TL;DR: A fake W-9 is a completed Request for Taxpayer Identification Number and Certification, either edited after the payee filled it in or generated as a finished form, offered as if the IRS had issued it. An April 6, 2026 FBI press release put 2025 losses on AI-related complaints at nearly $893 million. That is a broader fraud figure, not a rate for W-9s. An IRS seal, a watermark, or a CP 575 fails as a visual check, because the IRS publishes a blank and a typed form with no seal is what a real W-9 looks like.
What a Fake W-9 Actually Is
The payee fills in Form W-9. The IRS does not issue a completed one. About Form W-9, last reviewed on June 27, 2026, describes the use: a U.S. person gives the correct taxpayer identification number to someone who must file an information return. The form in the file is the payee's certification, not an IRS letter.
A valid W-9 carries the name and TIN, signed and dated under penalties of perjury. The instructions allow substitute forms and electronic submission, so a typed page can be a real W-9. A foreign person may not provide one. Backup withholding is 24 percent when the TIN is missing or incorrect. TIN Matching, for payors who can use it, checks whether the name and TIN match IRS records. None of that arrives as a seal.
The blank Form W-9 is what the IRS publishes. Line 1 is the name. The TIN is the taxpayer identification number the payee certifies. Looking for an IRS seal, a watermark, or a CP 575 treats the W-9 as a notice the IRS never sent. A CP 575 is an employer identification number assignment letter, a different document, covered in how to spot a fake EIN confirmation letter. A W-9 is not a W-2 either. A W-2 reports wages an employer paid. A W-9 certifies the TIN of a person who expects an information return.
The upload arrives in two production classes. Edited-after-creation starts from a real signed W-9, a prior year's form, or the IRS blank, then changes the name, the TIN, the classification, or the signature date. Generated-from-scratch fills every line, including a signature, so the page agrees with itself and never passed through the payee. FinCEN's September 9, 2024 analysis of check fraud tied to mail theft found that 44 percent of the checks were altered and then deposited, and 26 percent were used as templates for counterfeits. Those percentages describe checks. They illustrate the two classes, a genuine instrument changed after it existed and a new instrument built from a template, and they are not a rate for W-9s.
Tells That Still Work, and the Ones That Do Not
The name on line 1 and the TIN still work, for payors who can use TIN Matching. The combination either matches IRS records or it does not. A mismatch is a reason to withhold and a reason to hold the vendor file. A match means the IRS has that name with that number. It does not mean this PDF is the form that person signed, and it does not mean the applicant controls the entity.
An IRS seal fails. A watermark fails. A CP 575 fails. The IRS publishes a blank. A completed W-9 with no seal, no watermark, and no notice number is what the genuine article looks like. A form that looks too clean is not a finding.
The name on line 1 should be the payee on the information return, and for an entity it should match the legal name on the formation record. Standing is a different question, covered in how to spot a fake certificate of good standing. Tax classification should agree with the entity type in that record. A signature date after the payments already went out is a timeline problem. A recent date by itself is not.
How Detection Actually Works
The file's story is that this U.S. person completed a W-9, signed and dated it under penalties of perjury, and certified that the name on line 1 and the TIN belong together. Detection asks whether the bytes support that story.
Production method asks how the page was made. The IRS blank, a payee's filled PDF, a later edit, a photograph of a signed paper form, and a generative pipeline do not share a path. Edited-after-creation leaves a real certification under a later save, usually at the TIN or line 1. Generated-from-scratch has no payee submission underneath. The case note should name the class. A typed form is not, by itself, either class, because substitutes and electronic submission are allowed.
Timestamp trail asks whether creation and modification fit the signature date. A form signed in March and saved again in October can be a bookkeeper's copy. A signature dated last week on a file built months earlier around a different TIN reads as an edit. A scan's creation date reflects the scanner. The trail sits beside TIN Matching.
Issuer matching is easy to aim at the wrong office. The payee is the person who completes the form. The IRS publishes the blank and does not certify the finished page. A file that looks like an IRS notice, complete with a CP number, is not a W-9. For payors who can use TIN Matching, the name and TIN either match IRS records or they do not. Everyone else compares line 1 with the legal name on the formation documents and with the rest of the vendor file. A match on that name and TIN does not identify who signed.
Consistency checks classification, exemption claims, and signature block against line 1 and against the application. A generated form will obey the line 1 rules on its face. Model artifacts are certification prose, checkboxes, and signature images that do not come from the IRS blank or from a real pen. Recycled patterns are the same signed PDF, the same TIN, or the same signature image on an unrelated payee. One reviewer with one vendor will not see the third copy. The same edit-after-creation problem on other files is covered in document fraud in banking.
What to Do with a Suspect File
Hold the vendor setup. Do not hunt for an IRS seal. Read line 1, the TIN, the classification, and the signature and date. If the payor can use TIN Matching, submit that name and TIN. A mismatch supports backup withholding at 24 percent and supports a hold. A match means the records agree on that pair, and this file can still have been edited.
Without TIN Matching, compare line 1 with the legal name on the formation record and with the name the payments will use. A W-9 for an entity the state does not show, or for a person who is not the contracting party, is the case. A foreign person should not be on a W-9. An EIN letter is not this form, and a W-2 is not this form.
When the name and TIN match and the file still looks rewritten, ask whether line 1 or the TIN changed after the signature was applied. A name that belongs to a paper entity is a separate question, covered in shell company red flags. For a scored read of the file itself, check the file. The x-ray is production method, timestamps, issuer match, consistency, model artifacts, and recycled patterns. TIN Matching remains the name-and-number check.
Where Sphinx Fits
Watchdoc scores the W-9 and shows the x-ray a reviewer can point to. Sphinx's published product figures include 1 million documents processed, at $0.45 per document. The Watchdoc playground is free for the first file. Run line 1 and the TIN against the file's history before the certification is treated as the payee's own.
Frequently Asked Questions
How can you tell if a W-9 is fake?
For payors who can use it, TIN Matching tests whether the name on line 1 and the TIN match IRS records. Compare that name with the contracting party and the formation record, and check that the form is signed and dated under penalties of perjury. An IRS seal, a watermark, and a CP 575 are absent from a real W-9. Competent fakes fail when the name or TIN was edited after the payee signed, or when the whole form was generated and never signed by that person.
Does the IRS issue a completed W-9?
No. The IRS publishes the blank Form W-9 and the instructions. The payee, a U.S. person, completes it and gives it to the party who must file an information return. About Form W-9, reviewed June 27, 2026, describes that use. A completed form with no IRS seal is the ordinary document. The IRS does not mail back a certified copy.
What is the difference between a W-9 and an EIN confirmation letter?
A W-9 is the payee's certification of a name and TIN, signed under penalties of perjury. An EIN confirmation letter, such as a CP 575, is an IRS notice that a number was assigned. The IRS does not put a CP 575 on a W-9. A file offered as both is at least one of them in disguise. Backup withholding of 24 percent applies when the TIN is missing or wrong, which is a W-9 problem, not a letterhead problem.
What if the name and TIN do not match?
TIN Matching, where the payor can use it, returns that the name and TIN combination does not match IRS records. Backup withholding is then 24 percent. A mismatch is also a reason to hold the vendor file and ask for a new W-9 from the payee. A match is not proof the PDF was unedited, because a real name and TIN can be placed on a form that person did not sign.
.png)
