Coming in at number eight on the dirty dozen list the IRS is urging tax professionals and other businesses to be aware of spearphishing emails. These are emails which scammers try to steal client data, tax software preparation credentials and/or tax preparer identities. Scammers typically try to manipulate spearphishing with a goal of obtaining fraudulent tax refunds.
Phishing attempts are known as emails or text messages designed to trick users into providing personal information directly or by clicking on a link or attachment. Spearphishing is a specific phishing attempt targeted at organizations and businesses.
Spearphishing emails can range from information that looks like a new client reaching out or a request targeting payroll and human resource departments asking for sensitive W-2 information. IRS Commissioner Danny Werfel said “There are simple steps that tax pros and businesses can take to avoid being fooled by these common schemes, including extra caution when opening emails, clicking on links or sharing sensitive client data”. A successful spearphishing attack can steal client data, the taxpayers identity or financial information allowing the scammer to file fraudulent tax returns.
It is important that tax professionals are always on the lookout for suspicious emails, as they are typically the start of a spearphishing attack. The potential number of victims rises from a successful spearphishing attempt targeted towards tax preparers and their credentials. The two most common attempts are client impersonation and bogus requests for W-2s.
Tips and tricks to avoid spearphishing:
- Never click suspicious links.
- Double check requests with the original sender.
- Be vigilant year-round, not just during tax filing season.
If you or someone you know falls victim to a spearphishing attack, visit our Tax Fraud Prevention webpage for more information on how to report tax fraud.