Just a few months after I reported seeing a bump in scam e-mails purporting to be from the IRS, a new version is making the rounds.
The new version is very similar to the prior version. As before, the header is a variation on Federal Tax payment canceled or Your Federal Tax Transaction. The ones in my inbox purport to come from specific individuals at IRS; two names that appeared were Luz_Wright@irs.gov and Ivory_Hardy@irs.gov. However, those addresses are spoofed. If you have a decent spam filter, it will probably catch it as the actual email appears to come from an “internet marketing” site listed on the Spamhaus Project database.
The text of the email says:
Your federal Tax transaction (ID: 17227176358924), recently from your checking account was returned by the your Bank.
And yes, the grammatical errors are theirs, not mine.
The new twist on this email is the little blurb at the bottom that says:
Important Information for Home-care Service Recipients
If you are a home-care service recipient who has a previously assigned EIN either as a sole proprietor or as a household employer, do not apply for a new EIN. Use the EIN previously provided. If you can not locate your EIN for any reason, follow the instructions on the Misplaced Your EIN? Web page.
If you are a home-care service recipient who does not have an EIN, do not use the online application to apply for one. You must apply for your EIN using one of the other methods (phone, fax or mail). For additional information, visit the How to Apply for an EIN Web page.
I’m not sure why they lifted that particular text as it doesn’t match the rest of the message but then nobody claimed the scammers were all that clever.
To be clear, many of the web pages referenced in the email actually exist at the official IRS web site. There really is a Misplaced Your EIN page as well as a How to Apply for an EIN page. Clearly, the scammers are just hoping to lull you into a sense of false security. Ignore it. If you need to check something out related to your EIN, pop on over to the real IRS site (they just updated it) or call the IRS at 1.800.829.1040.
The purpose of the email is clearly to get you to click on the link to the pdf in the email. Don’t do it. You can simply delete the email of you can send it to phishing@irs.gov for investigation.
As before, the link likely contains a virus that could infect your computer or direct you to a site in order to steal your identity or otherwise access your financial information.
Best advice? Ignore all of these tax emails. Remember that the IRS will never send an unsolicited e-mail about your tax account or tax matters. Ever.
