Stop Emailing Your W-9 as a PDF

Every solopreneur sends a W-9 to get paid. Almost nobody thinks about where it sits after.

The Insight

A W-9 is one form: name, address, and either your SSN or your EIN — the number the IRS uses to confirm you exist so a client can legally pay you. Every consultant, freelancer, and solo LLC sends one before the first invoice clears. It feels like paperwork. It's actually the most sensitive document most solo operators will ever transmit — and attaching the PDF and hitting send is exactly the wrong way to do it.

Standard email was built decades ago to route mail, not protect it. The connection between servers is usually encrypted, but only while the file is moving. The second it lands, it sits in plain text — in your Sent folder, their Inbox, and both providers' servers — indefinitely.

Here's how it gets used against you. An inbox gets phished, or a reused password turns up in an old breach. The attacker doesn't read three years of email — they run an automated search for "W-9," "SSN," "EIN," "Tax ID." Whatever surfaces gets sold, or used directly: a fraudulent credit line opened in your name, or — since it's an EIN — fake 1099s filed to redirect real contractor income.

The Fix

The rule I'm building into Syntax Labs from day one: no W-9 travels as a raw attachment. It goes out as a link — encrypted, password-protected, expiring — with the password sent over a separate channel, never the same thread.

Not every "encrypted" option is zero-knowledge, and the difference matters here. Proton Drive and Tresorit encrypt files before they leave your device — even the provider can't open them. Koofr looks similar but isn't: standard Koofr storage uses keys Koofr holds. Koofr Vault is genuinely zero-knowledge, but it can't generate the external link a client needs — so for this job, it's out.

The one I actually use is Bitwarden Send: encrypted file links with an expiration date and a view limit — no account needed on the other end. Bitwarden flagged this exact use case for tax season this year; file sharing needs a paid plan, but for one document, that's a rounding error.

It's one extra step. And it closes the exact hole that turns paperwork into an identity theft case.

The Hard Truth

Nobody warns solopreneurs about this because it's boring. There's no clean villain, no dramatic hack — just a form sitting quietly in an inbox for years, waiting. Systems don't fail loudly. They fail by omission, one skipped step at a time.

If you've ever emailed a W-9 as a plain PDF, it's still out there. That's not a reason to panic. It's a reason to build the step in now, before the next one.

Sources:Bitwarden — March 2026 Spotlight: Send for Taxes · Bitwarden Send product page