March 22, 2021 By David Bisson 2 min read

Many people are familiar with U.S. Internal Revenue Service (IRS) scam letters fishing for money around tax season. Now, a new form of IRS scam targets tax professionals in a virtual version of the fake IRS letter.

The IRS warned tax professionals to be on the lookout for a scam that attempts to steal a victim’s E-Filing Identification Number (EFIN). Attackers use a fake email to target tax preparers’ identities and their clients’ data. Then, if they do get the information, attackers can impersonate the tax preparer and file fraudulent tax returns to get refunds.

Read on to learn how this IRS scam works and how to stay safe this tax season:

New IRS Scam Targets EFINS

According to the IRS, the ruse began with a scam email. This email claimed to come from ‘IRS Tax E-Filing.’ The subject line reads ‘Verifying your EFIN before e-filing.’

The email informs the tax preparer that they need to send over some documents to verify authorized E-File personnel. It then asks for a copy of both their EFIN and driver’s license number. To add some urgency to the threat, the email says the IRS will disable the tax preparer’s E-Filing access if they don’t comply.

The IRS urged tax preparers to not follow any of the steps outlined in the email. The best thing to do is to delete the email and not respond in any way.

Other Tax Scams

The IRS and other outlets have highlighted several other notable tax scams this season. In the beginning of February, for instance, the IRS warned taxpayers about the threat of ‘ghost’ tax return preparers who refuse to sign people’s returns that they prepare. Tax preparers are required to sign each return that they prepare and include their Preparer Tax Identification Number.

According to the IRS, the absence of a signature could indicate that a tax preparer is engaged in dishonest activity. They could be promising large refunds and charging fees based on the size of those refunds, for instance.

Another tax-related scam used fake SMS-based text messages that appeared to come from Her Majesty’s Revenue and Customs (HMRC) to trick U.K. recipients into thinking they could get a tax rebate. The scam messages arrived with a link that, when clicked, sent the user to a web page made to look like a real U.K. government website.

The bogus website domain, along with multiple grammatical errors, gave away the web page as a fake. It linked to a page designed to steal visitors’ personal information, including their credit card details. After scooping up their information it redirected victims to a real U.K. government page.

How to Stay Safe Against an IRS Scam

Organizations can defend themselves and their users against an IRS scam by investing in their email security defenses. One of the ways they can do this is by creating a security awareness training program and educating their workforce about some of the most common types of tax-based phishing emails and other scams that are in circulation.

To keep their employees aware of this IRS scam and similar attacks, organizations should test their employees on an ongoing basis. They should also use threat intelligence to stay on top of the newest tax scams.

More from News

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government. The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of…

Recent developments and updates in Biden cyber policy

3 min read - The White House recently released its budget for the 2025 fiscal year, which supports the government’s commitment to cybersecurity. The cybersecurity funding allocations line up with the FY 2025 cybersecurity spending priorities released last year that included the following pillars: Defend critical infrastructure Disrupt and dismantle threat actors Shape market forces to drive security and resilience Invest in a resilient future Forge international partnerships to pursue shared goals. In 2023, the White House released a 35-page document detailing the new…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today