Why email is a security risk for W-9s
Every year, bookkeeping and accounting firms collect W-9 forms from vendors to prepare 1099s. The standard process: send an email asking for the W-9, wait for the vendor to reply with a PDF attachment, hope they don't include their Tax ID in the email body.
Here's the problem:
- Email is not encrypted at rest. Most email providers store messages in plain text on their servers. A Tax ID in an email body is a data breach waiting to happen.
- Shared inboxes multiply the risk. If your firm uses a shared inbox ([email protected]), every team member with access can see every Tax ID that's ever been emailed.
- Attachments get forwarded. A W-9 PDF forwarded "for reference" ends up in three more inboxes, none of which are secure.
- There's no audit trail. When someone accesses a W-9, there's no log. You have no idea who looked at what, when.
If you're storing Tax IDs in a Google Drive folder or a shared email inbox, you're one breach away from a compliance nightmare.
The encrypted form alternative
Instead of email, use a secure form with encrypted fields. Here's how it works with EasyRequests:
- Tax IDs are encrypted on submission. The moment a vendor enters their Tax ID, it's encrypted with AES-256-GCM — the same standard used by banks and government agencies.
- Masked display by default. In your dashboard, the Tax ID shows as •••••4567. You see enough to verify, but the full value isn't exposed.
- Reveal requires admin access. Only workspace owners and admins can click "Reveal" to see the full Tax ID. And every reveal is logged.
- Complete audit trail. Every access — who viewed what, when, from which IP — is logged automatically. Pull the access report anytime.
Step-by-step: Collecting W-9s with EasyRequests
Step 1: Create a workspace
Log in to EasyRequests and create a new workspace. Select the W-9 Collection template. This pre-populates the form with the fields you need: business name, DBA, contact information, Tax ID (encrypted), entity type, and W-9 file upload.
Step 2: Share the intake link
Every workspace gets a unique intake URL. Share it with your vendor via email, text, or your client portal. The vendor sees a professional, branded form — no login required.
Step 3: Vendor fills out the form
The vendor enters their business information and Tax ID. The Tax ID field is marked as sensitive — it's encrypted the moment they submit. They upload their W-9 PDF directly through the form. Files are stored securely on Cloudflare R2 with presigned URLs.
Step 4: Review with masked display
In your dashboard, the submission appears with the Tax ID masked: •••••4567. You can review the business name, entity type, and other details without exposing the sensitive data. Download the W-9 PDF with one click.
Step 5: Reveal with audit trail
When you need the full Tax ID — for 1099 preparation, for example — click "Reveal." The full value is displayed temporarily. The action is logged with your identity, timestamp, and IP address. The audit trail is permanent and downloadable.
Compliance benefits
Using encrypted forms for W-9 collection gives your firm several compliance advantages:
- Data minimization. Sensitive data is encrypted at rest and only revealed when necessary — a best practice for handling taxpayer information securely.
- Access control. Only authorized team members can reveal Tax IDs. No more shared Drive folders where everyone can see everything.
- Audit readiness. If a client or regulator asks who accessed their Tax ID and when, you can pull the answer in seconds. Every reveal is logged.
- Reduced exposure. In the unlikely event of a data breach, encrypted Tax IDs are significantly harder for attackers to exploit. AES-256-GCM encryption adds a strong layer of protection — though firms should still follow applicable state breach notification laws.
Get started
The Free plan includes everything you need to start collecting W-9s securely: 1 workspace, encrypted fields, masked display, and audit trail. No credit card required.
Start collecting W-9s securely — set up in under 5 minutes.
EasyRequests is a secure data collection tool, not a tax compliance or TIN validation service. Consult your tax advisor for 1099 filing requirements.