As if it weren’t already overwhelming enough to gather all the necessary financial statements and fill in the various forms to prepare a tax return, cybercriminals are now making matters worse with a spear phishing scam that has drawn the attention of the U.S. Internal Revenue Service (IRS).
In a statement posted on its website, the IRS said it has learned of taxpayers who have been receiving phony emails that instruct them to visit a portal to update information in order to “e-file” their returns. Though the websites in question may resemble that of the IRS, they are more likely spear phishing scam sites designed to capture personal and professional information.
Email isn’t the only attack vector cybercriminals are using. According to a column in the Washington Post, some taxpayers are also receiving bogus voicemail messages threatening legal action if information is not handed over. Even a lawyer with U.S. Federal Trade Commissioner was among those targeted.
In some respects, it makes sense that spear phishing scams would eventually tie in to something like tax season, which has numerous deadlines to meet and all kinds of details that could easily be missed or overlooked. From a social engineering perspective, there is plenty of reason why unsuspecting citizens might worry they need to update information in order to get their returns processed correctly.
CSO Online recently provided one of the best summaries on how tax-related spear phishing schemes tend to work, with detailed screenshots of the typical email formats used and the kinds of portals designed to steal personal data. Besides the fact that the IRS would not contact taxpayers electronically for these purposes, other telltale signs include messages that don’t specify the recipient by name or email attachments that require a download in order for taxpayers to take the next step.
Forbes had some interesting ideas on how to ensure you’re not fooled by spear phishing scams, including filing tax returns earlier or later than is typical. In any case, anyone who experiences suspicious contact from an organization that purports to be the IRS is being urged to report it using the phishing@irs.gov email address.
Besides causing a nuisance, a spear phishing scam like this opens the door to identity theft and possibly worse. Perhaps if cybercriminals begin to make a habit of capitalizing on tax season, taxpayers will become savvy enough to know what to expect and be less likely to fall victim to it. As the old adage says, nothing is certain but death and taxes — cyberthreats notwithstanding.