In this particular example, hackers sent out form W-8BEN - which is typically used to establish foreign status for tax purposes - to a victim by mail or through a fax. Fake tax formsīesides tax documents, fake tax forms are also used to harvest sensitive data in phishing attacks.
Besides extortion or fraud, this information can also be used to steal your identity.
However, if the recipient downloaded and opened the file, they were taken to a dangerous website that installs infostealer malware on their computer.Īs the name suggests, infostealer malware is designed to gather up sensitive data stored on your computer or in your browser, extract it and send all of it back to hackers. SpiderLabs also recently observed a tax scam that involved phishing emails that contained a Microsoft Word file named “W2-2022.docx” that claimed to contain important tax details. Hackers are well aware of this and often use it to their advantage.
Whether you’re dealing with your employer, an accountant, businesses you’ve invested in or a tax filing service, you’re likely going to have a lot of tax-related documents in your inbox come tax season. Sometimes, you might get a call from the tax agency, but this is extremely rare, and you would be expecting such a call from your previous correspondence with the IRS. Also, the government agency will likely never contact you by email or over the phone as it prefers to do things the old fashioned way - through the mail. The email itself asks potential victims to review the attached HTML document and input sensitive information like their mother’s maiden name, Social Security number and date of birth which can be used to commit fraud or even worse, identity theft.Īs a general rule of thumb, the IRS isn’t going to ask you for this kind of information, as they already have it. Likewise, SpiderLabs also came across another IRS-themed phishing email that uses a share request to lure in victims. They often use threats of prosecution for breaking the law or a lower tax payment in an effort to deceive unsuspecting taxpayers.Īccording to a new blog post (opens in new tab) from Trustwave’s SpiderLabs, security researchers recently came across a phishing email that offered $16.5 million in approved funds if the recipient provides all of the required information - which includes their name, address, phone number, occupation and ID card. Just like with Instagram, YouTube, Netflix and other popular brands, hackers love to impersonate the IRS in their scams.
0 kommentar(er)
