The IRS has recently alerted Tax Professionals to a new email scam where cybercriminals pose as potential clients. These criminals are impersonating real Taxpayers by pretending to look for assistance in preparing and filing their taxes. The email contains a malicious link or presented as tax information that the Tax Professional would need to prepare the tax return. Their objective is to steal personal information that allows the criminals to prepare fraudulent tax returns to collect a tax refund or use it to commit other types of identity theft and fraud. The IRS anticipates that the number of these emails sent likely runs in the thousands to tens of thousands.
“These intricate email scams pose a real risk to tax professionals and the taxpayers they represent,” said IRS Commissioner Danny Werfel. “Cybercriminals try to capitalize on tax season by masquerading as real taxpayers looking for help. What they really want to do is help themselves to the sensitive client data of tax professionals. We urge tax professionals and their employees to be extra cautious when receiving unexpected email solicitations and avoid clicking on links or opening attachments.”
Here’s an example of a current new client scam being seen:
Subject: 2024 Tax Submission
Hello,
My name is (name can vary), I am searching for another CPA to help handle my taxes.
Is it safe to say that you are accepting new clients for the 2024 tax season? Do you additionally assist with IRS representation?
I figured I may have an issue with last year's return. (Click) HERE TO VIEW MY CREDENTIAL [Link to a phishing web address]
Upon your approval, we can arrange a physical or virtual meeting to discuss my situation and also provide my tax documents amongst others.
Kindly prompt how you plan to push ahead.
Best Regards,
(Name varies)
Tax Professionals and Taxpayers should be aware that some emails may appear to come from a legitimate sender or organization that had their email account credentials stolen. The IRS recommends that everyone set up two-factor or multi-factor authentication with to reduce the risk of having your email account compromised. Tax Professionals and Taxpayers should also verify the identity of the sender by using another communication method.
If you’ve experienced any loss due to an IRS-related scam, it should be reported to the Treasury Inspector General Administration (TIGTA), Federal Trade Commission (FTC), and the Internet Crime Complaint Center.
Tax Professionals should always have a written security plan in place to mitigate data breaches. If you are a Tax Professional who has experienced a data breach, be sure you quickly contact the IRS Stakeholder Liaison, FBI, Secret Service, the State Attorney General, and local police to report the data breach.
