Recommended by: Jerry Beard
A new Security Summit Alert was posted this week on the IRS website informing individuals and tax professionals of a new email scheme threat. The increasing number of email phishing and hacking schemes means that everyone must take precautions when opening and sending emails. We encourage everyone to contact their accounting professional to create a secure portal to transfer sensitive personal data safely and securely.
WASHINGTON – The Internal Revenue Service, state tax agencies and tax industry leaders today warned tax professionals to be alert to an email scam from cybercriminals posing as clients soliciting their services.
A new variation of this phishing scheme is targeting accounting and tax preparation firms nationwide. The scheme’s objective is to collect sensitive information that will allow fraudsters to prepare fraudulent tax returns.
These latest phishing emails come in typically two stages. The first email is the solicitation, which asks tax professionals questions such as “I need a preparer to file my taxes.” If the tax professional responds, the cybercriminal sends a second email. This second email typically has either an embedded web address or contains a PDF attachment that has an embedded web address.
In some cases, the phishing emails may appear to come from a legitimate sender or organization (perhaps even a friend or colleague) because they also have been victimized. Fraudsters have taken over their accounts to send phishing emails.
The tax professional may think they are downloading a potential client’s tax information or accessing a site with the potential client’s tax information. In reality, the cybercriminals are collecting the preparer’s email address and password and possibly other information.
The IRS urges tax professionals and tax preparation firms to consider creating internal policies or obtain security experts’ recommendations on how to address unsolicited emails seeking their services.
One tip: Never respond to or click on a link in an unsolicited email or PDF attachment from an unknown sender. As the IRS, states and the tax industry make progress in the fight against identity theft, cybercriminals are becoming more sophisticated in their efforts to steal additional client information. Criminals need more data in their effort to impersonate clients and file fraudulent returns to claim refunds, and schemes like this can help in this effort.
Read more at Protect Your Clients; Protect Yourself, the Security Summit initiative to increase awareness about the tax professional community.
For more resources on data breach protection, download Practitioner Data Breaches – IRS Resources @Your Fingertips
Jerry E. Beard, CPA, MST, is a Supervisor in the Tax Department of Ellin & Tucker. He has extensive hands-on experience providing tax compliance, planning, and consulting for a variety of clients with privately owned business operating in various industries and is also well versed in various tax services for trusts, estates and high net-worth individuals.