To securely send a W-9, verify who is asking, then deliver the form through a channel that encrypts your Taxpayer Identification Number end to end: a secure upload portal, a password-protected PDF with the password shared through a separate channel, certified mail in a security-tinted envelope, or an IRS-designated private delivery service. What you should not do is attach the form to an ordinary email. The IRS itself warns against putting your SSN, TIN, or full name in unencrypted email,1Internal Revenue Service. Sending and Receiving Emails Securely and that is the mistake most people make.
Verify the Requester Before You Send Anything
The single most important step happens before the form leaves your hands. Confirm the person asking is who they say they are. Call the requesting organization at a number you find independently — from the company’s official website or a state business registry — not one printed in the email or text that prompted the request. Ask which person is handling the document, why they need it, and exactly where to send it.
Legitimate requesters can name the information return they need to file. Federal law requires payors to collect your TIN so they can report payments to the IRS on returns like the 1099.2Office of the Law Revision Counsel. 26 USC 6109 – Identifying Numbers The most common situations, per the IRS requester instructions, are a company paying you as an independent contractor, a bank or brokerage opening an account, a business making real estate or royalty payments, and partnerships collecting a partner’s TIN for withholding.3Internal Revenue Service. Instructions for the Requester of Form W-9 A request that fits none of these contexts, or that arrives from an address you don’t recognize, deserves scrutiny before anything else.
Once you’ve confirmed the request, get the exact destination in writing: a secure portal URL, a verified mailing address, or a specific fax number.
Why Regular Email Is the Wrong Channel
Standard email is not encrypted. Attaching an unprotected PDF of your W-9 to a normal message is essentially a postcard carrying your Social Security Number across whatever servers happen to sit between you and the recipient. Anyone who intercepts the message, compromises either mailbox, or accesses a server backup can read it. The IRS makes this explicit in its guidance on secure email.1Internal Revenue Service. Sending and Receiving Emails Securely
The workaround is straightforward: either encrypt the file before it enters email, or bypass email entirely.
Password-Protect the PDF and Share the Password Separately
Most PDF software lets you apply AES 256-bit encryption and set a password before saving. Encrypt the completed W-9, then send the file through email or a messaging platform and share the password through a completely different channel — a phone call is the usual choice.
Sending the file and the password through the same channel defeats the encryption. If your email account is compromised, an attacker who finds the attachment will find the password right next to it. Different channel, every time.
Secure Portals and Expiring-Link Services
Many businesses maintain a secure upload portal specifically for tax documents. These platforms encrypt data in transit and at rest. Two checks before you upload: make sure the URL matches the one the company gave you when you verified the request, and confirm the padlock icon in your browser’s address bar showing an active TLS connection.
If the requester doesn’t have a portal, encrypted file-sharing services that generate a unique download link are a solid alternative. Set the link to expire within 24 to 48 hours so the document doesn’t sit accessible on someone’s cloud drive indefinitely.
Fax, If the Recipient Supports It
The IRS allows electronic submission of W-9 forms, including by fax, provided the requester’s system meets certain security requirements.3Internal Revenue Service. Instructions for the Requester of Form W-9 If fax is the channel your recipient prefers, confirm the destination number during your verification call and send it directly. Avoid online fax services that route through a web-based inbox unless you know how the provider stores and protects the file.
Certified Mail for Physical Delivery
Paper is still a defensible option, and for some people it’s the most comfortable one. USPS Certified Mail assigns a tracking number to your envelope and creates an electronic delivery record. Adding a Return Receipt (Form 3811) gets you documented confirmation that a specific person at the destination signed for it.
Use a security-tinted envelope so the contents aren’t visible against a bright light, and seal it with reinforced tape. USPS pricing changes periodically, so check the current rate schedule before mailing. Certified Mail plus a return receipt typically runs under $15 for a standard envelope.
IRS-Designated Private Delivery Services
If you need faster delivery or prefer a private carrier, the IRS publishes a list of designated private delivery services that qualify for the “timely mailing as timely filing” rule. Approved options include specific tiers from FedEx (such as Priority Overnight and Standard Overnight), UPS (such as Next Day Air and 2nd Day Air), and DHL Express.4Internal Revenue Service. Private Delivery Services (PDS)
Not every service level from these carriers qualifies. A court has rejected a filing as untimely because the taxpayer chose a service tier that wasn’t specifically on the IRS list, even though the carrier itself was approved. Check the current list and pick the exact tier named on it.
Confirm Delivery and Keep a Copy
After sending, confirm the form arrived. Track Certified Mail through the USPS site and hold the Return Receipt when it comes back. For digital submissions, save the confirmation page, upload receipt, or delivery notification. If you sent an encrypted PDF, follow up with the recipient to make sure they opened it successfully.
Keep a copy of every W-9 you send along with its delivery confirmation. The IRS generally requires taxpayers to retain records supporting their returns for three years from the filing date, though payors may need W-9 documentation for longer. Your copy protects you if a payor later claims they never received your TIN or if the IRS questions whether you complied with a reporting obligation.
Spotting a Fraudulent W-9 Request
Secure transmission only helps if you’re sending to the right person. Fraudulent W-9 requests are a common identity theft vector, and the pattern is consistent. Watch for messages from someone you’ve never worked with, artificial urgency (“we need this within the hour or your payment will be canceled”), requests directing you to a personal email address rather than a company domain or portal, and any pressure to skip the verification call. Legitimate businesses don’t push you past those steps.
If a request fits any of those patterns, stop. Confirm through an independent channel before you send anything, and treat the original message as suspect until you can prove otherwise.