The IRS has launched its 2019 ‘Dirty Dozen’ campaign warning taxpayers about the most common tax-related phishing scams that lead to tax fraud and identity theft.
Each year the IRS provides taxpayers, businesses, and tax professionals with information on the 12 most common phishing and tax scams to raise awareness of the most prevalent threats.
During tax season, cybercriminals are highly active and seek tax information to commit identity theft and submit fraudulent tax returns. Each year, many consumers are fooled into disclosing their personal information and scores of organizations fall victim to these scams and disclose the tax information of employees to scammers. The scams are conducted over the phone, via text messages, on social media platforms, websites, and via email.
On March 4, 2019, the IRS launched this year’s Dirty Dozen campaign with a warning about the most serious threat during tax season – phishing. On each of the following 11 weekdays, the IRS will highlight a different scam.
Tax-related phishing scams are often cleverly disguised. Emails are sent that appear to be from the IRS threatening fines or legal action or offering sizable refunds for overpayment of tax. The sender name is often spoofed, IRS logos are used, and the emails usually demand an urgent response. Regardless of the theme, the tax-related phishing scams have one purpose: To obtain personal information.
A new phishing scam was detected this year which prompted a warning from the IRS in February. Targeted tax professionals were being attacked to obtain client data. Fraudulent tax returns were then filed using the stolen information and the IRS issued tax refunds to taxpayers’ accounts via direct deposits. The taxpayers were then contacted by the scammers, who posed as a debt collection agency acting on behalf of the IRS to reclaim payments that had been made in error.
Payroll offices and human resources departments need to be on high alert during tax season for tax-related phishing scams that attempt to obtain form W-2 information. Emails are sent to payroll/HR staff requesting W-2 form information for all employees that have worked in the past financial year. The emails are either sent from a compromised email account within the organization – termed a business email compromise (BEC) attack – or they spoof the email address of a high-level executive – termed a business email spoofing (BES) attack.
Variants of these attacks include requesting changes to the direct deposit information of employees, payment of fake invoices, or requests for fraudulent wire transfers. Email scams are also conducted to spread malware that logs keystrokes and steals sensitive data.
The IRS explained that generally contact with taxpayers is not initiated by the IRS via email to request personal or financial information. Anyone receiving a tax-related phishing scam email that spoofs the IRS should forward the message to phishing@irs.gov
“Taxpayers should be on constant guard for these phishing schemes, which can be tricky and cleverly disguised to look like it’s the IRS,” explained IRS Commissioner Chuck Rettig. “Watch out for emails and other scams posing as the IRS, promising a big refund or personally threatening people. Don’t open attachments and click on links in emails. Don’t fall victim to phishing or other common scams.”
The post IRS Issues Warning About Tax-Related Phishing Scams appeared first on HIPAA Journal.