powered by social2s

Image of the Virginia State Seal

Commonwealth of Virginia
Office of the Attorney General

Mark Herring
Attorney General

202 North Ninth Street
Richmond, Virginia 23219


For media inquiries only, contact:  
Lara Sisselman, Press Secretary
Phone: (804)786-1022 
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.



RICHMOND (June 29, 2017) - Attorney General Mark R. Herring and the Virginia Department of Taxation are reminding Virginians and Virginia employers about a new measure that goes into effect on July 1 to protect personal information and prevent identity theft and the filing of fraudulent tax returns. Under new legislation passed by the General Assembly, Virginia employers must notify both the affected employee and the Office of the Attorney General if an employee's tax identification number in combination with the income tax withheld for that person has been breached.


"Far too often, employees whose payroll data information is stolen are completely unaware that they're victims of identity theft until it's too late," said Attorney General Mark Herring. "These new measures will safeguard Virginians and their personal information and help limit the damage these criminals are able to inflict."


"Stolen payroll data information too frequently ends up in the hands of fraudsters who file false tax returns using valid taxpayer personal information," notes Tax Commissioner Craig Burns. "This phenomenon is in part responsible for the annual increase in the number of fraudulent refunds denied by Virginia Tax and can make the filing of returns by legitimate taxpayers whose data was compromised more difficult and time consuming."


Criminals use stolen payroll information to file false tax returns in victims' names, which results in unsuspecting victims being unable to file tax returns with the IRS or their state tax departments, and they must work to clear up the crime and confusion. Tax agencies in turn often unknowingly issue tax refunds to the criminals.


Over the past two years, there has been a rise in the incidence of breaches of W-2 and associated payroll information. In 2016, the Office of the Attorney General received 566 data breach notifications, and in just the first six months of 2017, there have been 455 data breach notifications.


When a business becomes aware of a data breach, it should immediately contact local law enforcement. After determining the Virginia residents impacted by the breach, the business should notify the affected citizens and the Office of the Attorney General without unreasonable delay unless law enforcement says otherwise. More information for businesses on how to report data breaches can be found here.


The Office of the Attorney General urges victims of tax fraud and tax identity theft to report the incident to their employer, the IRS, the Virginia Department of Taxation, and their local police department. Virginians can visit the OAG website for extensive identity theft resources, including our ID Theft Guidebook for Victims, which discusses our ID Theft Passport program and provides tips and resources related to dealing with identity theft.