The Internal Revenue Service is warning taxpayers and tax practitioners about a new email phishing scam in which criminals are impersonating the IRS, sending unsolicited emails with subject lines like “Automatic Income Tax Reminder” or “Electronic Tax Return Reminder” that appear to come from the IRS.
The IRS and its partners in the Security Summit also reminded taxpayers and tax pros Thursday that it doesn’t send unsolicited emails and never emails taxpayers about the status of their tax refunds. The Security Summit is an initiative teaming up the IRS with major tax prep chains and tax prep software providers, plus state tax authorities, to combat tax-related identity theft and expose tax scams. They detected the new scam this week, although it sounds like it’s a more sophisticated variation on an older tax scam.
The emails include links that show an IRS.gov-like website with details purporting to be about the taxpayer’s refund, electronic return or tax account. The emails contain a "temporary password" or "one-time password" to "access" the files to submit the refund. But when taxpayers try to get access, it turns out to be a malicious file.
“The IRS does not send emails about your tax refund or sensitive financial information,” said IRS Commissioner Chuck Rettig in a statement Thursday. “This latest scheme is yet another reminder that tax scams are a year-round business for thieves. We urge you to be on-guard at all times.”
The new scam illustrates the growing sophistication of cybercriminal organizations. The scam now relies on dozens of compromised websites and web addresses that pose as IRS.gov, making it a challenge to shut down. By infecting computers with malware, these impersonators can get control of a taxpayer’s computer or secretly download software that tracks every keystroke, eventually giving them access to passwords to sensitive accounts, such as financial accounts.
The IRS, state tax authorities and the tax industry that are part of the Security Summit effort noted that they have made progress in fighting stolen identity tax refund fraud, but victims remain vulnerable to scams by IRS imposters who send them bogus emails or make harassing phone calls.
The IRS emphasized that it doesn't initiate contact with taxpayers via email, text message or social media to ask for personal or financial information. That includes requests for PIN numbers, passwords or other access information for credit cards, banks or other financial accounts.
The IRS also doesn’t call taxpayers to demand immediate payment using a specific payment method such as a prepaid debit card, gift card or wire transfer. The IRS typically will first mail a bill to a taxpayer who owes taxes.
For more information, see the
