Officials say thieves are stealing tax info and selling it on the dark web

Brigham Gonzalez recently changed jobs and moved on his own. Everything was great, until he woke up to a shocking call from his sister.

"She had received a letter from my previous employer stating that all of their W2's had been stolen," said Gonzalez.

Or at least the W2 information-- Gonzalez called the company, which verified the news.

"Somebody pretending to be upper level management just kind of bluffed their way into getting one of the employees to fax over all of the W2's."

This is not an isolated case-- Caleb Barlow, a security expert for IBM, said sometimes it is phone calls, sometimes email scams, but W2's are being stolen and sold on the part of the internet hidden from search engines. It's known as "the dark web."

"One of the first things that we have to recognize when we go into the dark web is, it's kind of a, "Don't do this at home."

Barlow took us into the cyber underground to marketplaces where vendors are selling stolen 2016 W2's in bulk for around $35 to $40.

"Now here's an example of a site that's selling W2 tax forms along with a date of birth and you notice it says AGI. Now, an AGI stands for adjusted gross income."

The IRS requires adjusted gross income to file a return. In addition to filing a fraudulent tax return on your behalf, the documents can be used to establish credit, and steal your identity.

The IRS said so far, it has stopped 1.4 million confirmed identity theft tax returns, totaling $8-billion.

"Now, of course, the best protection is, ultimately, prevention," said Barlow.

If your information is compromised: notify the Federal Trade Commission along with credit reporting bureaus. And be sure to call your financial institutions to fill out all appropriate IRS forms.

No one filed a fraudulent tax return on Gonzalez, which helped him breathe a little easier.

"Long term, I know that all of my information's still out there and anybody could decide to use it against me."

Gonzalez said his company did provide him with a year's worth of free credit monitoring. He said he does not blame the employees who fell victim to the scam, but would like to see companies put verification policies in place to prevent information from being passed so easily.