New Threat Research: Uncovering Adversarial LDAP Tradecraft

Read Threat Research


Watch Out for These Tax Season Scams

With less than a month to go before the 2023 tax filing deadline, consumers should be on the lookout for tax related scams. Scammers can capitalize on last-minute efforts to play catch-up if taxpayers don’t take a beat before clicking on a dubious link or handing over personal information. Either action could put taxpayers at risk for financial fraud or identity theft. Tax-season scammers often impersonate the IRS, tax professionals, or online filing websites, said David Putnam, head of identity and protection for LifeLock, a provider of consumer identity theft protection. Phishing emails, texts, and even phone calls designed to look like they’re from the IRS, or an IRS agent, are a common sight this time of year. They might threaten jail time or big fines if the targeted person doesn’t pay what the cybercriminals might claim are back or overdue taxes. “The IRS only communicates through snail mail, so if you get a text message claiming to be from the IRS, you’ll know you’re actually being contacted by a scammer,” he said. The IRS also doesn’t take payments in the forms of cryptocurrency or gift cards, making requests for back taxes in those forms obvious signs of a scam too. Phishing emails could also carry fake tax forms that look like they’re coming from an employer or a bank, said Ravi Srinivasan, CEO of Votiro, a cybersecurity company that specializes in the secure transfer of data.

Analyst Notes

The IRS provided excellent tips for protecting against these types of scams:

• File early. OK. The ship may have already sort of sailed on this one, but the earlier you file, the less time cybercriminals have to use your identity to commit fraud.
• Watch out for phishing and smishing. The IRS won’t send unsolicited emails or texts. Skip the links and attachments and go straight to the IRS or the applicable state and city websites.

• Get a PIN. File this tip under things to remember for next year. Taxpayers who can validate their identities with the IRS can obtain an identity protection PIN, a six-digit code that prevents a cybercriminal from filing a fraudulent tax return with your Social Security number.

• Fight back against fraud. If you discover someone has filed a tax return in your name, complete a paper return and include form 14039 (Identity Theft Affidavit), Putnam said. Report the fraud to local law enforcement and the Federal Trade Commission. Monitor your credit reports and account statements and contact the three major credit bureaus to ask for a freeze so that no one can request new credit in your name.

• Always use good passwords and 2FA. These are both a must for any account related to your tax returns and documents. Make sure you’re using good antivirus software and that it, along with your operating system, is up to date. While you’re at it, back up your tax information to a removable drive or encrypted cloud storage. Paper copies and drives should be securely stored.

• Know who you’re dealing with. If you’re self-filing online, make sure you’re using a reputable service. If you hire someone to do it for you, make sure they’re who they say they are. Be especially careful when submitting documents both online and on paper. Any decent tax professional or service will use a secure portal, not ask you to email them unprotected. Paper documents shouldn’t be left on a desk for anyone to find.

• Shred everything. Tax documents that are no longer needed must be properly destroyed. Dumpster diving still happens. Don’t be tempted to toss them in the trash and don’t put them in the recycling.