11 Vendor W-9 Request Red Flags That Signal a Scam

On Oct 18, 2026

A request for a W-9 is one of the most ordinary things in business, so ordinary that most people fill one out and send it back without a second thought. That is precisely why scammers love it. Behind a routine-looking W-9 request can sit an attempt to harvest your taxpayer ID for identity theft, or to slip in new banking details and reroute your payments to a criminal. The single most useful fact to remember is that a real W-9 never asks for your bank account. Here are eleven red flags that a W-9 request is really a grab for your money or your identity.

None of this means you should refuse every W-9, since legitimate ones are a normal part of getting paid. It means you should read the request the way you would any message asking for sensitive information: slowly, and with a healthy suspicion. Most of the flags below take only a moment to check, and any one of them is reason enough to stop and verify before you send anything.

The Short Version

The biggest red flag is a W-9 request that also asks for your bank account or routing number, because a genuine W-9 only collects your name, address, and taxpayer ID, never banking details. Watch too for a bundled “banking update” for the requester, an unsolicited request from a company you do not work with, a free or lookalike email domain, a mismatched reply-to address, an unfamiliar portal or link, demands for more than a W-9 needs, high-pressure urgency, instructions to skip your usual verification, sloppy generic messaging, and requests to send sensitive data through insecure channels. When in doubt, verify through a known contact before responding.

Table of Contents

Why a W-9 request is a favorite scam hook

A W-9 is a legitimate IRS form a business uses to collect a vendor’s taxpayer information so it can issue a 1099, and because the request is so routine, it rarely raises alarm, which is exactly what fraudsters count on. There are two games at play. One is identity theft, where the goal is to harvest your business’s or your personal taxpayer ID and details to open credit or file fraudulent returns. The other is payment fraud, where a “vendor” or “client” uses the W-9 exchange as cover to introduce new banking details and reroute real payments to themselves, a scheme known as business email compromise. The defense starts with knowing what a real W-9 actually collects, which, as the IRS explains, is your name, address, and taxpayer identification number, and never your bank account or a login.

This is general information, not tax, legal, or security advice. When a request feels off, verify it through a phone number or contact you already trust, not the details in the message, and report suspected fraud to the IRS and the FBI’s Internet Crime Complaint Center. Consult your accountant or IT professional for your specific situation.

The 11 red flags

It asks for your bank account or routing number. This is the clearest tell, because a real W-9 collects only your taxpayer ID and contact details. Any form or email that pairs a W-9 with a request for your banking information is not tax paperwork, it is a payment grab, so stop right there.
It bundles a banking update for the requester. Be just as wary if the message asks you to note the sender’s new bank details for future payments. Slipping a payment-redirect into a routine W-9 exchange is a classic business email compromise move, designed to send your next check to a criminal.
It arrives unsolicited from a company you do not work with. A W-9 request should come from a client or platform you actually do business with and expect to be paid by. An out-of-the-blue request from an unfamiliar company, or one you never onboarded with, is a strong sign someone is fishing for your information.
It comes from a free or lookalike email domain. Check the sender’s address closely. A supposed vendor writing from a generic free email account, or from a domain that is a subtle misspelling of the real company’s, is impersonating a business rather than representing one.
The reply-to or display name does not match. Look past the friendly display name to the actual address, and notice if replies would go somewhere different from the sender. Spoofed display names and mismatched reply-to addresses are engineered to make a scam message look like it came from someone you trust.
It routes you to an unfamiliar portal or link. Be cautious if you are told to “complete your W-9” on a website or link you do not recognize. A standard W-9 is a simple IRS form you can fill in and return directly, so an unexpected portal is often a phishing page built to capture your details.
It demands more than a W-9 needs. Watch for requests that go beyond the form, such as your full Social Security number when your business EIN would do, copies of your ID, or, worst of all, login credentials. A real W-9 does not require any of that, so extra demands signal a data grab.
It pressures you with urgency. Threats that you will not be paid unless you send the form immediately are a manipulation tactic. Real payers can wait for you to verify a request, and the artificial rush is meant to push you past the moment where you would otherwise stop and check.
It tells you to skip your normal verification. Be suspicious of any message that discourages you from calling to confirm, insisting you simply email the form back. Legitimate business partners have no problem with you verifying through a known number, and only a scammer benefits from you skipping that step.
It is generic and sloppy. Watch for a vague “Dear Vendor” greeting, obvious typos, or the wrong name for your business or the requester’s. Mass-sent phishing messages are rarely polished, and details that do not quite fit are a sign the sender does not actually know who you are.
It asks you to send it through an insecure channel. Be wary if you are told to send your completed W-9 as a plain email to a personal address, or by text or messaging app. Because the form carries your taxpayer ID, a legitimate partner will use a secure method, so an insistence on a risky channel is itself a warning.

What to do when a W-9 request looks off

When something does not sit right, slow down and verify before you send a thing. Confirm the request by contacting the company through a phone number or email you already have on file, never the contact details in the suspicious message, and ask whether they really requested your W-9. Send a completed W-9 only through a secure method, and remember it should contain your taxpayer ID and address, not your bank account. If a message tries to change where your payments go, treat that as a separate, high-risk request and verify the new banking details by phone with a known contact before anything is paid. And if you conclude it is a scam, do not reply or click, but report it to the IRS and the FBI’s Internet Crime Complaint Center, and warn your accounting team so no one else falls for it.

Main Takeaways

A real W-9 collects only your name, address, and taxpayer ID, so any request for your bank account is a red flag.
A bundled request to update the sender’s banking details is a payment-redirect scam known as business email compromise.
Check the sender’s domain and reply-to address, and be wary of unsolicited requests, unfamiliar portals, and demands for extra sensitive data.
Urgency and pressure to skip verification are manipulation tactics, not signs of a real payer.
Verify any suspicious request through a known contact, send W-9s securely, and report scams to the IRS and the FBI.

For more small-business and fraud-prevention guides, browse the DelightfulBlogs Business section, or see our guide to invoice “pay now” scams targeting freelancers.

Frequently Asked Questions

Does a W-9 ask for bank account information?

No. A legitimate W-9 collects only your name, business name if any, address, and taxpayer identification number, either your Social Security number or EIN. It never asks for your bank account, routing number, or online banking login. So if a W-9 request also wants your banking details, it is not a real tax form, it is an attempt to grab your payment information.

How do I verify a legitimate W-9 request?

Contact the company that supposedly sent it using a phone number or email you already have on file, not the contact details in the message, and confirm they actually requested your W-9. Legitimate clients expect this and will not object. Once verified, return the form through a secure method rather than a plain email to a personal address.

What is business email compromise, and how does it use W-9s?

Business email compromise is a scam where a criminal poses as a vendor, client, or executive to trick a business into sending money or data. A W-9 exchange makes handy cover, because it looks routine, letting the scammer slip in a request to “update” banking details and reroute real payments to their own account. Always verify banking changes by phone with a known contact.

Is it safe to email a completed W-9?

Only through a secure method and to a verified recipient. Because a W-9 contains your taxpayer ID, sending it as a plain, unencrypted email, especially to a personal address, exposes sensitive information. Use a secure file-sharing or encrypted option offered by a client you have confirmed is legitimate, and never send it to an address or channel that feels unusual or was pushed on you under pressure.

What should I do if I already sent my information to a scammer?

Act quickly. If you shared banking details, contact your bank right away, and if you gave up your Social Security number or EIN, consider a fraud alert or credit freeze and monitor for misuse. Report the incident to the IRS and the FBI’s Internet Crime Complaint Center, and alert anyone on your team who handles payments so the scammer cannot use the access again.

The Bottom Line

The W-9 is such a familiar form that a request for one slides right past most people’s defenses, which is the whole reason scammers use it. Anchor yourself to one fact: a real W-9 asks for your name, address, and taxpayer ID, and nothing about your bank account. Measure every request against that, watch for the domain tricks, the urgency, and the pressure to skip verification, and confirm anything that feels off through a contact you already trust. A minute of checking protects both your identity and the payments you have earned.