Fake emails target client info obtained by tax preparers
Tax season has been over for months, but the warnings about related scams continue.
Recent Internal Revenue Service advisories show that your personal information is vulnerable if you have had a professional individual or company prepare your taxes.
The agency this month urged tax preparers to beware of “spear phishing” emails that can result in stolen taxpayer information and fraudulent returns filed in the names of individual and business clients.
Spear phishing emails appear to come from a known or trusted sender with the goal of getting victims to disclose personal information such as passwords. Some versions encourage people to open a link or attachment that downloads malware onto the computer.
“We are seeing repeated instances of cybercriminals targeting tax professionals and obtaining sensitive client information that can be used to file fraudulent tax returns,” IRS Commissioner John Koskinen said in a news release. “Spear phishing emails are a common way to target tax professionals.”
The agency has kicked off an awareness campaign for tax preparers called “Don’t Take the Bait.”
In some cases, the emails come from a bogus prospective client who wants information about the cost of having his or her tax return prepared. It contains the sentence “Click here to view my details,” with a link. That’s the tipoff. Clicking unleashes a virus and gives the sender access to computer files.
Other versions ask the preparer to open an attachment.
“However, the attachment in reality downloads malware that tracks each keystroke made by the tax professional so that the criminal can steal passwords and sensitive data,” the IRS says.
And, of course, there are many other examples because “cybercriminals are endlessly creative,” the IRS said.
In some cases, indentity thieves have hacked into individuals’ email accounts. When the scammers see that a victim was in email contact with a tax preparer, they send an email to the preparer asking that the direct deposit refund account number be changed. Bingo for the scammer.
Fake debt collectors are back in the news, but it’s good news this time.
The Federal Trade Commission announced last week that a federal court, at the FTC’s request, temporarily froze the assets of an operation that was bilking people out of money for debts they didn’t owe.
The defendants posed as lawyers and threatened lawsuits and jail time if their targets didn’t pay up. They gave a “case number” and a phone number to call. Those who responded, the FTC said, were told a lawsuit or criminal action had either already been filed or soon would be. They also said police would be coming to their house to arrest them.
The agency, in its complaint, also said the scammers dragged some legitimate small business into their scheme. They did that by claiming a connection to the real business. That prompted angry consumers to call the businesses to complain about the supposed debt, the FTC said.
Reminder about fake debt scams:
■ If a debt collector says you owe money, ask for a validation notice that says how much money you owe. This must be sent in writing, within five days of the collector contacting you.
■ If you are threatened with jail time, hang up.
■ If you own a small business, research online occasionally to see if anyone else is using your business’ name. If you start receiving complaints about practices in which your business is not engaged, report to the FTC.