Tax Season Warning: the IRS on Social Engineering
As 2020 begins and April 15th approaches, the US Internal Revenue Service wants taxpayers to keep a sharp eye out for signs of social engineering.
According to tweets the IRS issued at the end of December, “The most common way thieves steal identities is simply by asking for them.” This is especially a problem during tax season, when thieves file fraudulent returns, or use tax worries as the entering wedge of other social engineering campaigns.
The IRS Twitter feed offers a short list of things in communications that should put you on your guard. Scammers often:
• “Pose as a trusted source.”
• “Tell you there’s something wrong with your account.”
• “Claim you’re in violation of a law.”
• “Tell you to open a link or an attachment.”
• “Ask you to log into a familiar-looking–but fake–website.”
In every one of those cases, crooks have misrepresented themselves as IRS agents as they attempt to lure taxpayers into giving up sensitive information.
That kind of impersonation works with all five of the tactics the IRS warns against, and most work equally well as smishing (text messaging), or as vishing (voice calls) as they do with conventional email phishing.
The tax agency points out on its website that there’s one sure sign that the person who says they’re from the IRS is in fact a scammer: “The IRS doesn’t initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information.
This includes requests for PIN numbers, passwords or access information for credit cards, banks or other financial accounts.” So if you’ve been contacted out of the blue by someone who says you owe taxes, that you might be about to arrested, or that the Government needs your bank account credentials, it’s fraud.
A threat to an individual is also a threat to that individual’s organization, and businesses and other organizations also deal with the IRS and other Government bodies. This kind of impersonation scam can be easily avoided, especially if an organization takes the trouble to offer its employees new-school social engineering awareness training. The IRS website has full details on phishing here: https://www.irs.gov/privacy-disclosure/report-phishing
If you’re interested in training your employees to recognize fraud and scams, contact Ashton Technology Solutions today, at 216 397-4080!
