Current Spearphishing Scam: Cybercriminals are Targeting Tax Professionals
It’s tax season and cyber criminals are targeting tax professionals. A recent scam flagged by the Journal of Accountancy calls out spearphishing. —A fraudster phishing tactic, which, this time around, looks like an email from the IRS (Internal Revenue Service) requiring action or is otherwise attempting to wheedle attention from busy tax professionals with an unsettling phrase, “unusual activity report.” While the email may have co-opted the IRS logo (along with those of popular tax service preparation providers), it is a scam crafted to obtain official login credentials so that cybercriminals can find and use taxpayer information to steal identities and file fraudulent tax refund claims.
REDW’s trusted tax and cybersecurity advisors caution tax professionals not to click anything in the email if you receive such a communication. Instead, forward potential phishing attempts (preferably as an attachment) to phishing@irs.gov and find more information on identity theft for tax professionals at the IRS website.
IS YOUR PROFESSIONAL TEAM UP TO SCRATCH ON THE BASICS OF CYBERSECURITY?
Do not fall behind the times. As seen in the current spearphishing scam targeting tax professionals, cyber hackers are upping their game with specifically designed tricks, targeting all levels of employees. One critical factor to remember – and impart into the habits of your team – is that humans are frequently the weakest links in cybersecurity. Staff habits and actions taken on behalf of a business are the most likely points of entry for a cyber-criminal.
It’s too easy to look like the real thing. With today’s technology and YouTube videos, it is easier than ever to replicate an existing website, further fooling targets of phishing. Matching exact colors and fonts, copying logos, and purchasing similar names can be done in a matter of minutes. Noticing the difference between real and fake websites can take a keen eye.
The Federal Trade Commission (FTC) reminds us that today’s version of phishing can also come through text messages, business phone calls, emails purporting to help the recipient “secure” their accounts, and as fake invoices. Keeping your devices secure, backing up your data, and training your staff are all essential steps to thwarting and rectifying issues that stem from phishing attempts.
Tip for Success: Multi-factor Authentication can significantly strengthen your cybersecurity defenses — Utilizing multi-factor authentication (MFA) whenever available for your business is also highly recommended by cybersecurity advisors. While it may take a moment longer for team members to get into their accounts, MFA systems can save companies countless headaches with their automated alerts which notify your IT team of a potential threat or cyber-hacker attempting to gain access to sensitive business data.
WE WELCOME YOUR QUESTIONS ON SPEARPHISHING, CYBERSECURITY & TAX PREPARATION
For questions on safe cyber practices, especially during the tax busy season, please contact REDW Cybersecurity consultant Jennifer Moreno, CISA, using the form below.
Or for questions on tax preparation, filing, and payment, please address your question(s) to REDW Principal and Tax Practice Leader, Christina Roderick, CPA, MST, CGMA, using the form below.
below.Â
