Scamdemic: Preparers help clients dodge COVID schemes

Bad situations can bring people together, and it appears that COVID-19 has brought together a lot of online scammers and victims.

Recently, the IRS warned of a “new twist” text scam to trick victims into disclosing bank account information under the guise of receiving their $1,200 Economic Impact Payment using a fake phishing URL that apparently comes from a state agency or relief organization. The URL instead takes recipients to a fraudulent website that impersonates the IRS.gov “Get My Payment” website, where victims unwittingly surrender personal and financial account information that scammers then harvest.

COVID offers fertile ground for fraud as millions frantically click and open emails for everything from hotspots and surgical masks to charities and toilet paper — usually from behind flimsy home firewalls because business offices are closed.

“When it was first announced that taxpayers would receive stimulus payments, we included information in all of our newsletters regarding these types of scams. Hopefully, that helped,” said Enrolled Agent Twila Midwood at Advanced Tax Centre in Rockledge, Florida, who added that she hasn’t had any clients victimized that she knows of.

It’s just the latest in a long trail of tax and financial scams leveraging the internet and e-communications to steal.

EA John Dundon, president of Taxpayer Advocacy Services in Englewood, Colorado, said his widowed mother was taken for $4,000 in Walmart gift cards. “We speculate that one of the phishing attackers who unsuccessfully attempted to compromise my business server wound up figuring out who my mom was and going after her,” he said.

‘Probably a scam’

The IRS constantly warns taxpayers of evolving threats and scams from fraudsters. “There are thousands of variations of COVID-related scams, including many related to the economic stimulus payment by the IRS,” according to an announcement from the IRS, state tax agencies and the tax industry (a.k.a., the Security Summit) kicking off their 5th Annual National Tax Security Awareness Week.

Probably nobody can get through to taxpayers like their own preparer.

“Because of many identity-theft issues about 20 of my clients had in the 2015 season, I’ve tried to share all known scams with them through email or newsletters so they know what things to look for,” said Burbank, California, CPA Brian Stoner. “My biggest point is, anything from a government agency through a phone call or email is probably a scam, so check it out carefully before responding. So far, I haven’t had any clients being victims, but have had a few tell me they got this item or this email or this phone call.”

“I communicate early and often about known and possible scams, and I frequently share information from the IRS, [the Treasury Inspector General for Tax Administration], the [Federal Trade Commission] and so on with the latest warnings and updates,” said Phyllis Jo Kubey, president of the New York State Society of Enrolled Agents.

The first thing to communicate to clients: Tax authorities don’t text taxpayers asking for bank account information. (Clients who receive the above text scam should take a screenshot of the text message and include the screenshot in an email to phishing@irs.gov, along with the date, time and time zone that they received the message; the number that appeared on their caller ID; and the number that received the text message.)

Sophia Germer/Bloomberg

Weak links

Those authorities are waging a ceaseless war on cyber crooks. Tax Security Awareness Week topics include passwords and security software, secured web addresses, unsecured public Wi-Fi, multifactor authentication and the special vulnerability of small businesses to cyberattacks.

Tax information, unfortunately, makes a juicy target. Recently, the IRS began masking sensitive information on business tax transcripts to safeguard taxpayers against the threat of ID theft.

Starting in January, taxpayers who can verify their identities will be able to get an Identity Protection PIN, a six-digit number renewed annually that prevents anyone else from filing a bogus return using a taxpayer’s Social Security number. Perhaps mindful of its own warnings about scammers’ ingenuity, the IRS promises the clearance vetting will be “rigorous.”

Another Security Week topic is virtual private networks. Dundon’s mother is on one now and “her internet activity is closely monitored,” her son said.

“Every time I talk to her,” Dundon added, “the conversation ends with me saying, ‘Don’t click on any links, and I love you.’”