Jul. 26, 2006 - A Powerful Scam to Resist

Today's Wall Street Journal ran a tiny blurb about internet "phishing" scams which use the Internal Revenue Service (IRS) as the lure.

This fits perfectly with my recent posts, It Can't Happen to Me and Protecting Mom and Dad, so let's take a closer look at these "phishing" scams.

According to the IRS website, "phishing" is defined as:

"a scam where Internet fraudsters send e-mail messages to trick unsuspecting victims into revealing personal and financial information that can be used to steal the victims’ identity."

Most phishing scams use large financial institutions such as Citibank, Chase, PayPal, etc. as the lure, hoping that the email will land with someone who really has an account with that institution (see this example).  Those emails are easy to ignore if you don't do business with the particular bank or credit card company named in the email message.  No problem.

Phishing scams that use the IRS, however, are tougher to ignore because everyone does business with IRS at some point.  And when we see an email that appears to be from them, it probably gets our attention.

Be wary.

The IRS website lists some recent schemes.

• "One e-mail scam, fraught with grammatical errors and typos, looks like a page from the IRS Web site and claims to be from the "IRS Antifraud Comission" (sic), a fictitious group. The e-mail claims someone has enrolled the taxpayer's credit card in EFTPS and has tried to pay taxes with it. The e-mail also says there have been fraud attempts involving the taxpayer's bank account. The e-mail claims money was lost and "remaining founds" (sic) are blocked. Recipients are asked to click on a link that will help them recover their funds, but the subsequent site asks for personal information that the thieves could use to steal the taxpayer’s identity."
  
• "E-mails claiming to come from tax-refunds@irs.gov, admin@irs.gov and similar variations told the recipients that they were eligible to receive a tax refund for a given amount. It directed recipients to claim the refund by using a link contained in the e-mail which sent the recipient to a Web site. The site, a copy of the IRS Web site, displayed an interactive page similar to a genuine IRS one; however, it had been modified to ask for personal and financial information that the genuine IRS interactive page does not require."

I can just see people falling for this stuff.

Another thing to keep in mind is that the IRS should not have your email address to begin with unless you provided it to them.  Furthermore, even if you did provide them with your email address, they are most likely to communicate with you through the U.S. Mail anyway.

My personal rule of thumb is to totally ignore all such emails and to delete them immediately.  I don't even open them.  If there is an urgent matter that requires my attention, then my bank, credit card company, or the IRS have more reliable means of contacting me.

Remember, never give out your personal information to anyone, anywhere unless you are absolutely certain you know whom you are dealing with and that the transaction is secure.

When in doubt, don't do it.

Jul. 29, 2006 - Untitled Comment

Jul. 29, 2006 - Reply to Denise T