Last week tax season began as millions of U.S. citizens could begin to e-file their taxes. While the term ‘tax season’ is the most commonly applied, according to James Carder, CSO of LogRhythm ‘peak scam season,’ might sometimes be more appropriate.
As an indication of the level of scams at play, the Internal Revenue Service (IRS) states there were 649,000 confirmed fraudulent returns attempted to obtain $3.1 billion in refunds in 2018. The IRS protected $6 billion in 2017, $6.4 billion in 2016 and $8.7 billion in 2015.
In addition, cybercriminals have already launched a phishing campaign this year targeting Automatic Data Processing (ADP) users telling them their W-2 forms are ready and prompting them to click a malicious link. As an example, some cybercriminals hack into executives’ email accounts and send communication from that alias targeting human resources and/or payroll departments.
James Carder explains the motive behind cybercriminals targeting this time of year: “There are criminal organizations around the world that do nothing but commit tax fraud. The key to their business model is to submit as many fraudulent claims as soon as possible — hoping they beat the legitimate filer to the punch so they can redirect the deposit to a bank account they own.”
The analyst goes on to explain the size of the problem: “With more than eight billion records exposed in 2019, it’s very likely cyber criminals already have the personal data necessary to impersonate a lot people. If they don’t have the information needed, they’ll probably launch a phishing attack to steal remaining details. In fact, the IRS has reported phishing as one of the most common forms of scam during tax season.”
Carder explains just how easy the theft of data is for scammers: “And unfortunately, criminals don’t require that much of your personal information. They don’t even need your W2. Many attackers will fake W2 information, such as income, while being careful that the amounts aren’t suspicious enough to be flagged.”
He adds that: “Ultimately, anyone can be susceptible to tax fraud — no matter who you are, what your job is, or what salary you make — and unfortunately, the only time a person finds out that they’ve been frauded is when their return gets subsequently rejected at filing. Because of this, it behooves people to file as soon as possible and to be extra cautious of calls, emails, or other messages asking for personal details.”
In terms of how the threat can be reduced, Carder recommends: “for an extra layer of security, individuals can request tax pin number to use as a secondary factor of authentication when filing returns. Those that have experienced fraud in the past automatically receive a pin from the government and can attest to the fact that it’s a long and arduous process to recover from. It can easily take a year to resolve and recover from tax fraud, so in addition to costing victims their money, it also costs them their time.”
