The Security Summit yesterday reported that taxpayers are being targeted by a new series of text-message scams that impersonate state departments of revenue and tax relief organizations. An organization comprised of the Internal Revenue Service, state tax agencies, and private members of the tax industry, the Summit has been raising awareness of identity theft tax refund fraud since 2015.

In an Internal Revenue Service press release, the Security Summit explains that identity thieves are asking taxpayers to provide bank account information finalize transfer of Economic Impact Payment funds. The text messages include a link to a website that is designed to look like the online “Get My Payment” tool, reading: “You have received a direct deposit of $1,200 from COVID-19 TREAS FUND. Further action is required to accept this payment into your account. Continue here to accept this payment.”

How do phishing sites steal my information?

Phishing websites use many different mechanisms to steal victims’ information and money, many of which also appear in phishing emails, social media messages, and text messages:

1. Collecting data from information-gathering fields
2. Installing malware with embedded links
3. Getting visitors to call listed numbers
4. Running background scripts that install malware

Since some of these sites can steal information simply by visiting them, recipients of phishing emails should make it a habit to never click on embedded links and attachments in unsolicited digital messages. (Another good practice is to only visit trusted websites by entering the URL into a web browser.)

What should people do if they receive a phishing message?

The Security Summit says that victims should report tax-related phishing attempts to the IRS, since collecting data and raising awareness can help us all avoid falling victim to impersonation scams. Specific to this text-message scam, the Summit recommends sending a screenshot of the message in an email containing the following information to Phishing@IRS.gov:

• Date/Time/Timezone that they received the text message
• The number that appeared on their Caller ID
• The number that received the text message

“The IRS does not send unsolicited texts or emails,” the Summit reminds taxpayers. “The IRS does not call people with threats of jail or lawsuits, nor does it demand tax payments on gift cards.”

Finally, the Summit notes that the remaining non-filers who could be eligible to receive an EIP need to use the “Non-Filers: Enter Payment Info Here” tool before the upcoming Nov. 21, 2020 deadline.

Source: IR-2020-249