Email scammers can’t pass up a tried and true theme that is almost guaranteed to produce results. And with W-2 forms being sent out, it marks the start of this year’s expected campaigns.
Remember, threat actors responsible for phishing scams are always looking for anything that grabs the attention of the victim and gets them to act. One such scam is the spoofing of emails designed to provide taxpayers with access to their W-2 forms online. While most realize this information should only come from an employer, an email from “forms [at] 2022taxforms [dot] com” (a spoofed email address) could fool an unsuspecting recipient who is currently in the process of filing taxes. The recipient clicks a link, provides an array of personal information (including their social security number) and becomes the newest victim of a phishing campaign.
These phishing scams require a minimal understanding of social engineering and an online form service to collect a victim's personal information.
I’ve already put out some guidance on the types of tax-related scams to be on the lookout for… the W2 is only the first of many this year.
Here's how it works:
