Looming April Deadline Leads to 6000% Increase in Tax Related Phishing Spam

Every year the same nerve-wracking day comes along in April. It’s stressful for many and it’s a great opportunity for cybercriminals to kick their activity into high gear as those in the U.S. file their income taxes. Tax fraud is on the rise, particularly W-2 fraud schemes. IRS Commissioner John Koskinen has called this one of the most dangerous phishing scams that has come around in a long time.

Partly due to this, in 2016 it is estimated that the IRS paid out around $5.8 billion in fraudulent refunds. According to IBM, tax related spam is up 6,000% since December of last year.

W-2 fraud occurs when cybercriminals are successful at getting ahold of W-2 information. Often, someone in the human resources or accounting department is tricked by a fake email message into sending W-2 information to an executive. Often it is the CFO or CEO that is impersonated. It is dangerous because of the type of information that is on those forms: Full names, addresses, social security numbers, pay information, etc. Information from these has been seen for sale on the Dark Web for $40-50 per record.

• File your income taxes early and certainly before the April deadline. This year, that date is April 18. Even if you plan to file an extension, do it before the April date. The IRS has stated that 54 million people filed taxes after April last year. The earlier you file, the less likely a cybercriminal can do it for you.

• Beware of fraudulent email messages from tax software companies. The competition in that arena is fierce and they do increase their marketing at this time. Cyber criminals are getting better and better and sending out realistic-looking spam appearing to be from these companies.

• If you get email requesting W-2 information be sent to anyone, confirm the request by picking up the phone or personally making a visit to the requestor. Consider whether the requestor would normally need or ask for this information.

• Don’t click links or attachments that arrive in unexpected email messages or texts. Often, these contain malware or forms that request sensitive information that gets sent back to the criminals.

• If you do receive email from a tax preparer or software company, go directly to that website to log in rather than clicking links in messages.

• Always use a strong and unique password for online accounts. Each online account, be it your financial institution, your health insurance company, or your tax provider, should have a completely unique password associated to it. This will prevent passwords from being reused on other sites, should a breach occur at one of them.

Remember that the IRS does not communicate with taxpayers via email, telephone, or text. If they need to initiate contact, it will be via the U.S. Postal Service.