the IRS on Social Engineering
We have had occasion to warn of this before, but as 2020 begins and April 15th approaches, it may be worth another mention. The US Internal Revenue Service wants taxpayers to keep a sharp eye out for the signs of social engineering. According to tweets the IRS issued at the end of December, “The most common way thieves steal identities is simply by asking for them.” This, of course, is especially a problem during tax season, when thieves file fraudulent returns, or use tax worries as the entering wedge of other social engineering campaigns.
The IRS Twitter feed offers a sound short list of things in communications that should put you on your guard.
Scammers often:
- “Pose as a trusted source.”
- “Tell you there’s something wrong with your account.”
- “Claim you’re in violation of a law.”
- “Tell you to open a link or an attachment.”
- “Ask you to log into a familar-looking--but fake--website.”
In every one of those cases, crooks have misrepresented themselves as IRS agents as they attempt to lure the worried, the conscientious, and the gullible into giving up sensitive information. That kind of impersonation works with all five of the tactics the IRS warns against. It’s also worth noting that most of them work equally well as smishing--that is, text messaging--or as vishing--that is, voice calls--as they do with conventional email phishing.
The tax agency points out on its website that there’s one sure sign that the person who says they’re from the IRS is in fact a scammer: “The IRS doesn't initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information. This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.” So if you’ve been contacted out of the blue by someone who says you owe taxes, that you might be about to arrested, or that the Government needs your bank account credentials, it’s fraud.
A threat to an individual is also a threat to that individual’s organization, and businesses and other organizations also deal with the IRS and other Government bodies. This kind of impersonation scam can be easily avoided, especially if an organization takes the trouble to offer its employees new-school security awareness training.
The IRS website has full details on phishing here: https://www.irs.gov/privacy-disclosure/report-phishing
Gloss