Tax Season Warning: the IRS on Social Engineering

Young man using a laptop building online business making dollar bills cash falling down. Beginner IT entrepreneur under money rain. Success economy concept-1We have had occasion to warn of this before, but as 2020 begins and April 15th approaches, it may be worth another mention. The US Internal Revenue Service wants taxpayers to keep a sharp eye out for the signs of social engineering. According to tweets the IRS issued at the end of December, “The most common way thieves steal identities is simply by asking for them.” This, of course, is especially a problem during tax season, when thieves file fraudulent returns, or use tax worries as the entering wedge of other social engineering campaigns.

The IRS Twitter feed offers a sound short list of things in communications that should put you on your guard.

Scammers often:

  • “Pose as a trusted source.”
  • “Tell you there’s something wrong with your account.”
  • “Claim you’re in violation of a law.”
  • “Tell you to open a link or an attachment.”
  • “Ask you to log into a familar-looking--but fake--website.”

In every one of those cases, crooks have misrepresented themselves as IRS agents as they attempt to lure the worried, the conscientious, and the gullible into giving up sensitive information. That kind of impersonation works with all five of the tactics the IRS warns against. It’s also worth noting that most of them work equally well as smishing--that is, text messaging--or as vishing--that is, voice calls--as they do with conventional email phishing.

The tax agency points out on its website that there’s one sure sign that the person who says they’re from the IRS is in fact a scammer: “The IRS doesn't initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information. This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.” So if you’ve been contacted out of the blue by someone who says you owe taxes, that you might be about to arrested, or that the Government needs your bank account credentials, it’s fraud.

A threat to an individual is also a threat to that individual’s organization, and businesses and other organizations also deal with the IRS and other Government bodies. This kind of impersonation scam can be easily avoided, especially if an organization takes the trouble to offer its employees new-school security awareness training.

The IRS website has full details on phishing here:


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Has Gone Nuclear Webinar

Get the latest about social engineering

Subscribe to CyberheistNews