How to send tax documents securely

Why tax documents need more care

A W-2, 1099, tax return or bank statement holds everything someone needs to steal an identity: your name, address, Social Security number, income and account numbers. Tax season is also when phishing peaks, so scammers know these files are moving around. The IRS asks tax professionals to protect client data and encrypt it in its guide Publication 4557, Safeguarding Taxpayer Data.

The risk with email isn't usually the moment you send it. It's that the attachment then lives, unencrypted, in your sent folder, the recipient's inbox, both email providers' servers and every backup, long after anyone needs it. If any of those accounts is broken into later, the file is still there.

How to send tax documents securely, step by step

1. Check who you're sending to. If the request came by email, confirm it by phone with someone you know. A “your accountant needs your W-2” email is a common scam.
2. Use an end-to-end encrypted link. With end-to-end encryption, the file is locked on your device before it's uploaded, and only the person with the link can unlock it. The service storing it can't read it. In ShareSecure this is on by default: the key is in the part of the link after #, which never reaches the server.
3. Add a passcode, and send it separately. If the link ends up somewhere it shouldn't, it's no use without the passcode. Text or say the passcode instead of putting it in the same email as the link.
4. Make it expire. Pick the shortest time that works, like a day or a week. When the link expires, ShareSecure erases the file.
5. Keep it view-only, or let it work once. If the recipient only needs to read the document, leave downloads off. For something that should be seen once, turn on Works once: the file is erased as soon as it's opened, and you're told if anyone tries the link again.
6. Several documents? Send them together. Drop a whole folder or several files in and they go as one link, with each document viewable on its own.
7. Know when it arrived. Turn on Tell me when it's opened to see when the link was opened, and whether it was on a new device, without anyone learning who opened it.

If you're the one collecting documents

Accountants, bookkeepers and anyone helping family with taxes spend a lot of time asking people to email sensitive files. Instead, send a file request link: anyone can upload through it without an account, their browser encrypts the files to your key, and only you can open them. You choose how many files it takes and how long it stays open.

After it's sent

• Delete the share once it's been received, rather than waiting for it to expire.
• Don't keep extra copies of the documents in your downloads or desktop folders.
• If you think a link was shared too widely, delete it: every link forwarded from it stops working too.

What no tool can do

Once someone can see a document, they can photograph or screenshot it. ShareSecure can put a watermark with the viewer's name and the time over the file, which makes a leak traceable, but no website can stop a camera. Only send tax documents to people you'd trust with them.