Fake IRS E-Mail Scam Goes Phishing

A new phishing attack posing as a tax refund from the Internal Revenue Service is using a configuration problem on the GovBenefits.gov Web site to fool users into thinking they're safe in offering up personal information such as Social Security and credit card numbers.

The fraud begins with an e-mail supposedly from the IRS, which claims the recipient is owed a tax refund. In the message from "[email protected]," a link is embedded to a site where recipients can supposedly collect the refund.

So far, said Graham Cluley, senior technology consultant with U.K.-based security company Sophos, that's not out of the ordinary. But this phishing campaign goes a step farther.

"The link bounces you off a U.S. government site onto one owned by the criminals, who are waiting to steal your credit card and Social Security number," said Cluley.

The site, GovBenefits.gov, hasn't been hacked, said Cluley, but he believes it has had its security configuration incorrectly set so that URL requests are easily redirected.

That's providing an opening for the phishing scheme to do its damage. "Absolutely, this is devious," Cluley said. "The URL really does take people to the real site, but only for a moment before their browsers are redirected to the bogus site that poses as an IRS page. The e-mail even instructs people to cut and paste the address into their browsers' address bars, which will make them even more reassured that it's not a phishing attack."

The attack takes advantage of the incorrect GovBenefits.gov security configuration to bounce people to the bogus site run by the phishers. There, the fraudsters instruct users to enter their Social Security and credit card numbers to deposit the bogus tax refund in their credit card account. "This is more advanced than the typical phish, because the link really does, at first, take you to the real benefit site. The phishers didn't need to hack into or compromise the government site to do this, the Web site has simply had this vulnerability on it all along," added Cluley.

It's also a new tactic for phishers. "This is new, and tremendously opportunistic," said Cluley. "The problem is that it's less likely to ring alarm bells in users' heads."

IRS spokesperson Michelle Lamishaw said that the site in question was not run by the agency, and that the IRS.gov site was safe to visit. "Our site is secure and there is no bounce," she said. "GovBenefits.gov is not an IRS.gov site."

"The IRS does not send out unsolicited e-mails," said Lamishaw. "It certainly does not send unsolicited e-mails asking for personal informational." If in doubt, consumers should contact the IRS by telephone at 800-829-1040 to determine whether the agency is trying to contact them about a tax refund.

The IRS issued a consumer alert Wednesday about the scam, and noted that this isn't the first online fraud attack the IRS has weathered. Over the years, the IRS has publicized several schemes, including abusive tax avoidance transactions, identity theft, and claims for slavery reparations.

As of mid-day Wednesday, the GovBenefits.gov site was still improperly redirecting phishing victims to the criminal site. Representatives from the GovBenefits.gov site did not respond to TechWeb's request for comment.

"This is a warning to every business and agency that runs a Web site to be very careful that it cannot be abused to bounce surfers elsewhere," added Cluley.