In July 2019, the IRS finalized, with no substantive changes, a rule originally proposed in 2017 that allows employers to mask employee Social Security numbers or tax identification numbers on certain copies of the Form W-2. This change is being made to mitigate the risk of identity theft, which affects millions of Americans every year. Let’s review some of the key details of the new rule.
When does it take effect?
Employers may begin truncating SSNs on employee W-2s issued after Dec. 31, 2020.
How is the truncation implemented?
For nine-digit SSNs and TINs, the first five numbers may be represented as asterisks or Xs. For example, 123-45-6789 would become either ***-**-6789 or XXX-XX-6789.
Will employers be required to truncate SSNs and TINs?
No. Employers may opt to mask SSNs and TINs or leave them in their original form, as before.
Which copies of the Form W-2 does the new rule apply to?
Employers may mask SSNs and TINs only on copies of the Form W-2 that are distributed to employees. W-2s submitted to the IRS or to the Social Security Administration may not contain truncated SSNs or TINs, since those agencies require the full number for accurate recordkeeping.
Wasn’t SSN/TIN truncation already allowed by the IRS?
Yes, but only for other forms. As this IRS guide page explains, SSNs and TINs (along with employer identification numbers and adoption TINs) can be masked using the asterisk or X method described above on the following forms:
- Form 1095-C.
- Form 1098 series, except Form 1098-C.
- Form 1099 series.
- Form 5498 series.
- Substitute and composite substitute statements.
As with the upcoming W-2 change, truncation on any of these forms may only be done on paper or electronic copies sent to the payee. It also can’t be performed on copies sent to the IRS or to state or local government.
What is the rationale for this change?
Identity theft, mostly. According to cybersecurity vendor Proofpoint, one in three Americans has experienced identity theft, which is higher than the global average. Removing full SSNs and TINs from W-2s eliminates one of the possible means by which someone might steal such personally identifiable information and use it to impersonate the victim online or in another forum.