IRS to Permit Truncated Social Security Numbers on W-2s to Fight ID Theft

To help protect people from identity theft, the Internal Revenue Service has issued a final rule that will allow employers to shorten Social Security numbers (SSNs) or alternative taxpayer identification numbers (TINs) on Form W-2 wage and tax statements that are distributed to employees, beginning in 2021.

The IRS published the new rule in the Federal Register on July 3. It finalizes a proposed rule issued in September 2017 with no substantive changes.

Under the regulation, SSNs or other TINs can be masked with the first five digits of the nine-digit number replaced with asterisks or XXXs in the following formats:

• ***-**-1234.
  
• XXX-XX-1234.
  

"From a security standpoint, this will provide a greater degree of protection to employees," said Mike Trabold, director of compliance at payroll administration firm Paychex.

To ensure that accurate wage information is reported to the IRS and the Social Security Administration (SSA), the rule does not permit truncated TINs on W-2 forms sent to those agencies. The IRS said that instructions to W-2 forms will be updated to reflect these regulations and explained that masking the numbers on employees' forms is not mandatory.

The IRS already allows employers to use truncated TINs on employees' Form 1095-C for Affordable Care Act reporting and on certain other tax-related statements distributed to employees.

[SHRM members-only HR forms: W-2 Form Electronic Delivery Consent Notice]

Delayed Applicability Date

The IRS delayed the applicability date of the final rule to apply to W-2 forms that are required to be furnished to employees after Dec. 31, 2020, "so employers still have time to decide whether to implement the change," according to attorneys at Washington, D.C., law firm Covington & Burling. "The delayed effective date is intended to allow states and local governments time to update their rules to permit the use of truncated TINs, if they do not already do so," the attorneys wrote.

Employer Steps

"Employers must decide if they'll opt-in and have SSNs truncated, as truncation is not mandatory," Trabold said. "If so, employers will need to decide if they'll truncate for all their employee W-2s, or allow employees to make that decision for their own W-2," he added.

Employers should also confirm if their payroll software or payroll provider can accommodate truncation, and determine if the states and localities where they operate also adopt truncation by 2020. "If not, an employer will need to be ready to support both truncated and non-truncated W-2 versions," Trabold said.

Commenters' Concerns

"Permitting employers to truncate Social Security numbers on Forms W-2 provided to employees will better protect individuals' sensitive personal information," the Minnesota Department of Revenue said in comments submitted to the IRS after the rule was proposed.

But another commenter feared that the change could hamper accurate reporting to government agencies. "Employees who already receive masked pay statements will have no means of ensuring that their SSN is entered (and subsequently reported to the SSA and IRS) correctly," the anonymous commenter said. "According to the SSA website, a SSN correction is a common error and even if an SSN is 'verified,' it could still be entered into payroll software incorrectly. The W2 provides a means for the employee to catch that mistake."

Comments also warned that truncated TINs on W-2 forms could make it difficult for tax return preparers to verify that the taxpayer has provided the correct SSN, among other concerns.

The IRS responded that the benefits of allowing employers to protect their employees from identity theft by truncating employees' SSNs (or alternative TINs) outweighed the risks of unintended consequences, and that many of the potential consequences noted by the commenters could be mitigated by using other methods to verify a taxpayer's identity and the accuracy of the taxpayers' information.

Some believe the new rule does not go far enough by making truncated Social Security numbers or other TINs an option rather than a requirement. "W-2 forms have been the target of several high-profile breaches, therefore [the IRS] should only permit truncated SSNs to protect employees from future breaches," according to the Electronic Privacy Information Center in Washington, D.C.

Related SHRM Articles:

IRS Issues Draft Form W-4 Overhaul for 2020, SHRM Online, June 2019

Former Employee Ghosted? Here's What to Do with a Returned Check or W-2, SHRM Online, February 2019

Beware of Form W-2 Phishing Scheme, Authorities Warn, SHRM Online, January 2018