Don’t fall for tax ID theft phishing scam from crooks impersonating tax software companies

Every computer user is familiar with the constant updates to software. So are identity thieves.

And now these crooks are targeting tax professionals in a new phishing scam designed to steal usernames and passwords.

The Internal Revenue Service and its state and tax industry Security Summit partners say that this latest impersonation scheme variant is a sophisticated scam designed to get information that can be used to file false tax returns and collect fraudulent tax refunds.

It's the latest in a series of scams this summer that have targeted professional tax preparers.

Software upgrade hook: This is the time of year when many software providers issue software upgrades and when tax professionals are working to meet the Oct. 15 deadline for extension filers, notes the IRS.

The online crooks are taking advantage of the timing.

This latest scam email variation comes with “Software Support Update” as its subject line and highlights an “Important Software System Upgrade.” It thanks recipients for continuing to trust the software provider to serve their tax preparation needs and mimics the software providers’ email templates.

The fake email then informs the recipients that due to a recent software upgrade, the preparer must revalidate their login credentials. It provides a link to a fictitious website that mirrors the software provider’s actual login page.

But instead of upgrading software, the tax professionals are providing their information to cybercriminals who use the stolen credentials to access the preparers’ accounts and to steal client information.

Beware emails asking for secure data: Again, the IRS and Security Summit partners remind tax professionals — and anyone who gets a suspicious tax email — that software providers do not embed links into emails asking them to validate passwords.

Also, tax professionals and taxpayers should never open a link or an attachment from an unsolicited email.

As several of my tax pro friends have pointed out, make sure that every member of your tax and/or accounting office knows these rules. A little cyber security training can go a long way to protecting not only your tax business, but also your clients’ tax data.

Alert the IRS et al: If you or a staffer in your tax preparation office get one of these latest phishing emails from fake tax software providers seeking login credentials, alert your real software provider so the company can help get the word out about this scam.

Sharing the phishing attempt with the proper agencies also will help the IRS, state officials and the software manufacturers better catch these crooks and stop future ones.

To share with the appropriate authorities, the IRS says use the “Save As” option. When that tab opens, under “save as type” in the drop-down menu, select “plain text” and save to your computer’s desktop. Do not click on any links.

Then open a new email and attach the saved email in a message to your tax software provider, as well state officials at StateAlert@taxadmin.org and IRS at phishing@irs.gov.

You also might find these items of interest:

• IRS warns of four hot summer tax scams
• 5 ways to protect your tax identity and refund money
• Fear you might be a tax ID theft victim? Here's what to do