Key Takeaways:
- Scams take many shapes and forms, such as phone calls, letters, and emails.
- Tax professionals are cautioned about email scams disguised as new client inquiries which contain malicious links designed to steal their data.
- To protect themselves, individuals are advised to ignore unsolicited requests for personal information, verify the authenticity of any suspicious communications directly with the organization, and ensure tax preparers are legitimate and authorized.
Once again, cybercriminals are taking advantage of tax season to rev up their malicious activities, and their targets are not only taxpayers but also tax professionals.
The IRS has identified the most common tax scams that it sees happening and has reminded taxpayers that it never contacts taxpayers by phone to discuss their personal tax issues, nor does it contact taxpayers by email unless the taxpayers have opened an IRS account and signed up for email communications. The IRS never asks for identifying information such as bank account numbers, credit card numbers or Social Security numbers by phone or email.
As in previous years, email-based messages are the most common scams being perpetrated this year, and one of the most common is aimed at tax professionals. The message states that the writer’s personal CPA has retired and asks if the professional is accepting new clients. It then directs the professional to click on a link to access information about the writer. Naturally, the link is malicious and enables the scammer to access the professional’s data.
Following are 10 prevalent tax scams identified by the IRS, and tips on how to protect yourself.
Phishing scams
These email attacks encompass a wide variety of scams that are designed to convince the receiver that the message is legitimate and get them to click on a link included in the email. These links typically lead to fake websites created to record any information the user inputs using different forms of spyware. These emails and websites are frequently very well designed to emulate real websites for organizations victims may do business with, such as credit card companies, banks, TurboTax or the IRS.
How to protect yourself: If you receive an email that contains an alarming message (i.e., “Your account has been hacked and you must act now to protect your data”) and includes any links that you are directed to click, do not click anything. If you have an account with the alleged sender, look up their Customer Support number – on a separate screen, not in the suspicious email – and call them to ask if the email is real. Also, look in the email header for the originating email address. If it doesn’t bear any resemblance to the alleged sending organization, it is a phishing scam. Delete it from your computer.
“Unexpected refund”
These messages may arrive by phishing email or cell phone text, alleging that “The IRS noticed a miscalculation on your tax return. Please fill out this form to claim your new tax refund.” The link that leads you to a form actually provides the scammer with access to your data and may ask for information like bank account numbers. This is a “social engineering” scam, designed to manipulate you into providing sensitive information such as your social security number, birthdate, and driver’s license number. Scammers can use this information to break into your bank account or even take out loans in your name.
How to protect yourself: Remember, the IRS will never send you an email unless you have opened an IRS account and opted in to email communications, and the IRS will never call you on the phone about an unexpected tax refund.
Gift card scams
It’s hard to believe, but scammers have turned to gift cards to cheat people out of their money. The scammer calls or emails you pretending to be an IRS agent, notifying you of an unexpected tax penalty or overdue tax. They then instruct you to buy gift cards from different stores and give them the card numbers and PINs to pay the balance.
How to protect yourself: Remember, the IRS will never request credit card, debit card or gift card numbers, and the IRS will never contact you by phone about an outstanding debt.
Tax-related identity theft
Your Social Security number (or Tax Identification Number), address, and birthdate must be protected because cybercriminals use them to file fraudulent tax returns in your name and collect large tax refunds. You would likely have no idea this has happened until you tried to file your tax returns and received an IRS letter informing you a tax return was already filed under your name and Social Security number for the period in question. You may also receive notification of an IRS account being created in your name or an unsolicited tax transcript.
How to protect yourself: Never provide your Social Security number or Tax Identification Number to anyone you don’t know or who calls you on the phone to inform you of any type of “discrepancy.”
Fake charity scams
Cybercriminals will call a target and aggressively solicit a donation that must be made immediately to beat a fake deadline. They will pressure you to provide a credit card number over the phone to expedite the donation and assure you that it is tax deductible.
How to protect yourself: Never give anyone your credit card number or bank account information over the phone. These types of calls are often concentrated in certain geographic areas and should be reported to local police, who will convey the information to the appropriate law enforcement agencies that deal with cybercrime.
Verification requests
You may receive a phone call or email allegedly from the IRS asking for a “verification” of certain data, such as your W-2 or other identifying documents. If the message is received by email, it may ask you to upload a document. The only time the IRS requests ID verification is when irregularities appear on your tax return, in which case they’ll send a notification by U.S. mail.
How to protect yourself: Remember, the IRS will never call you on the phone and will only email if you have opened an IRS account and opted-in to email communications.
IRS phone scam
These scams have been around for years, and they continue only because, unfortunately, many people fall for them. The caller will trick you into believing they work for the IRS, and they may even have some of your personal information to convince you they are legitimate. If you question any of their information, they often become threatening and say that law enforcement will contact you within days if you don’t cooperate. These scams take different forms, including:
- A threat of legal action if a tax debt is not paid immediately.
- An allegation that you have a tax penalty related to your most recent tax filing.
- An untrue notification that you qualify for a tax rebate for filing early.
- An untrue statement that you never cashed a past IRS refund check can be deposited directly to your account if you provide your bank account number.
How to protect yourself: Hang up. The IRS will never call you about any of these issues or ask you for credit or debit card numbers. Above all, do not verify any personal data they may have.
COVID-19 stimulus check scams
Although the pandemic is behind us and related government benefits ended long ago, cybercriminals are still making hay from it. This particular message often arrives by cell phone text from a scammer claiming to be from the IRS, informing you of a “stimulus” check you qualify for. An attached link instructs you to provide sensitive personal information that they use to hack your accounts and potentially steal your money and identity.
How to protect yourself: Do not click on any links, and delete the texts immediately. Again, the IRS never communicates by text.
Taxpayer Advocate Service scam
The Taxpayer Advocate Service is an organization within the IRS that researches and reports to the public on IRS operations and how they can be improved to benefit taxpayers. Cybercriminals make phone calls posing as TAS representatives and tell victims they qualify for an “increased tax refund,” but that they must provide their Social Security number, birthdate and other personal information to claim the refund.
How to protect yourself: Hang up. The Taxpayer Advocate Service does not call individuals for any reason, and the IRS would never contact a taxpayer by phone to discuss a refund.
“Ghost” tax preparers
An illegitimate tax preparer charges you to prepare your tax return but refuses to sign it, telling you they are not required to sign because your income is below a certain threshold. They may also insist on being paid in cash or suggest that you have your tax refund deposited to their bank account. They pocket your money and never file your return.
How to protect yourself: All tax preparers must have a valid Preparer Tax Identification Number (PTIN) and must sign your return when it is completed. Ask to see their PTIN before you hand over your tax documents. Tell them upfront you will pay by check or money order. When your return is completed, make sure you see their signature on it before the return is filed. If the return is e-filed, you should receive an email confirming it has been filed.
If you believe you have been the victim of cybercrime and your tax information or financial data may be at risk, contact your KRD advisor and your local police.
