Tax Season Scams

Tax Season Scams

Tax season inevitably brings with it a proliferation of tax-related phishing attacks and scams designed to compromise personal information. Phishing is a fraudulent process by which an individual attempts to acquire sensitive, personal information by posing as a legitimate entity. During tax season, phishing scams often pose as the IRS and other legitimate agencies.

It's a fact of life that everyone has to pay taxes, making everyone a viable target and potential victim.

The two most common methods that malicious users take advantage of are tricking people into visiting fake websites or opening malware infected attachments:

• Fake Websites: This is the most commonly utilized method for tax season scams. For example, an email appearing to be from the IRS, is received by the user. The email contains a link to a fake IRS website. The links often appear authentic and connect the victim to sites that resemble the genuine IRS website. These imposter sites are set up to collect personal and/or financial information entered into an online form. These fake websites often ask for information such as SSN, bank routing and account numbers, credit card numbers, and online banking passwords or PINs.

• Malware Infected Attachments (often disguised as tax forms): In this method, forms are sent as attachments within an email. Users are then tricked into opening the attachments or forms, thinking that the forms must be completed as part of their tax filing. In these instances, scammers are attempting to infect computers with malicious software that would give them hidden access to the infected computer or silently record everything that is typed on the keyboard. This would then allow malicious users to silently steal information.

General Guidance to Avoid Being a Victim of Tax Season Scams

• Avoid clicking on any links in emails that claim to be from the IRS. Clicking on links in emails is why the fake websites method above is so successful each year. In most cases, these sites try to trick you into entering personal information on a fraudulent site. Links and addresses to the legitimate sites are included at the end of this article.

• Avoid opening email attachments that claim to be from the IRS. In most cases they contain malware that will attempt to infect your computer.

• The IRS does not initiate contact with taxpayers by email to request personal or financial information, or to communicate payment information. Additionally, the IRS never asks people for PIN numbers, passwords or similar secret access information for their credit card, bank or other financial accounts. The only banking information the IRS asks for is bank account number and routing number if you elect for direct deposit of a refund, and this information is included directly on the tax filing. Suspicious emails claiming to be from the IRS should be forwarded to phishing@irs.gov, and then the original email should be deleted from your mailbox.

• To obtain federal or state tax forms, visit the official IRS or state websites. Links are provided in the Useful Links section at the end of this article. The IRS does not send tax forms via email.

• The IRS is responsible for all services relating to income taxes. Past scams have included the use of other government agency names including the US Department of the Treasury, Office of Professional Responsibility, and EFTPS (Electronic Federal Tax Payments System).

• If filing a tax return electronically (e-filing), avoid doing so via public wireless networks such as coffee shops, book stores or airports. Public wireless networks, or hotspots, are generally not secure and should not be used for transmitting personal or sensitive information. If using wireless in a small office or home, ensure that proper security measures are in place on the wireless network, such as wireless encryption.

Common Tax Scams Reported by the IRS

Below, are some common tax scams that the IRS has reported and some general information to help prevent falling victim to them:

• Refund Scam: This is the most common scam reported by the IRS. In this scam, a bogus email tells the recipient that they are eligible for a federal tax refund. In order to claim the refund, the user must open an attached form, or click on a link contained in the email to access and complete the form.

TIP: The IRS does not notify taxpayers of refunds via email, nor do taxpayers have to complete a special form or provide detailed financial information to obtain a refund. Refunds are based on information contained on the federal income tax return filed by the taxpayer. To check the status of a refund, visit the IRS website at http://www.irs.gov/ and use the Where's My Refund? interactive tool to check the status of a refund.

• Inherited Funds, Lottery Winnings, Cash Consignment: In this scam, recipients receive an email claiming to come from the U.S. Department of the Treasury. The email notifies them that they will receive millions of dollars in recovered funds or lottery winnings or cash consignment if they provide certain personal information, including phone numbers, via return email. The IRS advises that the e-mail may be just the first step in a multi-step scheme, in which the victim is later contacted by telephone or further e-mail and instructed to deposit taxes on the funds or winnings before they can receive any of it. Alternatively, they may be sent a phony check of the funds or winnings and told to deposit it but pay 10 percent in taxes or fees. Thinking that the check must have cleared the bank and is genuine, some people comply. However, the scammers, not the Treasury Department, will get the taxes or fees.

TIP: In reality, the Treasury Department does not become involved in notification of inheritances or lottery or other winnings.

• Member Satisfaction Survey: In this scam, recipients receive an email purporting to come from the IRS advising taxpayers that they can receive a sum of money by filling out an online customer satisfaction survey. In order to obtain the money, the victim must provide their banking information.

TIP: The IRS does not offer money for completing surveys.

• Form W-8BEN (Beneficial Owner Form): In this scam, a real IRS form name (W-8BEN) is used, but the form itself is modified. The fake form requests detailed financial information, and sometimes includes nationality, passport number, spouse's name, mother's maiden name, etc. The form is often sent via email, postal mail, or even fax and is often accompanied with a threat of additional taxes being owed unless the form is quickly faxed back to the requester.

TIP: The IRS provides guidance that taxpayers file the genuine Form W-8BEN with their financial institutions, not the IRS. Additionally, the genuine W-8BEN does not request the taxpayer's passport number, bank account number, bank security PIN or similar information.

• Scare Tactics: Several scams exist to scare people into opening infected attachments or clicking on malicious links. One example includes a "Tax Avoidance Investigation" email claiming to come from the IRS Fraud Department and asking the user to complete an investigation form. Another example includes an email appearing to come from the IRS notifying a taxpayer that their tax return will be audited. The email instructs the recipient to click on links to complete forms online or to open attachments within the email.

TIP: The IRS does not send unsolicited, tax-account related emails to taxpayers.

• IRS "Antifraud Commission" and Electronic Federal Tax Payment System (EFTPS): An email is received that states that the IRS's "Antifraud Commission" has found that someone tried to pay their taxes through the Electronic Federal Tax Payment System, or EFTPS, using the email recipient's credit card and that, as a result, some of the recipient's money was lost and the remaining funds were blocked. The email includes a link that sends the recipient to a website that asks the recipient to enter personal and financial information, such as SSN and account numbers, in order to unblock their funds.

Useful Links

• Click here to access the IRS website.
• Click here to access a list of the U.S. state websites.
• Click here to access information on protecting your personal information and the steps to take if you receive a suspicious IRS-related communication.