It’s tax season in the US. That means it’s also fraud season.
The US tax-filing season has only been under way for a month, but already the Internal Revenue Service is warning that it’s seen a 400% surge in phishing and malware compared with the previous tax year.
US taxpayers have been able to submit returns for the 2015 tax year as early as 19 January. The deadline to file taxes is April 15.
That’s nearly two months away.
Accordingly, many of us are studiously averting our gazes from teetering piles of paperwork heaped on our dining room tables.
But fraudsters aren’t procrastinating. As the IRS has found, they’re getting a head start in their attempts to tackle our financial data.
The automated attacks from crooks who’ve gone out of their way to get access to innocent users’ online tax submission accounts.
In May 2015, crooks used an online IRS system called Get Transcript to probe for taxpayers’ personal information that they could then use in refund fraud.
That system didn’t actually have anything to do with the system used to file taxes or get refunds. Rather, it was a reference portal used for retrieving returns from past years.
But that’s just what crooks needed to file fraudulent returns for this year.
They struck again with that type of attack a few weeks ago, with a PIN-stealing attack on the IRS that affected 100,000 taxpayers.
This time, the crooks used a list of known SSNs to try to get access to the IRS’s Get My Electronic Filing PIN portal.
How to spot tax phishers
If you get an unsolicited message that’s purportedly from the IRS or an associated organization, be suspicious.
The IRS generally doesn’t initiate contact with taxpayers by email, text or social media to request personal or financial information, the agency stressed.
These official-looking electronic communications often ask taxpayers to update important information by clicking on a link. Those links may be masked to appear like they’re linked to official pages, but they’re just heading for trouble. Don’t click on them.
These are some of the subject lines and requests the IRS is seeing in these scams:
- Confirm your personal information.
- Get my IP PIN.
- Get my E-file PIN.
- Order a transcript.
- Complete your tax return information.
- Variations about people’s tax refunds.
- Update your filing details, which can include references to W-2.
You can report these scams by sending the messages to phishing@irs.gov.
Image of Phishing courtesy of Shutterstock.com