Tax Season Scams: How to Stay Safe From ‘IRS’ Fraudsters

Update (3/21/2018): More than 10,000 present and former employees of The Travel Corporation had their sensitive personal information exposed after the company's Director of Human Resources sent copies of employee W-2 forms to a hacker impersonating the Global CEO through business email spoofing.

The data exposed includes "names, addresses, Social Security numbers, and W-2s of all present USA employees and a number of former USA employees," according to a notice of data breach sent to employees of The Travel Corporation. These employees are now at serious risk of identity theft and tax fraud.

If you are a present or former employee of The Travel Corporation and your information was exposed in this W-2 form phishing scam, our attorneys may be able to help. Fill out our free, no-risk case evaluation form today.

Some people file their taxes immediately after receiving their W-2 form, eager to receive their annual tax return. Others take their time with the tricky process of filing taxes, or reluctantly put off paying their tax bill until the last minute. Regardless of your feelings about Tax Day, it’s in your best interest to file your taxes as quickly as possible this year — because if you don’t, a scammer might just do it for you.

In 2016 alone, $21 billion was lost to false tax refunds, according to the IRS.

Tax fraud is a growing crisis in our country. In 2016 alone, $21 billion was lost to false tax refunds, according to the U.S. Internal Revenue Service, and that figure is only likely to grow as data breachesand identity theft become more common, and scammers become savvier.

If you’re not concerned about the latest tax scam threatening consumers, you should be. Read more to learn how to stay safe this tax season and how to spot fraudsters impersonating IRS representatives.

FBI Warns Employers About This Year’s Tax Season Threat: W-2 Phishing Scams

This year, the IRS and the Federal Bureau of Investigation warn employers to remain vigilant against this year’s most popular type of tax phishing scheme: business email spoofing to obtain W-2 forms.

This scam involves a criminal impersonating a business executive through a compromised or spoofed email in order to obtain the entire organization’s W-2 information from the company’s payroll or human resources department, according to the FBI.

Once they obtain this information from unwitting payroll employees who believe they’re sending the W-2 forms to a trusted professional within the company, hackers will file bogus tax returns, according to The New York Times.

Since 2017, over 200 employers have fallen victim to the W-2 form phishing scheme.

These funds will go into the affected taxpayer’s account, and soon after, a scammer impersonating an IRS collections officer will call demanding the refund be “returned” to a specified account, or else the taxpayer will face criminal charges. In some cases, the hacker may simply sell your tax information on the “Dark Web” to the highest bidder.

Scammers have been increasingly using W-2 phishing schemes, because with one email they can potentially score treasure troves of employee data. And, unfortunately, this has been an effective scam. Since 2017, more than 200 employers have fallen victim to the W-2 form phishing scheme, compromising hundreds of thousands of their employees’ tax information, according to Forbes.

The FBI advises that employers stay safe from this scam by educating payroll and human resources employees about the W-2 phishing scheme as soon as possible, and limiting the number of employees who have the authority to approve and handle W-2 related requests or tasks within the business.

If your business received an email that you suspect is an W-2 form phishing email, don’t respond to it. Save the phishing email as an email file on your computer and report the scam by emailing it as an attachment to phishing@irs.gov.

How Do I Know If That IRS Call or Email Is Legitimate?

Not all tax schemes involve the spoofing of business executive emails. Some take the form of individuals impersonating the IRS.

No one wants to get on the bad side of the “taxman.” Unscrupulous hackers often take advantage of these common worries about the IRS to trick taxpayers into disclosing sensitive tax information over email or phone through threat and bullying.

However, it’s important to know that the IRS does not initiate contact with people by phone call or email, except in rare cases. Instead, the agency sends letters via the U.S. Postal Service, as a policy. In the special circumstance that the IRS makes a call or home visit, they will send several notices in the mail first.

Additionally, the IRS will never:

• Contact taxpayers by email, text message, phone, or social media channels to demand payment.
• Request PINs, passwords, or access information for financial accounts.
• Demand immediate payment without the opportunity to question or appeal that tax amount.
• Demand specific payment methods like prepaid debit card, gift card, or wire transfers.
• Threaten to bring in law enforcement to have you arrested or deported for not paying.
• Threaten to revoke your driver’s license or business license for not paying.

If a person who claims to be an IRS representative does any of the above, they’re almost certainly a scammer, and should be reported to the IRS immediately at phishing@irs.gov.

Identity Theft Victims Also Have to Be Vigilant This Year

Scammers may change the target of their scheme, or the way they illegally obtain their information, but what doesn’t change is the fact that tax season scams are a major consumer concern in the weeks leading up to Tax Day.

Along with W2 phishing schemes, identity theft is another major tax scam concern this year, especially in the wake of the 2017 Equifax data breach, which exposed the sensitive data of at least 147.9 million Americans.

Social Security numbers and tax ID numbers were among the sensitive data revealed in this breach, putting consumers at higher risk of tax fraud. Scammers with those two pieces of data can use your Social Security number to file a false tax return in order to claim fraudulent refunds.

If you are a data breach victim, the IRS and the U.S. Federal Trade Commission recommend the following steps to protect yourself against fraudulent tax returns:

• File your taxes as soon as possible — that’s your best defense against tax fraud.
• Notify one of the three major credit bureaus to place a free fraud alert on your credit file.
• If you’re seriously concerned, consider a credit freeze, which prevents access to your credit records until lifted.
• Take advantage of free credit monitoring, if the company that exposed your information offers it.
• Don’t believe anyone who calls or emails and says you’ll be arrested unless you provide immediate tax payment, even if they have your Social Security Number and claim they’re from the IRS.
• Regularly monitor your credit reports. You can order a free report from each of the three credit reporting agencies (Equifax, Experian, and TransUnion) each year.

Data Stolen in a W-2 Phishing Scam? We May Be Able to Help

As we approach April 18, employers should remain at high alert to W-2 form phishing emails for the sake of their business and their employees.

If your data was stolen in a W-2 form phishing scam, and you suffered subsequent identity theft in the form of a fraudulent tax return, our attorneys may be able to help you.