Fake IRS E-Mail Scam Goes Phishing - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
News
News
11/30/2005
03:08 PM
50%
50%

Fake IRS E-Mail Scam Goes Phishing

Users are now being targeted with a new phishing attack posing as a tax refund from the Internal Revenue Service.

A new phishing attack posing as a tax refund from the Internal Revenue Service is using a configuration problem on the GovBenefits.gov Web site to fool users into thinking they're safe in offering up personal information such as Social Security and credit card numbers.

The fraud begins with an e-mail supposedly from the IRS, which claims the recipient is owed a tax refund. In the message from "[email protected]," a link is embedded to a site where recipients can supposedly collect the refund.

So far, said Graham Cluley, senior technology consultant with U.K.-based security company Sophos, that's not out of the ordinary. But this phishing campaign goes a step farther.

"The link bounces you off a U.S. government site onto one owned by the criminals, who are waiting to steal your credit card and Social Security number," said Cluley.

The site, GovBenefits.gov, hasn't been hacked, said Cluley, but he believes it has had its security configuration incorrectly set so that URL requests are easily redirected.

That's providing an opening for the phishing scheme to do its damage. "Absolutely, this is devious," Cluley said. "The URL really does take people to the real site, but only for a moment before their browsers are redirected to the bogus site that poses as an IRS page. The e-mail even instructs people to cut and paste the address into their browsers' address bars, which will make them even more reassured that it's not a phishing attack."

The attack takes advantage of the incorrect GovBenefits.gov security configuration to bounce people to the bogus site run by the phishers. There, the fraudsters instruct users to enter their Social Security and credit card numbers to deposit the bogus tax refund in their credit card account.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
2020 State of DevOps Report
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
Slideshows
10 Trends Accelerating Edge Computing
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/8/2020
Commentary
Is Cloud Migration a Path to Carbon Footprint Reduction?
Joao-Pierre S. Ruth, Senior Writer,  10/5/2020
News
IT Spending, Priorities, Projects: What's Ahead in 2021
Jessica Davis, Senior Editor, Enterprise Apps,  10/2/2020
Register for InformationWeek Newsletters
Video
Current Issue
[Special Report] Edge Computing: An IT Platform for the New Enterprise
Edge computing is poised to make a major splash within the next generation of corporate IT architectures. Here's what you need to know!
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll