What do these scams look like?
Emails are typically sent to HR or accounting employees asking them to forward company W-2's to the sender. These "to" and "from" email addresses are legitimate email addresses, with accurate employee names - making it appear as an actual request.
What does the scammer do with the information?
Hackers obtain employee W-2 information to file fraudulent tax returns, seeking large refunds. Consequences of a successful scams are leaked data and possible employee class litigation.