For most of us tax season is an anxious time. Indeed, criminals are eager to take advantage of our anxiety. And, as we know, the April 15th filing deadline date just a week away. With this is view, it’s important to stay vigilant and be on the lookout for tax scams.
In fact, according to the “Dirty Dozen” list published by the Internal Revenue Service (IRS), phishing and vishing continue to be the top methods used by criminals. Scammers use fake emails, websites, and spoofed phone numbers to steal identities and money. So, what do these phishing and vishing tax scams look like? Lets take a look at a few examples.
Lookout For These Phishing Tax Scams
Criminals are using cleverly disguised emails that look like the IRS such as, the Tax Account Transcript scam. In this scam, criminals send emails pretending to be from “IRS Online.” They include an attachment with the label, “Tax Account Transcript,” as bait to entice users to open documents containing malware.
Another phishing scam to lookout for are emails that contain the direction “you are to update your IRS e-file immediately.” This phishing scam includes links to fake websites that impersonate the official IRS website. What should you do if you receive a phishy email?
What Should You Do With a Phishy Email?
Did you know the IRS does not initiate contact through unsolicited emails for personal or financial information? So, what should you do if you receive one of these phishing tax scams? The IRS recommends the following:
- Do not open the email.
- Do not open any attachments or click on any links. They may have malicious code that will infect your computer.
- If using an employer’s computer, notify the company’s technology professionals.
- Report the phishing email by forwarding it to [email protected].
The official IRS website provides a webpage where you can get your personal tax transcript online. You don’t need to be sent a specific link to access the data.
Lookout For These Vishing Tax Scams
The IRS is warning about a new scam where criminals are making unsolicited phone calls claiming to be from the Taxpayer Advocate Service (TAS), an independent organization within the IRS. Criminals are spoofing the phone number of the TAS office making the call look legitimate to the intended victim. The criminals may also use automated calls leaving a phone number for the intended victim to call back. The goal of this scam is to get your personally identifiable information, such as your Social Security number or your individual taxpayer identification number.
Erroneous Refund Scam
Another tax scam to lookout for is the erroneous refund. This scam involves your real bank account. Here’s how it works. Criminals steal client data from tax practitioner’s computers via phishing or other schemes and file fraudulent tax returns. Now for the twist. The criminals have the tax refund deposited into the victim’s actual bank account. That’s what gives this scam the appearance of legitimacy making it extremely dangerous. To retrieve the funds criminals are using a variety of phone scams (vishing).
In one version thieves, posing as IRS debt collection agency officers, call the victim to say a refund was deposited by mistake and ask for the victim to forward the money to their bogus collection agency.
A Twist on the Scam
In another version, victims receive an automated call claiming to be from the IRS. The victim is threatened with fraud charges, an arrest warrant, and suspension of their Social Security benefits. The criminal ends the message by leaving a bogus telephone number for the victim to call. What should you do if criminals start calling you?
What You Should Do If Criminals Start Calling
If the caller claims to be with TAS, hang up. It may feel rude, but keep in mind, the IRS will not initiate contact with you by phone to request personal or financial information.
If the caller claims to be with the IRS and they say it’s about an erroneous refund, hang up. Think critically. If you know that you have not yet filed a tax return, then you should not have a tax refund from the IRS in your bank account. So, if your bank account is showing a deposit from the IRS, it no doubt means a thief has stolen your identity, filed a fraudulent tax return, and is now calling you to get the money.
IRS Recommendations
The IRS recommends the following actions to return the funds and avoid being scammed.
Direct Deposit
If the fraudulent refund is a direct deposit:
- Contact the Automated Clearing House (ACH) department of the bank/financial institution where the direct deposit was received and have them return the refund to the IRS.
- Call the IRS toll-free at 800-829-1040 (individual) or 800-829-4933 (business) to explain why the direct deposit is being returned.
Paper Check
If the fraudulent refund is a paper check:
- Write “Void” in the endorsement section on the back of the check.
- Submit the check immediately to the appropriate IRS location.
- Don’t staple, bend, or paper clip the check.
- Include a note stating, “Return of erroneous refund check because (and give a brief explanation of the reason for returning the refund check).”
If you become a victim of the erroneous refund scam, you may find that the tax return you prepare will be rejected, because a return bearing your Social Security number is already on file. If that’s the case, you will need to inform the IRS that you are a victim of a tax preparer data breach. More information and the detailed steps to follow can be found in the Taxpayer Guide to Identity Theft.
Stay Safe This Tax Season
Unfortunately, nearly 1 out of every 2 Americans are at increased risk for tax fraud due to the Equifax breach. So stay vigilant and be on the lookout for tax scams. Don’t let thieves and criminals take advantage of the anxiety tax season may bring or your fear of the IRS. Don’t open any unsolicited emails purporting to be from the IRS, and if you’re not expecting a call from the IRS, hang up.
Sources:
https://www.irs.gov/newsroom/irs-kicks-off-annual-list-of-most-prevalent-tax-scams-agency-warns-taxpayers-of-pervasive-phishing-schemes-in-its-dirty-dozen-campaign
https://www.irs.gov/newsroom/irs-warns-of-tax-transcript-email-scam-dangers-to-business-networks
https://www.irs.gov/newsroom/tax-scams-consumer-alerts
https://www.irs.gov/individuals/get-transcript
https://www.irs.gov/newsroom/irs-warns-of-new-phone-scam-using-taxpayer-advocate-service-numbers
https://www.irs.gov/newsroom/scam-alert-irs-urges-taxpayers-to-watch-out-for-erroneous-refunds-beware-of-fake-calls-to-return-money-to-a-collection-agency
https://www.social-engineer.org/framework/attack-vectors/vishing/
https://www.irs.gov/newsroom/taxpayer-guide-to-identity-theft
https://www.social-engineer.com/stay-safe-tax-season-equifax/
Image:
www.social-engineer.org
Great article, thank you. We also see large and sophisticated hacking rings getting w2 data from knowledge based servers, such as in the Equifax, Intuit, Citi, and even the massive IRS breach.
Then they use the actual w2 withholding to seem legitimate and claim a refund.
Crazy.
Anyway, thanks again for the great read.