Cyber crime computer keyboard
gettyThe IRS is again warning taxpayers about scams and schemes targeted to taxpayers and tax professionals as part of this year's Dirty Dozen.
Dirty Dozen
The "Dirty Dozen" is an annual list of common scams taxpayers may encounter. Many of these schemes peak during tax filing season as people prepare their returns or hire someone to help with their taxes.
The list of 12 scams and schemes—hence the name—started in 2002. These scams and schemes put taxpayers, businesses, and the tax professional community at risk of losing money, personal information, and data. While the Dirty Dozen is not a formal listing of IRS enforcement priorities, it's designed to raise awareness and protect taxpayers and tax professionals.
Phishing And Smishing
Phishing and smishing may sound fun (the 90s grunge fan in me immediately thinks of moshing), but they are far from it. These are fake communications posing as actual notices from legitimate organizations intended to trick you.
Specifically, phishing is a form of email sent by scammers impersonating the IRS or other legitimate organizations. The email lures victims by pretending to have something of value—like a phony tax refund—or scaring them into believing that they must act immediately—like suggesting false criminal charges are imminent.
Smishing is similar to phishing, but scammers use text or smartphone SMS messages instead of email. Scammers often use intimidating language like "Your account has now been put on hold" or "Unusual Activity Report" with a bogus link to restore your account. They hope that you'll click the link so that they can collect information from you or send malicious code to your phone.
"Scammers are relentless in their attempts to obtain sensitive financial and personal information, and impersonating the IRS remains a favorite tactic," said IRS Commissioner Danny Werfel. "People can be anxious to get the latest information about their refund or other tax issues, so scammers frequently try using the IRS as a way to trick people. The IRS urges people to be extra cautious about unsolicited messages and avoid clicking any links in an unsolicited email or text if they are uncertain."
Recent Variations
This year, in particular, tax professionals have seen an uptick in "new client" scams. These scams may be accompanied by PDF or Zip files allegedly containing tax forms or transcripts or directions to download files that have recently been uploaded for your convenience.
Sometimes, the headers imply that there's an ongoing relationship, like "Follow-up on my last email" or "my request," while others suggest that the "new client" found you on the web or through a referral—a recent example read "I am currently seeking a new CPA, and your expertise has caught my attention. Could you please advise on the documents you typically require from clients? I'd like to enter that I have everything prepared for our potential collaboration."
Be skeptical about emails you aren't expecting, even if they look like they are from your tax professional (or client). And use trusted platforms, such as dedicated portals, to upload and download emails and other data.
The IRS notes that in some cases, phishing emails may appear to come from a legitimate sender or organization whose email account credentials have been stolen. Setting up two-factor or multi-factor authentication can reduce the risk of individuals' email accounts being compromised.
Additionally, posing as a trusted organization, friend, or family member remains a common way to target individuals and tax preparers for various scams. Individuals should verify the identity of the sender by using another communication method, for instance, calling a number they independently know to be accurate, not the number provided in the email or text.
Online Account "Help"
Another tech-focused scheme involves scammers who offer to help set up an Online Account on IRS.gov—sometimes for a fee. The goal for these criminals is to get personal tax and financial information that can be used to commit identity theft.
The IRS has been ramping up its online capabilities for individual taxpayers, business taxpayers, and tax professionals. Services may allow you to access your transcripts, pay bills, check notices, and account balances. The online services can be excellent time savers, and if you're a regular reader, you know I'm a fan.
But this information is also valuable to identity thieves, who use it to submit fraudulent tax returns in a victim's name to get a big refund, making you a target.
In these scams, a third party offers to "help" you create an online account at IRS.gov. That means they may ask for your personal information, including address, Social Security number or Individual Taxpayer Identification Number (ITIN), and photo identification. Instead of using this information to help, the scammers can sell it or use the sensitive details to file fraudulent tax returns, obtain loans, and open credit accounts.
The only place to go to create an IRS Online Account is IRS.gov—the best plan of action is to navigate there directly (I keep it bookmarked on my laptop for easy access). The IRS says you should not use third-party assistance other than the approved IRS authentication process through IRS.gov to create your own IRS Online Account. I would caveat that some third parties, like trusted tax professionals with whom you already have a relationship, can help you set up your account—but in most cases, they may walk you through the process without asking for your personal information. Even if you trust your tax professional, there is no need to give them access to your online account—keep your password to yourself.
IRS Commissioner Danny Werfel noted, "An Online Account at IRS.gov can help taxpayers view important details about their tax situation. But scammers have realized the sensitive information there is valuable to them, so they're now focusing on tricking people that they need help setting up an account."
But, Werfel says, "This is just an elaborate scam designed to obtain valuable and sensitive tax information that scammers will use to try to steal a refund." Werfel added. "This is another reminder that people should be wary of unexpected reach-outs from the IRS and other financial institutions. Taxpayers should avoid sharing sensitive personal data over the phone, email, or social media to protect themselves and avoid getting caught up in these scams."
IRS Contact
The IRS reminds taxpayers that your first contact with the agency will tend to be through the mail. The IRS will never initiate contact with taxpayers by email, text, or social media regarding a bill or tax refund.
Protect Yourself
To protect yourself, if you receive any unsolicited communication claiming to be from the IRS via email or text:
- Don't respond. Any engagement could put you at risk. Remember, this is how scammers make a living—their goal is to persuade you to give up your information, so don't give them an additional opportunity.
- Don't open attachments. Even if they look harmless, they can contain malicious code that may infect your computer or mobile phone.
- Don't click on links. Visit the IRS identity protection page if you clicked on links in a suspicious email or website and entered confidential information.
- Forward the text or email, preferably with the full email headers, to phishing@irs.gov. Send the whole email and not a scan (simply forwarding scanned images removes valuable information). The IRS also asks that you include the sender's contact information (email or phone number), date, time, time zone, and the number that received the message.
- Delete the original email or text.
The Federal Communications Commission has a Smartphone Security Checker that provides valuable tips. It features best practices on setting pins and passwords, where to find security apps, how to enable remote locating and data wiping, and how to back up and secure your data if your device is lost or stolen. There is also information on how to safely use public Wi-Fi networks and what steps to take if your phone is stolen.
Report Bad Actors
If you experience monetary losses due to these scams, the IRS encourages you to report them to the Treasury Inspector General for Tax Administration (TIGTA), the Federal Trade Commission, and the Internet Crime Complaint Center (IC3).
Tax Breaks: Timely tax tips and the latest news delivered to your inbox weekly
