Postponed Tax Deadline Approaching and with it Tax-Related Phishing Attacks

Many events were cancelled or postponed due to the COIVD-19 pandemic, including the usual yearly tax deadline of April 15th. With its rescheduled date of July 15th coming up swiftly, it is not only important to ensure your taxes are completed, but it is also important to be aware of phishing scams online which are trying to dupe you into handing over your personal and private information.

Stimulus Relief Scam Used to Steal PII

Many people, particularly those put out of work due to the Coronavirus pandemic, were very excited to receive a very welcome Stimulus Relief check of $1,200 earlier this year. Being that there are so many people in the country, not everyone received their checks at the same time; malicious actors used people's desires to get their much needed money in order to scam them. These scammers utilized both phishing emails as well as telephone calls presenting themselves as Stimulus Relief support representatives.

These so-called representatives told their victims that people either had to sign checks over to them in order to verify the victim's identity. Others claimed they needed to verify receiving bank accounts by persuading unsuspecting citizens into telling them the full bank account number rather than verifying the last four digits which would be all a reputable source needed to verify. This turns into a tax scam because the malicious actors utilize stolen information to steal the victim's identity and falsely filing taxes in that person's name before that individual gets the chance to do so.

COVID Relief Themed Scam

Just as the Stimulus Relief effort was used to the cybercriminals' advantage, so has the pandemic which warranted the stimulus checks. The IRS warns of continued COVID-19 themed phishing scams, which started at the beginning of the pandemic as pretending to be coming from the CDC or WHO as informational emails "helping" people to avoid the spread of the virus, which are now targeting people's interest in the creation of a vaccine. According to Forbes, there are a plethora of cyber-scams flooding the Internet at the moment, one of which involves a similar approach malicious actors had to the Stimulus Relief scam above; these people send emails to folks who have been frequently searching the Internet for COVID-19 related news, particularly about a vaccine which is said to be needed before things can return to pre-Coronavirus normal. Because these individuals are interested in a vaccine, the scammers send them emails about investing early in companies which are working on said cure; these cybercriminals then take the financial information provided to them by victims of this scam and steal their identities.

QuickBooks Phishing Scam

A cybersecurity firm, Darktrace, was hit by one of the more malicious phishing scams of late. This advanced cybersecurity company was the target of a multi-layered phishing scheme which began with an email from quickbooks@notification.intuit.com which appeared to have a seemingly legitimate attachment of the company's monthly invoice. The next attack on the company came a month later where the attacker stole an accountant's email address and utilized it to directly contact the company CEO. This second email attempted to persuade the CEO into entering in their credentials on a fake Skype page and the email included a phony Skype voicemail message to try and make the request look more legitimate.

According to a report from Darktrace, the sender of those emails was clearly very intentional as to which email was received by which recipient, utilizing platforms the individuals were known to use so as to appear to be familiar to them. The report states, "The fact that these attacks specifically targeted the CEO and only individuals who had access to the company's research and intellectual property shows that this was a well-planned and meticulously executed attack." Thankfully for the company and unfortunate for the cybercriminals behind this attack, the cyber firm is highly skilled at handling such attacks and in these instances actually used their artificial intelligence (AI) to judge the legitimacy of emails in order to protect the company from further onslaught.

Traditional Scams

Telephone calls seemingly coming from the IRS demanding you fork over massive amounts of money or else the police are on their way to get you have existed for quite some time. Not only this, but many of these scammers also decide to take the same approach of targeting tax payers with similar aggression via email. It is important to remember that the IRS only communicates with tax payers via the postal service. Additionally, if an email is ever phrased in a threatening way where there are deadlines and demands, take a step back, breathe, and think logically about the email; does this sound like how a reputable source would interact with the public? If not, you can rightly assume this is not a legitimate email coming from the source it is pretending to be from.

Quick Tips to Avoid Tax Season Scams

1. The IRS never calls or emails people - if someone is claiming to be coming after you from the IRS, report the number or email address as being fictitious and malicious. The IRS will only contact you via the mail, so only take that form of communication seriously.
2. Invest in credit monitoring services - Credit monitoring services help to not only help you in tracking your credit, but also gives you some insight as to whether or not someone has stolen or attempted to steal your identity. Many companies offer this as a free service and it is absolutely worth the time it takes to set up an account in order to have peace of mind when it comes to your credit and identity.
3. Be aware of phishing scams or malicious calls - Phishing scams and malicious calls increase in the first few months of the year as W-2s are sent to employees and people begin filing their taxes. Avoid falling for these tricks by scrutinizing contacts from seemingly legitimate businesses by looking for strange Sender emails with misspellings or incorrect company names such as customersuport@quickbookz.net. As people become more and more wise to what a phishing scam entails, however, cybercriminals are getting smarter and can sometimes mask their Sender emails or phone number to look as though they are reputable. In these instances, go to those companies' websites directly and contact customer support representatives. Do this by searching for the website and do not click on any links in the received emails. Also be on the lookout for grammatical errors or, as mentioned above, immediate demands "or else."

Image by Freepik.