How to send a W-9 securely
A signed W-9 pairs your full legal name and address with your Social Security number. That combination is exactly what identity theft runs on, and most people email it as a plain attachment.
Your legal name, your address, and your SSN or EIN, plus your signature. There is no scenario in which a leaked W-9 is harmless. Treat the file the way you would treat a photograph of your passport.
Channels ranked
The ranking below is really a ranking of how many copies of your Social Security number each method leaves behind, and for how long. A portal upload leaves one, held by the party that needs it. A plain email attachment leaves a copy in your sent folder, a copy in the recipient’s inbox, and a copy on each mail provider’s servers, all of it indexed and searchable, none of it under your control, and every one of those copies still sitting there in four years when somebody phishes an accounts payable clerk. Everything else is convenience, and convenience is worth something too, so if the real choice is between emailing the form today and stalling a paying client for a week over transport security, email it, then go get an EIN before the next request arrives.
| Method | Risk | Notes |
|---|---|---|
| The requester’s vendor portal | Lowest | Purpose-built, encrypted in transit and at rest, access-controlled and logged. Always the first choice when offered |
| A reputable e-signature service | Low | The requester sends a link, you complete and sign in the browser. Nothing lands in email. Validity |
| Encrypted file transfer with a separate password | Low | A one-time-download link, with the password given by phone or text |
| Password-protected PDF or ZIP by email | Moderate | Workable. The password has to travel by a different channel, and a follow-up email does not count as one |
| Physical delivery or mail | Moderate | Slow, but keeps the number off the internet entirely. Sensible for a single high-value transaction |
| Fax | Moderate | Acceptable to a dedicated machine. Internet fax services are simply email with extra steps |
| Plain email attachment | High | The most common and the weakest. Persists indefinitely in at least four places |
| Text message or chat app photo | High | Cloud photo backups, screenshots, forwarding. Avoid |
| A link somebody emailed you | Highest | The standard phishing pattern. Navigate to the portal yourself |
Reduce the exposure permanently
Get an EIN and use it instead of your SSN
The single most effective step for a sole proprietor. An EIN is free from the IRS and issued in minutes. Your own name still goes on Line 1, but Part I carries a number that is not your Social Security number. Detail
Send it once, to each payer, and keep a log
Record who has it and when you sent it. That log tells you whose breach affects you, and who to notify if you recertify.
Ask for the portal
Most companies of any size have one and simply default to email. "Do you have a secure upload for this?" gets a link more often than not.
Delete the working copy from shared places
Downloads folders, desktop, shared drives, and the email you sent it in. Keep one copy in a location you control.
Set up an IRS Identity Protection PIN
An IP PIN stops somebody else filing a return using your SSN. It is free and it is the single best defense against tax-related identity theft.
Verifying the request is genuine
- Start with the obvious question: if this company is not paying you, it has no legitimate reason to want your TIN.
- Read the full sending domain rather than the display name, because a lookalike domain is the standard trick and it works.
- Confirm by calling a number you looked up yourself.
- A W-9 asks for a name, an address, a classification and a TIN. Anything asking for a bank account number, a copy of your ID or a password is something else wearing the name.
- January is the dangerous month, when genuine requests arrive by the dozen and a fake one blends straight in.
- Treat any W-9 request that arrives bundled with a change of payment details as fraud until you have proved otherwise.
Who should receive your form, and who should not
If you are the one collecting them
A payer holding hundreds of W-9s holds hundreds of Social Security numbers, and the legal exposure for mishandling them is real. The form states it under Misuse of TINs: a requester that discloses or uses TINs in violation of federal law may be subject to civil and criminal penalties. Tighter duties under IRC 7216 and 6713 apply if your organization is also a tax return preparer, and state data-breach law applies either way. The practical failure is almost never dramatic. Forms arrive by email, get saved wherever the person who opened them happened to be working that afternoon, and then sit in a folder that forty people can read for as long as the company exists, until one day somebody exports the vendor master to a spreadsheet and mails it to a consultant. Six habits close most of that off.
- Collect through a portal or e-signature system, never by asking for email attachments.
- Encrypt at rest and restrict access to the people who actually need it.
- Never store W-9s in a shared drive folder with broad permissions, or in a ticketing system.
- Purge on a schedule once the retention period has passed. How to purge safely
- Mask TINs in any downstream report or export.
- Train the accounts payable team on phishing, because a fraudulent vendor W-9 with new banking information is a common attack.
Frequently asked questions
Is it safe to email a W-9?
A plain email attachment is the weakest common option. Email is generally not encrypted end to end, and the file persists in your sent folder, their inbox, and both mail providers backups. Prefer a portal or an encrypted transfer.
Can I send a W-9 without my full SSN?
Not if your TIN is your SSN. Part I has to be complete. The better answer is to obtain a free EIN and use that instead, keeping your own name on Line 1.
Is it safe to text a photo of a W-9?
Messaging apps push images into cloud backups and photo libraries, and a screenshot forwards in one tap. Use a portal.
What if a client insists on plain email?
Send a password-protected PDF and give the password by phone. If they refuse even that, weigh the relationship against the exposure, and consider using an EIN for that client going forward.
General information, not tax advice. This page explains a federal tax form in plain English. It is not legal, tax, or accounting advice, and W9Form.org is not affiliated with the IRS. Verify everything against the official Form W-9 page on IRS.gov and speak to a licensed professional about your own situation. How we source and review these pages.