The IRS and the FBI are warning consumers about a new phishing campaign that impersonates both of those agencies in an effort to collect victims’ personal information through a fake questionnaire.
The phishing attack uses an email template that includes the seals of both the FBI and the IRS and it plays on people’s fear of law enforcement to scare victims into giving up sensitive data. The email talks about some changes in the United States tax code that require people to fill out a new form. The message uses quasi-legal language but has some telltale grammatical mistakes that should tip victims off that it’s a scam.
“Owing to changes of tax laws of United States of America of June 21, 2017 (Federal tex regulations ref. no. 13-44876478) any business activity of resident or the non-resident citizens of the United States of America abroad, in particular the belonging of offshore companies, equity participation and offshore capitals, is transferred under the special control of the Federal Bureau of Investigation,” the email says.
“FBI requires a completed questionnaire here with absolutely reliable information.”
The link in the email directs victims to a page where they would supposedly download the fake FBI form. What they actually get, however, is a ransomware variant. The agencies haven’t disclosed what kind of ransomware the phishing campaign installs, but reminded victims not to pay the ransom if they’re infected.
“This is a new twist on an old scheme,” said IRS Commissioner John Koskinen. “People should stay vigilant against email scams that try to impersonate the IRS and other agencies that try to lure you into clicking a link or opening an attachment. People with a tax issue won’t get their first contact from the IRS with a threatening email or phone call.”
Cybercriminals often try to legitimize their phishing emails and other scams by using logos, seals, and other indicators from government agencies. The IRS is a favorite for these scammers, mainly because people tend to be afraid of the agency and the ramifications of having unpaid taxes. IRS phone scams are an offshoot of this, and have proliferated in recent years as fraudsters have branched out from traditional online crime.
