Sending a W-9 through ordinary, unencrypted email is not safe. The form carries your Social Security number or EIN, and a plain email exposes that number at every server it passes through and every inbox it lands in. The IRS does permit electronic delivery of Form W-9, but only through systems that authenticate the sender, protect the data in transit and at rest, and capture a signature under penalty of perjury.1Internal Revenue Service. Instructions for the Requester of Form W-9 (Rev. March 2024) A Gmail attachment does not clear that bar. Below is what actually goes wrong with plain email, the methods that do protect the form, and what to do if you have already sent one.
Why Plain Email Puts Your SSN at Risk
Email moves through a protocol called SMTP, which works like a relay. Your message hops through several intermediate servers before reaching the recipient, and a copy sits on each server’s hard drive along the way. Even after the recipient deletes the message, fragments can remain in caches, backups, and archived logs. Your tax ID does not simply travel from you to your client. It gets copied at every stop.
Most major providers now encrypt email in transit using Transport Layer Security.2Google. Email Encryption in Transit TLS protects the message only while it is moving between servers. Once it lands, the encryption stops. A server breach, a compromised account, or a careless forward can expose your SSN to people who were never meant to see it.
The file itself carries risk too. A Word document or fillable PDF holds hidden metadata: the author’s name, the software used, creation and modification dates, and sometimes tracked changes. Anyone who receives the file can read that information without special tools.
Safer Ways to Send a W-9
The IRS allows businesses to accept W-9s electronically when the system verifies identity, keeps the data unaltered in transit, and captures an electronic signature.3Internal Revenue Service. Announcement 98-27 That description fits a purpose-built portal, not an email attachment. A few options actually protect the form:
- Password-protected PDF. Most PDF software can lock a file with AES 256-bit encryption. The step people skip is sending the password through a different channel. If the PDF and the password sit in the same email, anyone who intercepts one gets both. Text or call the password instead, and use at least 12 characters mixing letters, numbers, and symbols.4Adobe. Password Protect PDF and Encrypt a PDF for Free
- Secure client portal. Accounting firms, payroll companies, and larger businesses often host an upload portal that keeps your W-9 behind a firewall. You log in, upload the form, and it never travels as an open attachment. Look for portals that require multi-factor authentication.
- Secure file transfer (SFTP). SFTP creates an encrypted tunnel between your computer and the recipient’s server using SSH. The file is encrypted in transit and is not left on intermediate servers. It shows up more often in business-to-business setups than in individual contractor work.
- Certified mail. The U.S. Postal Service’s Certified Mail service provides tracking and electronic delivery confirmation. Slower than email, but no digital copy sits on any server.5PostalPro. Certified Mail Guidebook
A note on fax. A traditional analog fax runs over phone lines with no internet servers in the path, but most “fax” today is actually fax-over-IP, which routes through the internet the same way email does. Unless you know both machines are analog and on landlines, do not assume fax is safer than email.
Use an EIN So Your SSN Never Leaves Your Desk
If you are a sole proprietor or freelancer who fills out W-9s regularly, there is a structural fix that reduces your exposure no matter how the form travels. Sole proprietors with an Employer Identification Number can use that EIN on the W-9 instead of their Social Security number.6Internal Revenue Service. Form W-9 (Rev. March 2024) An EIN is tied to your business activity, not your personal credit file, so a leaked EIN is far less damaging than a leaked SSN.
Applying is free and takes about five minutes through the IRS online application. You need a valid SSN or ITIN to apply, and your principal place of business must be in the United States.7Internal Revenue Service. Instructions for Form SS-4 You receive the EIN at the end of the session. From then on, enter it in Part I of the W-9 and stop handing your SSN to clients.
This does not help W-2 employees, who must use their SSN. It also does not undo any SSN you have already shared. Going forward, though, it is the single most effective privacy step a contractor can take.
