For those looking to get their taxes done early, watch out for emails impersonating ADP offering a link to retrieve your W2 early!
While everyone pretty much hates taxes, obtaining all your necessary paperwork is something most want to take care of well-ahead of tax time. A new phishing attack purports to be ADP – one of the world’s largest HR and Payroll companies – telling you your W2 is ready!
Source: AppRiver
While your organization may not be using ADP for payroll, this phishing attack is taking more the shotgun approach by impersonating an organization that a material percentage of their potential victims use.
This particular attack brings users to a spoofed ADP logon page, where victims can enter in their ADP credentials. Attackers can then leverage these credentials to log in as the user and change bank accounts for direct deposit. They can also gain access to personal information including: birthdate, address, social security number, phone number and more – all to be nefariously used as part of another identity theft scam.
Users that have been educated with Security Awareness Training know to look for suspicious details that don’t align – such as a bogus email “from” domain, or the URL the email links to not being anything close to “adp.com”. By validating these bits of information before clicking on a link or attachment will make the difference between becoming a victim and avoiding a very costly mistake.
Here's how it works:
