The Internal Revenue Service, state tax agencies, and the tax industry, as part of the Security Summit, are warning tax professionals about a new scam making the rounds. The new scam involves a phishing email scam impersonating tax software providers and attempting to steal usernames and passwords.
The timing isn’t coincidental: now is the time when many software providers issue software upgrades as tax professionals work to meet the September 15 and October 15 deadlines for taxpayers filing on extension.
The email typically has a subject line that reads “Software Support Update,” “Important Software System Upgrade,” or similar. The body of the email, which mimics the software providers’ email templates, advises that due to a recent software upgrade, the tax preparer must revalidate their login credentials. The email then directs users to a link to what is really a fictitious website that mirrors the software provider’s actual login page. Instead of a software upgrade, the preparers get taken: their information is directed to cybercriminals who use the stolen credentials to access the preparers’ accounts and to steal client information.
It’s a similar strategy to a scam reported in June where thieves pretended to be from a tax software education provider seeking sensitive preparer data.
These types of phishing scams are why the Security Summit launched the 10-week Don’t Take the Bait campaign. The Security Summit officially began on March 19, 2015, when IRS Commissioner Koskinen met with IRS officials, leaders from top tax preparation firms, software developers, payroll and tax financial product processors, and state tax administrators to discuss how they could best protect taxpayers. This most recent awareness effort highlights the many tactics of the cybercriminal, as well as the steps tax professionals, can take to protect their clients and themselves.
All tax professionals should remember that legitimate businesses and organizations will never ask for usernames, passwords or sensitive data via email. And obviously, tax preparers should never provide such sensitive information via email.
Additionally, it’s important to remember that anyone handling taxpayer information has a legal obligation to protect that data. If you have received or fallen victim to the scam email, forward a copy to phishing@irs.gov. Finally, if you have disclosed information and taxpayer data has been stolen, you need to contact your local stakeholder liaison.
For additional tips to protect clients and taxpayer data, tax professionals can check out Protect Your Clients, Protect Yourself on IRS.gov.