Make Sure the W-9 Request Is Real
A fake W-9 request is a common phishing tactic because people expect to fill one out when starting contract work. The IRS warns that scammers pressure people for personal and financial information, sometimes impersonating businesses or the IRS itself.8Internal Revenue Service. Recognize Tax Scams and Fraud Before you send anything, check a few things:
- Did you initiate the relationship? A W-9 request makes sense after you have agreed to do work. An unsolicited email asking for your SSN “to process a payment” is a red flag.
- Can you verify the sender? Do not rely on the email address alone. Call the company using a number you find from their official website or a business directory, and confirm the request.
- Is the form legitimate? Download a fresh copy of Form W-9 from irs.gov and fill that out. A modified form could route your data somewhere else.
- Are they rushing you? Urgency is a scam hallmark. A legitimate business will give you reasonable time.
The IRS itself will never email you to ask for a completed W-9 or any personal tax information. An email that claims otherwise is a scam.
What Happens If You Refuse to Send One
Skipping the W-9 does not make the problem disappear. When a business pays you without a correct taxpayer identification number, the IRS requires them to withhold 24% of your payments as backup withholding and send that money to the IRS.9Internal Revenue Service. 2026 Publication 15 You get credit for it on your return, but in the meantime you lose nearly a quarter of every check. Payments subject to backup withholding include nonemployee compensation, interest, dividends, rents, royalties, and broker proceeds.10Internal Revenue Service. Backup Withholding for Missing and Incorrect Name/TINs Sending the form through a secure method is a better answer than refusing to send it at all.
If You Already Emailed a W-9 in Plain Text
You cannot un-send the email, but you can make a stolen SSN much harder to exploit.
- Get an IRS Identity Protection PIN. An IP PIN is a six-digit number that blocks anyone from filing a federal tax return under your SSN without it. Anyone with an SSN or ITIN can enroll through their IRS online account; the PIN changes annually and is available from mid-January through mid-November. This is the strongest single defense against tax-refund fraud.11Internal Revenue Service. Get an Identity Protection PIN
- Freeze your credit. Federal law lets you place a free freeze at Equifax, Experian, and TransUnion. The bureau must activate a freeze within one business day and lift it within one hour when you request it online or by phone. A freeze blocks new accounts from being opened in your name.12Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
- File at IdentityTheft.gov. If you suspect your information has been misused, the FTC site walks you through a recovery plan with checklists and sample dispute letters.13Federal Trade Commission. Report Identity Theft
- Delete the email from both ends. Ask the recipient to delete the message and empty their trash, and do the same on your end. Server backups may still hold copies, but you have reduced the number of places the form sits in plain text.
If you are a sole proprietor, apply for an EIN now so future W-9s use that number instead.
Why Federal Law Only Partly Protects You
Several federal statutes protect tax data, but they do not all bind the same people, and the coverage is narrower than it looks. IRC ยง 6103 makes tax returns and return information confidential and prohibits disclosure outside specific exceptions.14Office of the Law Revision Counsel. 26 U.S. Code 6103 – Confidentiality and Disclosure of Returns and Return Information That statute binds government officers, government employees, and people who receive tax data from the government. It does not directly govern a private business that receives your W-9. Willful unauthorized disclosure by someone covered under section 6103 is a felony punishable by up to $5,000 and five years in prison.15Office of the Law Revision Counsel. 26 U.S. Code 7213 – Unauthorized Disclosure of Information Those penalties reach government employees and their contractors, not the marketing agency that left your form in an open inbox.
The Privacy Act of 1974 works the same way: it applies to federal agencies and their contractors, not private companies.16Office of the Law Revision Counsel. 5 U.S. Code 552a – Records Maintained on Individuals The Gramm-Leach-Bliley Act and the FTC Safeguards Rule require security programs at banks, lenders, and investment firms, but not at every business that hires a contractor.
Federal law heavily protects tax data while the government holds it, and offers thinner protection once a private company has your SSN on a W-9. That is why how you send the form, and whether you can send an EIN instead, matters more than the statute book.