W-2 Phishing Increases 2016 Tax Fraud Estimates to $21 Billion

Let’s be clear on something. The Internal Revenue Service is not going to email you out of the blue and tell you that there is any sort of issue with your tax returns. The IRS just doesn’t work that way. And it is not likely that a CEO or someone at that level is going to ask for copies of W-2s for anyone.

Recently the IRS reported that several companies, including Sprouts Farmers Market, Snapchat, and Seagate fell victims to the W-2 scams. Scammers called up people with access to the valuable W-2 information asking for copies to be sent. Unfortunately, they fell for it.

Before sending sensitive data, wire funds or open an unsolicited attachments, call the sender to verify the request or validate the attachment. Criminals are stepping up their attacks on businesses right now as most industries not in the financial or healthcare worlds, don't think they have anything valuable for cybercriminals to target. Wire fraud and the current W-2 scam are proving that wrong... very wrong.

The IRS estimates that American taxpayers will pay around $21 billion for income tax fraud in 2016, which is a massive increase over the $6 million figure of 2014. The scammers are working overtime now with the dreaded Tax Day around the corner. And all of the expected attacks have phishing in common.

Remember the basics of identifying phishing, besides the fact that the IRS won’t email you asking for anything unless you initiate the communications. Even then, no one should be asking you to email sensitive information. Watch for errors in email messages, such as poor spelling and punctuation or incorrect or poor quality graphics. Don’t click links or open attachments that come in these messages and beware of vishing; phishing via the telephone. A common vishing scam is someone phoning to say it’s the IRS letting you know that they are filing a lawsuit against you. Then they ask for all kinds of sensitive information or a financial payout in order to drop the case. Scare tactics are common in these scams.

The IRS will initiate communications with you via the U.S. Postal Service, so if you get any messages or notes from them in any other way, it is very likely phishing of some sort. If you have been a victim of IRS phishing scams, file a report with the IRS and the FTC. You can go directly to their websites to find out how.

If you do receive an email or phone call and want to verify it with the IRS, get a phone number off the IRS website or some other way. Just don’t use any phone numbers left in the emails or on voicemail.

The ultimate goal is to get money. Unfortunately, they can get your information in a variety of ways outside of phishing for it directly from you too.

The IBM X-Force, which conducts security research, found that there was a significant increase of attacks hitting the medical industry as well. Medical records have a lot of information that can be very valuable on the dark web. In fact, those go for about $50 each where credit card records are a measly $1-$3. Even if you don’t fall for any of these attempts, it is possible that the IRS is the weak link. Last year the IRS was breached and there are estimates that 700,000 files were compromised in that incident. This was the infamous “get transcript” scandal that has since been suspended.

The phishers and scammers are getting a bit smarter year after year. They are also taking the “catch more flies with honey than with vinegar” approach and pretending they want to help, as well as sending email just asking for more information to be mailed back; no links or attachments even included in the messages. So remember never to reply. Instead, get an email address off the organization’s website separately and create a brand new message.

So, if you get any message claiming to be from the IRS that tries to scare you into providing information on a form, or claims that you owe back taxes and need to send money, or asks you to email back any information at all, it’s likely that tried and true social engineering tactic called phishing is at work.

The best way to avoid having someone get your tax refund first is to file early. Then if someone tries to fraudulently file one afterward, the IRS will reject it because your legitimate one was already filed.