Tis’ the season for tax villains. The notion that spam has been increasing lately has been obvious recently and for more evidence of that nasty trends you need look no further than this fact: From Dec 2016 to Feb 2017, IBM X-Force researchers saw a 6,000% increase in tax-related spam emails.
And that’s just one of a number of tax season scams and frauds IBM X-Force security researchers have been tracking in a report “Cybercrime Riding Tax Season Tides: Trending Spam and Dark Web Findings” issued today.
+More on Network World: IRS Dirty Dozen: Phishing, phone cons and identity theft lead scam list for 2017+
Some of IBM’s tax scam-themed observations included:
- Criminals use the topical time of tax season to lure consumers to open emails and files which have malware embedded in then which steals consumer’s passwords and other financial information. The email might look like they are coming from the IRS but they are not it’s the crooks posing as the IRS.
- Crooks send a business’s accounting staff an email that appears to have come from an executive asking for employee W-2 information. The emails look legitimate so unsuspecting employees open them, answer the questions and send sensitive information to the hackers.
- Dozens of tax software companies are competing for consumer’s business this time of year and send legitimate marketing emails to entice you to file with them. Cybercriminals have recreated the look and feel of those emails and are redirecting unsuspecting consumers to fraudulent websites where they steal log in details and ultimately enough info to file a return.
- In 2017, IBM has seen criminals selling W-2s and tax information for ~$40-$50 which can enable them to file false returns and possibly collect your return before you’re able to file. As a result, the longer a tax payer waits to file a tax return, the more they are potentially susceptible to this scam. In 2016, it was reported that the IRS paid out approximately $5.8 billion in fraudulent refunds.
The IRS said of the evolving W-2 scam in particular: “This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns. We need everyone’s help to turn the tide against this scheme,’’ said IRS Commissioner John Koskinen in a statement. “Taxpayers should avoid opening surprise emails or clicking on web links claiming to be from the IRS. Don’t be fooled by unexpected emails about big refunds, tax bills or requesting personal information. That’s not how the IRS communicates with taxpayers.”
+More on Network World: IRS warns on ever-changing “dangerous W-2 phishing scam”+
IBM X Force made a bunch of recommendation to combat fraudsters including:
- File now: Last year, 54 million Americans filed after April, waiting until the last minute to file. File your taxes as soon as you receive your W-2 from your employer. The longer you wait, the more opportunity a fraudster has to file on your behalf.
- Pin the IRS: The IRS IP PIN is a six-digit number assigned to eligible taxpayers to help prevent the misuse of their Social Security number on fraudulent tax returns.
- Watch credit: Most breached organizations now offer free credit monitoring services – consumers should plan to take advantage for the maximum time allotted.
- Inbox vigilance: The IRS will never initiate contact with taxpayers by email, phone, text or social media to request personal or financial information. This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.
- No spoofing zone: Scammers often send spoof emails from a target organizations' CEO, requesting all employee W-2 information from human resources and accounting departments. Don’t fall for it, pick up the phone and call them to authenticate the request.
- Avoid clicking on email links from tax vendors: If you intend to self-file online, access your vendor’s website directly to ensure you’re accessing the trusted site.
- Avoid password reuse: Especially when filing your taxes online, make sure to avoid using a password you’ve used for other websites.
Check out these other hot stories:
Cisco says Arista’s redesign moves not good enough
Open source routing project gets a vital technology infusion
IBM technology creates smart wingman for self-driving cars
Extreme swallows Brocade's data center networking business for $55M
IBM on the state of network security: Abysmal
Cisco expands wireless reach with access points, management software
5 burning questions with new IETF Chair and Cisco Fellow Alissa Cooper