Vigilance about the security of your online activities is needed every day; however, it is especially important during tax season. Hackers exploit and try to scare taxpayers through targeted phishing attacks and enticements to click a link or open an attachment in a fraudulent email or text message.
Even if you’ve already filed your taxes this season, you can still be vulnerable to tax-related cyber scams. Many schemes take advantage of users by alleging to have information about a filer’s refund, warning of unreported or under-reported income, noting a problem with the return that was previously filed, threatening a consequence for not responding, such as additional taxes or delaying a refund, or offering to pay you to participate in an IRS survey.
Some precautions will help minimize the risk of tax-season scams:
- Do not respond to emails or text messages appearing to be from the IRS. The IRS does not initiate taxpayer communications through email, text or social media tools to request personal or financial information. The IRS does not send emails stating that you are being electronically audited or that you are getting a refund. The IRS offers recommendations on what to do if you receive a suspicious IRS-related communication on Report Phishing.
- Never send sensitive information in an email or text. Criminals may intercept the information.
- Do not open attachments or click on links contained in suspicious emails. Common scams tout tax rebates, offer great deals on tax-preparation services or tax-related software, provide changes to tax laws, or recommend a free tax calculator tool. If you did not solicit the information, it is likely a scam. A downloadable document, usually in .pdf format, claiming to explain new tax laws can be populated with malware that may infect your computer, potentially stealing or destroying data or causing other damage.
- Carefully select the websites you visit. Searching for tax forms, tax preparers, or advice on the deductibility of an item requires caution. Do not visit a website by clicking on a link sent in an email, found on someone’s blog, or in an ad. The website you are taken to may look real; however, it may be a look-alike fake or a counterfeit e-file site. Secure website indicators include an URL (web page address) that begins with “https” and the “lock” icon in the browser window.
- Be Wi-Fi wise. Wi-Fi hotspots are intended to provide convenient access to the Internet; however, they are not necessarily secure against eavesdropping by hackers.
- Secure your computer and encrypt your personal data. Lock your laptop, tablet and cell phone. Be certain your computer and mobile devices have the proper security controls, including strong passwords, up-to-date anti-virus and anti-spyware software, and a firewall. Passwords should be changed regularly and have a minimum of eight characters that include uppercase and lowercase letters, numbers and symbols. Ensure your personal information is properly encrypted while in transit and while in storage on your computer.
- Shred old tax returns, personal and financial information and documents. Scammers will rummage through garbage in search of sensitive information, such as bank, credit or debit card numbers and statements, dates of birth, social security numbers and security questions to authenticate customers, such as a mother’s maiden name.
- Check your credit report for identity theft. You are entitled to one free credit report a year through the three major credit bureaus. Order them through annualcreditreport.com.
Taxpayer Resources
The IRS has released its “Dirty Dozen Tax Scams for 2014,” which highlights common tax-related scam tactics, including online identity theft, tax return preparer fraud, phishing and fraudulent activities that occur offline, such as criminals who impersonate legitimate charities at tax time and place phone calls to victims to solicit money.
IRS.gov has a special section dedicated to identity theft issues, including videos, tips for taxpayers and an assistance guide. For victims, the information includes how to contact the IRS Identity Protection Specialized Unit toll free at 800-908-4490.
The United States Computer Emergency Readiness Team (US-CERT) offers security tips on “Recognizing and Avoiding Email Scams” and “Avoiding Social Engineering and Phishing Attacks.”
The best tax advice is to think before you click or download.
