Tax and IRS Phishes

Introduction to Tax and IRS Phishing Campaigns

In the cyber world, anticipation of a major deadline or event can become a lucrative opportunity for attackers. Tax time is no exception.

Tax and IRS phishing campaigns

exploit the stressful and often confusing nature of tax filing to deceive individuals and organizations into revealing sensitive data.

Typical Targets

Tax phishing

campaigns often target individual taxpayers, small businesses, and accounting firms. These groups may not only house valuable personal and financial information but are also more likely to respond to attempts that seem to be directed by tax authorities.

Tactics, Techniques, and Procedures (TTPs) Used

Email Spoofing: Attackers spoof legitimate-sounding email addresses, such as donotreply@irs.gov.
Social Engineering: Phishers employ urgency and fear tactics, invoking penalties or audits to push targets into quick action.
Payloads: These can include attachments containing malware or links to fraudulent websites designed to look official.

Phishing Lures

Subject Lines and Spoofed Senders

Immediate Action Required: IRS Tax Payment Issue
Urgent: Your Tax Refund Is On Hold
Audit Notification: Respond Within 24 Hours

The emails often appear to come from

irs.gov

or similar domains, tricking individuals into believing they are legitimate.

Common Pretexts

Phishing campaigns may claim the target owes additional taxes or is eligible for a large refund, requiring the target to “confirm” personal information. Another pretext is threatening actions like account suspension unless immediate action is taken.

Understanding the pretext in phishing emails is crucial to identifying the scam quickly. The importance of scrutinizing source legitimacy cannot be overstated.

Payload Delivery and Credential Harvesting Methods

Phishing emails may contain

attachment payloads

such as PDFs purporting to be tax forms, or they may direct users to spoofed sites that imitate the IRS’s online payment page.


Email Sample:

From: donotreply@irs-gov.com

Subject: Urgent: Review your Tax Statement

Dear Valued Taxpayer,



We have an issue processing your tax return. Open the attached document for details.

Attachment: IRS_Tax_Issue.pdf



Regards,

Internal Revenue Service

Once users download the attachment or visit the fraudulent link, they are prompted to enter their

Social Security Number

bank account information

, or other sensitive data.

Detection and Response

Detecting Tax Phishing Attacks

Email Filtering: Advanced spam filters and

anti-phishing

solutions are essential for identifying and blocking suspicious emails.
Metadata Analysis: Reviewing email headers can reveal discrepancies in

origin IP

and

header credentials

.
Behavior Monitoring: Monitoring user activity for interactions with unusual URLs can provide early warnings of a phishing incident.

Responding to an Ongoing Attack

Immediately isolate the affected systems to prevent further data loss.
Notify financial institutions and request a freeze on transactions.
Perform a full audit of accessed files to assess potential data breaches.
Contact the IRS directly to confirm the legitimacy of any suspicious communication.

Key Lessons

Never trust unsolicited tax-related emails: The IRS doesn’t initiate contact with taxpayers by email, text messages, or social media.
Scrutinize Email Sources: Always verify the sender’s domain, especially when dealing with government-related correspondence.
Educate Employees and Clients: Conduct training sessions on identifying phishing attempts, especially during tax season.
Implement Robust Security Measures: Use multi-factor authentication and regular backups to avoid data loss.