IRS Warns of Nasty W-2 Phishing Scheme

The news that the Internal Revenue Service has issued its second major warning about tax scams in a little over a month (this one involving a phishing email scheme that look a like a message from company executive requesting personal information from employees), Jon French, security analyst at AppRiver have the following comments on it.

[su_note note_color=”#ffffcc” text_color=”#00000″]Jon French, Security Analyst at AppRiver:

Is the spate of IRS scams and data breaches at the moment indicative of major failings at the institution?

This current W-2 phishing problem isn’t indicative of any problems with the IRS I’d say (this time). This just shows that attackers will use phishing tactics for stealing data or financial information in general. The attackers aren’t taking advantage of any holes in the IRS’ system or network. They are taking advantage of peoples trust in communication by spoofing emails from CEO’s.

Is the IRS seen as “low hanging fruit” since so many of its service users seem unaware of scams like these and how they operate?

Using phishing emails themed with IRS information is pretty common. We see numerous examples of these emails getting caught every day. The fact that everyone in the US has to deal with the IRS makes it a very large base of possible victims for the attackers to abuse. They can do minimal research to find a company’s CEO and then just send it out to a collection of employee email addresses and hope someone responds. Sometimes users will end up having back and forth conversations with the attacker and not even realize they aren’t talking to their boss.

How can citizens be vigilant as they interact with the IRS?

Verify what sites you are actually at or what phone number you are actually calling. We see fake IRS emails with links to click that take users off to phishing sites, but they are almost always easy to spot if you are looking. The key is looking before you click and knowing what to look for. Things like unrecognized websites or odd looking formats are good indicators a message may be illegitimate. But sometimes phishing emails can look very clean and professional as well. So it’s always important to not just trust what you see and to make sure to double check everything.

What tips would you give people for spotting scams like those the IRS are warning?

Verify verify verify. Verify who you are talking to and what sites you visit. Paying extra attention to detail can prevent these terrible situations where some employee in accounting may realize they just sent everyone’s personal data to an unknown attacker. Or even handing over all their own personal data to a phishing website. Having protection such as email filtering can also help prevent these types of messages from even getting to a user’s inbox (since we see these types of messages getting caught in our filters every day). One of the best tactics though always comes around to user training. If users know what to look for and can notice when things feel off, that is a great defense to have to keep your data safe.

Jon also wrote a blog about this recently, which can be seen at HERE.[/su_note]

[su_box title=”About AppRiver” style=”noise” box_color=”#0e0d0d”]AppRiver’s corporate headquarters is located in Gulf Breeze, Florida, USA, and our Europe, Middle East and Africa (EMEA) headquarters is in Lupfig, Canton Aargau, Switzerland. The Company also has a regional sales office in Northport, New York, USA and we maintain multiple, secure world-class data centers throughout the United States, Europe, and Asia. Our growing 170-member team protects more than 45,000 corporate customers and eight million mailboxes around the world.[/su_box]