LANSING — Business taxpayers should be extra alert for cybercriminals attempting to steal W-2 forms and other sensitive information through a phishing scam, according to the Michigan Department of Treasury.

In a typical scenario, cybercriminals impersonate people of authority within a company and send an email to payroll personnel asking for copies of all employee W-2 forms.

A W-2 form contains an employee’s name, address, Social Security number, income and withholdings. Cybercriminals use that information to file state income tax returns and steal refunds, or they post it for sale on the “Dark Web.”

The Internal Revenue Service reports the scam has affected all types of employers, from small and large businesses to public schools and universities, hospitals, tribal governments and charities. A common theme in this scam and other email scams is that the copy includes grammatical and spelling mistakes.

Business taxpayers who receive this type of email are asked to report the encounter to phishing@irs.gov. To learn more about identity theft, go to www.michigan.gov/identitytheft.