A W-9 form is a U.S. tax document used to collect a person or company’s legal name, tax classification, and taxpayer identification number. It is commonly shared during vendor onboarding, contractor payments, and other business workflows, so it often sits alongside invoices, bank details, and HR records.
In cyber security, W-9 forms matter because they combine identity and payment-related data that can be abused for fraud, phishing, tax scams, or business email compromise. Attackers may search for W-9 files in document repositories, shared drives, or email archives because the forms help identify suppliers and impersonate payment relationships. Defenders should restrict access, encrypt stored copies, monitor downloads, and treat exposed W-9s as sensitive records that may require notification and fraud monitoring.