Where to send a completed W-9
To the person or business that asked for it, and nowhere else. The form says so on its own face: Give form to the requester. Do not send to the IRS.
There is no IRS address for Form W-9 and no IRS process that receives one. A W-9 posted to a service center achieves nothing: the payer still has no TIN, backup withholding still applies, and you have put your Social Security number in the mail for no reason. The instruction is printed at the top right of the form.
Who the requester is
| Who asked | Where to send it |
|---|---|
| A client hiring you as a contractor | Their accounts payable team or the person who requested it |
| A large company with a vendor portal | Upload it to the portal. This is usually the most secure route |
| A bank or brokerage | Through their secure message center, or in person at a branch. Do not use email |
| A property manager | Their owner portal, or their office |
| A platform or marketplace | Complete the tax information step in your account settings |
| A closing agent or title company | The closing package, at or before settlement |
| A law firm handling a settlement | Their secure file transfer, or in person at signing |
| An insurer settling a claim | The claims contact handling your file |
The payer keeps the form and uses the information to prepare Forms 1099. Nothing goes to a government agency. No central registry exists either, so there is no "W-9 lookup" and every payer has to hold its own copy.
Verify the request before you send anything
A completed W-9 contains a full legal name, an address, and a Social Security number: everything needed to open credit in your name. Fraudulent W-9 requests are a standard phishing technique, and they cluster around January, when genuine requests are flying around and nobody looks twice at one more. The request will look plausible. It will name a company you have heard of, it will come from someone with a job title, and it will often arrive with a deadline attached. Five checks take a minute between them and cost you nothing when the request turns out to be real.
Is there a payment relationship?
A W-9 request only makes sense from somebody who is paying you or is about to. If you have never heard of the company, that is the end of the inquiry.
Check the sender address properly
Read the full domain rather than the display name. Lookalike domains are the usual trick: an extra letter, a hyphen, a different suffix.
Reply through a channel you found yourself
Do not reply to the email. Call the company on a number from their website or your contract and confirm the request with a person you know.
Be alert to urgency and threats
"Send within 24 hours or payment will be withheld" is something a real client might genuinely say, so a fraudster gets to borrow the pressure for free. Verify anyway.
Never send it via a link in the email
If a portal is involved, navigate to the portal yourself.
A request from a company that has never paid you. A free-mail address rather than a corporate domain. A form that asks for a bank account number or a copy of your driver’s license, which a real W-9 never does. A demand to email it as a plain attachment when the company has a portal. Any request arriving alongside a change of banking information.
The best channels, in order
- 1. The requester’s secure portal or e-signature system: purpose-built, encrypted, logged.
- 2. An encrypted file transfer service, with the password shared separately.
- 3. A password-protected PDF or ZIP, emailed, with the password sent by text or phone.
- 4. Physical handover or mail, which is slow but keeps the number off the internet.
- 5. Fax, if the recipient still uses one and the machine is not shared.
Plain email attachment is last on the list and the most common. It leaves your SSN in your sent folder and their inbox, backed up and indexed, essentially forever. Full guidance on secure delivery
Keep a record of who holds it
Maintain a simple list: who you sent a W-9 to, on what date, and which TIN you used. A spreadsheet is plenty. It takes seconds per entry and gives you three things worth having in February. You can tell immediately whether an arriving 1099 was expected. You have evidence of exactly what you submitted when a form comes back with the wrong name on it. And you have the list of people to notify the day your name, entity or TIN changes, which is otherwise reconstructed from memory at the worst possible moment.
Frequently asked questions
Do I send my W-9 to the IRS?
No, never. The form is given to the requester, who keeps it on file. There is no IRS address for it and the IRS does not want a copy.
Who exactly should receive it?
The business or person that asked for it, which in practice means their accounts payable team, their vendor onboarding portal, or the contact who requested it. Send it back through the channel they specified.
What if a stranger asks for my W-9?
Treat it as a phishing attempt until you can verify a payment relationship. A completed W-9 contains everything needed for identity theft. Contact the company through a number you look up independently.
Should I send a W-9 to every client proactively?
No. Send it when asked, or when you know a payer needs it. Circulating your SSN unnecessarily increases exposure for no benefit.
General information, not tax advice. This page explains a federal tax form in plain English. It is not legal, tax, or accounting advice, and W9Form.org is not affiliated with the IRS. Verify everything against the official Form W-9 page on IRS.gov and speak to a licensed professional about your own situation. How we source and review these pages.