Hackers got their hands on information from around 110 million AT&T customers when they were able to breach the company’s records.
The data stolen from the telecom is only the latest security breakdown. At least 1 billion records have been stolen or accessed in data breaches this year, according to TechCrunch.
All those stolen records are one reason why so many of us are getting more phishing emails and smishing texts. The illegally obtained data also helps crooks and con artists gain entry into additional networks that have high-value information, like taxpayer data.
That’s why the Internal Revenue Service and its Security Summit partners in state tax agencies and the tax professional community are warning tax professionals to be aware of evolving phishing scams and cloud-based schemes designed to steal sensitive taxpayer information.
“We continue to see a barrage of email and related attacks designed to trick tax professionals and gain access to their sensitive information,” said IRS Commissioner Danny Werfel. “These attempts can be elaborate, multi-layered efforts that look convincing and can easily fool people. Tax professionals need to be wary and educate their employees to use extra caution to protect their clients and their businesses.”
The summertime warning also underscores the pervasiveness of these illicit efforts to get tax-related information. The variants of the email attacks alone routinely number in the hundreds and can target tax professionals whether it’s tax season or not, said the IRS.
Types of security threats: Phishing and related scams are all designed to achieve one goal, trick the recipient into disclosing personal information such as passwords, bank account info, credit card data, or Social Security numbers.
The IRS outlined the different types of system compromises that tax professionals and taxpayers routinely encounter.
- Phishing/Smishing — Phishing emails or SMS/texts, known as smishing, attempt to trick the recipient into clicking a suspicious link, filling out information, or downloading a malware file. Phishing attempts often are sent to multiple email addresses at a business or agency increasing the chance someone will fall for the trick.
- Spear phishing — This specific type of phishing scam bypasses emailing large groups at an organization. Instead, it identifies potential victims, and delivers a more realistic email known as a lure. These types of scams can be trickier to identify since they don't occur in large numbers. They single out individuals, can be specialized and make the email seem more legitimate. Scammers can pose as a potential client for a tax professional, luring the practitioner into sharing sensitive information.
- Clone phishing — This is a newer type of phishing scam that clones a real email message and resends it to the original recipient pretending to be the original sender. The new message will have either an attachment that contains malware or link that tries to steal information from the tax professional or recipient.
- Whaling — Whaling attacks are very similar to spear phishing, except these attacks are generally targeted to leaders or other executives with access to secure large amounts of information at an organization or business. Whaling attacks can also target people in payroll offices, human resource personnel and financial offices.
The IRS and Security Summit partners also continue to see attacks that take advantage of cloud-based systems. Multi-factor authentication options provide an additional layer of security to access a system by using a phone, text messages, or tokens. Since email is easier for identity thieves to access, having these layers of security helps guard against potential vulnerabilities.
Scam warning signs: Regardless of the type of security compromise attempt, they share some common warning signs, listed below.
- An unexpected email or text claiming to come from a known or trusted source such as a colleague, bank, credit card company, cloud storage provider, tax software provider or even the IRS and other government agencies.
- A duplicate email from what appears to be a known trusted source that contains a new attachment or hyperlink.
- A message, often with an urgent tone, urging the receiver to open a link or attachment. These messages have a false narrative, like someone’s password has expired or some other urgent action is needed.
- An email address, number, or link that's slightly misspelled or has a different domain name or URL. A common website ploy used by crooks is IRS.com instead of the real IRS.gov naming convention. Taking a closer look at these email addresses, such as hovering the cursor over the email address, can show slight variations on legitimate addresses.
“There are major red flags that can be easily overlooked, so tax professionals and taxpayers should be extra careful and look closely when they receive an email from an official looking source,” Werfel said.
You also might find these items of interest:
- Don't fall for tax text message scams
- Beware latest tax scams: fake IRS refund emails to taxpayers, EFIN phishing of tax pros
- Fake business tax credits, bogus charities, and phishing and smishing all make the 2024 IRS Dirty Dozen list
Advertisements
🌟 Search Amazon Electronics 🌟
The text link above is an affiliate ad. If you click through and then buy a product, I receive a commission.
