LEXINGTON, Ky. (LEX 18) — In today’s electronic age, tax forms have moved online. With that comes a whole mess of searching for W-2 emails and last year’s login information.
According to Alex Risen, head of marketing at cybersecurity company PhishingBox, the chaos of emails, forms, and passwords invites cybercriminals to step in.
“It’s an opportunity for [cybercriminals] to try to jump in your inbox and send you something that looks just like a TurboTax email, just like an H&R Block email that you’ve received before.”
Not only will scammers use fake emails to send phishing images, but they will also call, posing as an IRS agent and claiming you owe money. Additionally, they will send links to fake sites asking for confidential information, like an identification number or a login.
“But you’re not logging in,” Risen said. “It’s taking you to a fake landing page where those cybercriminals are now harvesting your authentication credentials for your actual login.”
When a phish-y email, text, or call presents itself, Risen says the best course of action involves going directly to the source via a web browser.
“It’s always the safest to go direct, and that’s kind of one of the newer things to tell people is just don’t trust any of the links that are sent to you, whether its an email, whether it’s a text message.”
If something seems off, take time to hover over any links sent to see the full URL. That will tell if the link is real or fake.
Most organizations do not send emails or make calls to request confidential information anyway.
“Don’t ever trust that these organizations would be sending you that information,” Risen said. “A lot of times these organizations will tell you, we won’t send you this type of communication.”
The same goes for the IRS. The IRS will never initiate digital communications, so phone calls and emails asking for money should be an automatic red flag.
Risen said, “Just knowing that, hey, someone might be trying to take advantage of me. Again, I should go through legitimate, known websites. I should go directly through things that I’ve done before, the portals that I’ve used directly. I don’t need to interact with this email that’s telling me to log in.”
In 2023, the IRS received 294,138 complaints of reported identity theft. According to the Taxpayer Advocate Service, identity theft cases take an average of 19 months to resolve. This painful process is best avoided by playing defense on sketchy messages.
To report any tax-related scams or general phishing, visit irs.gov.
