one warns you about:
For senior care communities, tax season often brings cyber scams before it brings tax forms.
There’s one scam in particular that hits early every year — and it’s quietly causing major damage inside healthcare and senior living organizations.
The W-2 Email Scam (And Why Senior Care Is a Target)
Here’s how it usually happens:
Someone in your organization — often payroll, HR, or the business office — receives an email that looks like it came from you, the owner, or another senior leader.
The message is short and urgent:
“I need copies of all employee W-2s for the accountant. Can you send them over today? I’m tied up in meetings.”
It feels normal.
It sounds like you.
And in February, it doesn’t raise alarms.
So the employee sends the W-2s.
But the email wasn’t from leadership.
It was from a criminal using a fake or look-alike email address.
Now that criminal has access to:
- Full employee names
- Social Security numbers
- Home addresses
- Salary information
Everything needed for identity theft and fraudulent tax filings.
How This Affects Your Staff — and Your Facility
Most organizations don’t discover the problem right away.
They find out when an employee tries to file their tax return… and it’s rejected.
“Someone has already filed using this Social Security number.”
Now your staff member is dealing with the IRS, identity theft paperwork, credit monitoring, and months of stress — because of one email they trusted.
As an administrator, this isn’t just an IT issue.
It becomes:
- A trust issue with your staff
- An HR crisis
- A potential legal and compliance concern
- And a leadership burden you never asked for
Explaining to your team that their personal information was exposed is not a conversation any senior care leader wants to have.
Why This Scam Works So Well in Senior Care
This isn’t a sloppy phishing email. It’s effective because it fits your world.
- The timing makes sense. W-2s are expected in February.
- The request feels reasonable. Leadership really does ask for documents.
- The urgency feels normal. Everyone is busy this time of year.
- The sender looks legitimate. Criminals research names and roles.
- Staff want to help. Especially when it appears to come from leadership.
In care organizations, helpfulness and responsiveness are strengths — and criminals exploit that.
Five Simple Ways to Protect Your Community (Before This Happens)
The good news? This scam is very preventable. It doesn’t require complex technology — it requires clarity and consistency.
1. Create a “No W-2s by Email” rule
No W-2s or sensitive payroll documents should ever be sent by email. No exceptions — even if the request appears to come from leadership.
2. Require verification through a second channel
Any request for sensitive data must be verified by phone or in person. Not by replying to the email. This one step stops most scams instantly.
3. Have a quick tax-season reminder with staff
A 10-minute conversation now can prevent months of cleanup later. Show staff what these emails look like and give them permission to slow down and verify.
4. Secure payroll and HR systems with multi-factor authentication
If someone’s password is stolen, MFA is often the last barrier protecting your data.
5. Make verification a leadership value
Staff should feel supported — not embarrassed — for double-checking requests, even when they appear to come from leadership.
When questioning is encouraged, scams lose their power.
The Bigger Picture for Senior Care Leaders
The W-2 scam is often just the first wave.
Between now and April, senior care facilities frequently see:
- Fake IRS payment demands
- Emails posing as tax software updates
- Messages pretending to be from accountants
- Malicious links disguised as financial documents
Tax season is stressful enough. Cybercriminals know that distractions create opportunity.
Facilities that make it through cleanly aren’t lucky — they’re prepared.
They have clear rules.
They educate their staff.
They treat data protection as part of resident and staff safety.
A Final Thought for Administrators
You already carry enormous responsibility — for residents, families, staff, regulators, and boards.
Cybersecurity doesn’t need to be another source of anxiety.
A few clear policies and the right support can protect your people, your reputation, and your mission.
If this article made you pause and think, “We should probably review how we handle this,” that’s a good instinct.
And if you know another administrator who could benefit from this reminder, please share it with them.
Because tax season should never turn into an identity theft crisis — especially in a community built on trust.
