New email scam targeting firms

OSCPA staff report

The Ohio Department of Taxation and the IRS each issued warnings this week about a new two-stage email scheme targeting tax professionals nationwide.

This time, the threat comes in the form of an email from cybercriminals posing as potential clients soliciting services. The scheme's objective is to collect sensitive information that will help crooks prepare fraudulent tax returns.

These latest phishing emails come in typically two stages. The first email is the solicitation, which asks tax professionals questions such as "I need a preparer to file my taxes." If the tax professional responds, the cybercriminal sends a second email. This second email typically has either an embedded web address or contains a PDF attachment that includes an embedded web address.

In some cases, the phishing emails might appear to come from a legitimate sender or organization – maybe even a friend or colleague – because a fraudster has taken over the account to send phishing emails.

The tax pro might think they are accessing a potential client's tax information, when in reality the cybercriminals are collecting the preparer's email address, password or other sensitive information.

The IRS said tax professionals should consider creating internal policies or consult with a security expert on how to address unsolicited email.

One important tip: Never respond to or click on a link in an unsolicited email or PDF attachment from an unknown sender. Cybercriminals are becoming more sophisticated in their efforts to steal information. They need more data to impersonate clients and file fraudulent returns to claim refunds.

Read more at Protect Your Clients; Protect Yourself, the Security Summit initiative to increase awareness about the tax professional community.