Send your W-9 without exposing your SSN
A signed W-9 has everything an identity thief wants: your full name, your address and your Social Security or employer number. Here's how to check that a request is genuine, which ways of sending it are safer than a plain email, how to share less in the first place, and what to do if it went to the wrong person.
Have a plan already? Sign in
Open the W-9, W-4, W-8BEN or direct deposit form you were sent, type into its fields and add your signature — the PDF and the SSN or bank details on it stay in this browser.
Loading editor...
Updated 28 September 2026 · Written by Joe Farwick, who runs this site
Who can legitimately ask for your W-9
A W-9 is requested by a business that has to report payments to you to the IRS — usually on a Form 1099. Typical examples are clients you invoice as a freelancer or contractor, platforms that pay you, and banks or brokers opening an account for you. Section 6109 of the tax code requires you to give your correct number to people who must file those returns.
If a request arrives by email, check it through a channel you already trust: call the company on a number from its website or your contract, not one from the email, and ask whether they sent it. A real requester will happily confirm; a scammer will push you to reply quickly instead.
Safer ways to send a W-9
Best: the requester's own secure portal or vendor onboarding system. Many companies collect W-9s this way, and the file never sits in anyone's inbox.
Good: a password-protected PDF. Most PDF apps can add an open password when you save or export; send the password separately — by text message or phone — never in the same email as the file.
Also fine: an encrypted email service, a secure file-sharing link that expires, a fax to a number you've checked, or handing over a printed copy in person. Plain, unencrypted email is the weakest option — if that's all the requester accepts, at least confirm the address first and don't copy anyone else in.
Why plain email is the weak spot
Ordinary email usually isn't encrypted end to end. A W-9 attachment ends up stored in your sent folder, the requester's inbox, often a shared accounts-payable mailbox, and every backup of those — and it stays there for years. A single compromised mailbox on either side exposes it.
Misdirected mail is the other risk: autocomplete picks the wrong contact, or a reply goes to a spoofed address. Before you press send, check the recipient once more against an address you already know.
Share less: use an EIN instead of your SSN
If you're a sole proprietor or freelancer, you can get an employer identification number (EIN) from the IRS and put it on your W-9 instead of your Social Security number. The IRS issues EINs online and states that you never have to pay a fee for one. With an EIN on the form, clients never see your SSN.
Two caveats. The W-9 instructions say the IRS encourages sole proprietors to use their SSN, though an EIN is allowed. And line 1 must match the record the number belongs to — for a sole proprietor's EIN, that's still your own name.
Why signing the file on your own device matters
Many free online PDF signers upload your document to their servers to process it. For a W-9, that means one more company holding a copy of your SSN. Here, the PDF is opened, filled and signed in your browser; the file isn't sent to this site, so the only copy that leaves your device is the one you send to the requester.
Afterwards, delete stray copies from your downloads folder and shared drives, and keep one copy somewhere safe in case the requester asks again.
If you already sent it to a scammer
Act the same day. Report the identity theft and get a recovery plan at IdentityTheft.gov, the FTC's official site. Place a credit freeze with each of the three nationwide credit bureaus — the FTC notes that freezes are free — so nobody can open new credit in your name.
Then protect your tax account. The IRS offers an Identity Protection PIN, a six-digit number that stops anyone else from filing a return with your SSN or ITIN; anyone who can verify their identity can request one, most quickly through an IRS online account. For people at risk but not yet affected, the W-9 instructions point to the IRS Identity Theft Hotline at 800-908-4490 or Form 14039; if the IRS has already sent you a notice about your return, respond to the contact printed on that notice. Forward phishing emails that pretend to be from the IRS to phishing@irs.gov.
Sources
- IRS — Form W-9 (Rev. March 2024): identity theft, phishing and Privacy Act notice
- IRS — Instructions for the Requester of Form W-9 (electronic submission, fax)
- IRS — Get an employer identification number
- IRS — Get an Identity Protection PIN
- FTC — IdentityTheft.gov
- FTC — What to know about credit freezes and fraud alerts
A safer W-9 in three steps
Signing here keeps the file on your device — only the requester ever gets it.
- 1
Check who's asking
Only send a W-9 to a business that is actually paying you or opening an account for you.
- 2
Sign it on this device
Fill in and sign the PDF above — nothing is uploaded.
- 3
Send it the safe way
Use the requester's secure portal, or protect the PDF with a password you share separately.
Sending a W-9
What happens if I don't send a W-9 at all?+
The payer may have to start backup withholding — keeping 24% of your payments and sending it to the IRS — until you give them a correct taxpayer identification number.
Can I fax a W-9?+
If the requester accepts faxes, yes; the IRS even lists fax as a form of electronic submission. It avoids email, but make sure the fax number really belongs to them.
What may the requester do with my number?+
Use it for the tax reporting it was collected for. The form warns that a requester who discloses or uses TINs in violation of federal law may face civil and criminal penalties.
Does signing here cost anything?+
Filling in and signing is free to try, and nothing is uploaded at any point. To download the signed W-9 you need a plan: €2.99 a month or €24.99 a year. You can cancel anytime; access continues until the end of the period you paid for.
Signs a W-9 request is a scam
It claims to be from the IRS
The IRS doesn't collect W-9s, and it says it doesn't start contact with taxpayers by email.
You don't do business with them
No work, no account, no payment coming — no reason for them to have your tax number.
Urgency and threats
“Reply today or your account will be closed” is a pressure tactic. Real payers give you time.
It asks for more than the form
A W-9 never needs your bank password, a PIN, your mother's maiden name or a photo of your ID.
A look-alike sender
The address is one letter off, or a free webmail account claims to be a large company.
A link to “fill in your W-9 online”
If you didn't expect it, go to the payer's site yourself instead of clicking.
Sign your W-9 without uploading it
Open the form above — your SSN never leaves this device.
Choose the W-9