Tax season is in full swing and you’re probably working on your own taxes as we speak if you’re
located here in the US.
I know a lot of y’all will probably be looking forward to those IRS refund checks, and I
want you to be prepared for the potential scams that are going around.
So as a part of my ongoing security and privacy series of videos this fit right in because
there’s a lot of new techniques being used by criminals to steal your private data and
potentially that refund check.
I’m Shannon Morse, and I make videos about security and privacy online for the average
user.
This is my fulltime job and I’m super passionate about protecting people from scammers so I
hope this video helps.
Gabriel, Michael, and Keith made this video possible by supporting me on Patreon and BuyMeACoffee
- where you can get access to perks every month if you become a patron of my channel.
Here are three new techniques that are being used by scammers this year in the wild.
The first one has got the FBI talking.
This one led to the FBI releasing a Public Service Announcement that says criminals are
sending out fake and fraudulent 1099-K forms.
People who’ve received fake 1099’s which report income you’ve received over the last
year, say they haven’t actually made that money.
The FBI believes these fake forms are being sent to people by criminals who somehow got
ahold of people’s personally identifiable information and were able to fraudulently
open accounts with ecommerce companies as third party sellers.
That means a person would be paying taxes on money they didn’t actually earn while
a criminal is reaping the benefits.
Another technique used is called phishing, where a criminal “sprays and prays” - as
in they send out potentially thousands of emails to random people in the hopes that
maybe one or two of those people will click on it and fall for their scam.
Sounds like something you’d catch, right?
Well, they’re getting more sophisticated and harder to catch.
Sometimes your email provider won’t automatically stick these in your spam box or delete them,
so you might still see them show up.
That’s why it’s important to know what’s going on so you can be on alert whenever you
check your email.
So how do cybercriminals steal this info?
Well, they know you’re probably going to pay attention to an email that says it’s
from the IRS, so they’re sending out massive amounts of emails that pretend to be from
the IRS and include a malicious file attachment.
This attachment has a ZIP file that says it’s a W9 form, and a password is provided in the
body of text in the email for you to open that ZIP file.
See, W9 forms are commonly used by employers to associate you to your SSN or taxpayer ID
number.
It’s common to fill these out and sometimes update them with new information whenever
your details change.
But in this case, it’s not really a W9 form that you’re opening.
It’s actually an XLM file inside the zip attachment, and when opened it has a bunch
of code written into the file called “macros”.
When you open the file, it’ll ask you to enable macros, and when you do that, you’re
actually allowing the file to download malware onto your computer called Emotet.
Emotet malware is used by criminals to steal banking and personal information.
It’s spread through spam emails and can work it’s way through an infected system
to also spread to your contact list and potentially infect them too.
Because of issues like this, Microsoft decided to disable macros by default in their newest
version of Excel from January, but that doesn’t mean you should just let your guard down.
A second email scam, and the third scam for this video, also pretends to be the IRS and
asks for the recipient to fill out a non-resident alien W8 form for taxes.
Even though this second example includes a file attachment that isn’t itself malicious
- it doesn’t download malware onto your computer or anything - but it requests that
you fill out the form then fax it back to a specific number.
It’s likely that attackers are using this one to steal personally identifying information
via the forms.
So how do you protect yourself?
That’s actually something I focus on with this youtube channel so listen up, I have
a bunch of pro tips.
By the way I just hit 75000 subscribers on my channel, but I have another big goal I’m
getting super close to.
If this video was valuable, show your thanks by subscribing.
It’s a simple click and it helps me grow my business.
How do you recognize and protect against these attacks?
As for the fake 1099’s that the FBI alerted us about, one signal that you’ve been targeted
is if you start receiving random returned packages related to sales with an ecommerce
company prior to getting the fake 1099 from said company.
Since attackers are pretending to be you using personal information, protecting your personal
information online helps, as can reporting the fraudulent forms ASAP to the IRS.
I use a website called Abine’s DeleteMe to remove my PII from any search databases
that collect and store your information - sites like Spokeo, Whitepages, PeopleLookup...
there’s a tone of them and they collect info like your address, phone number, full
name etc without your consent and it’s incredibly annoying to opt out of being included in these.
So I pay for this service, they aren’t a sponsor, but if they were I’d absolutely
sing praises either way because I love this service.
They automate the process of removing your info so you don’t have to waste time doing
it yourself.
I’ll put my referral link down below if you wanna sign up for it.
As for the emails: A lot of times the email address in the “from” line will be something
really odd, unrelated to the government agency it’s pretending to come from.
The body of text can often have really weird grammatical issues or spelling errors, so
scrutinize the text.
This isn’t necessarily the case all the time though - they could be written by someone
fairly well versed in social engineering tactics...
so a major point to make here is that - the IRS DOESNT send out emails about tax issues.
They send you snail mail.
So if you’re getting emails from the IRS - HUGE RED FLAG FOLKS - it’s probably a
scammer.
It’s better to call the IRS or go through their own online website to find an answer
if you think there’s a problem with your taxes or forms.
If you do get these kind of emails, IGNORE THEM.
Even if you know it’s a scam and you reply and tell them they’re a big douchebag for
sending you that email or if you do anything that alerts the attacker that your email account
is active and is being checked... then the scammer will likely add your email address
to a list for future spam or scams because they now know there is a human on the other
side looking through the inbox - and you could potentially fall for future scams, even if
you caught this one.
So just ignore it.
Lastly, for tax scams is calls.
Luckily on Android, scam and spam protection is built in, so anytime I receive a call that
is likely from a scammer, it’s automatically blocked.
But if you do receive a call and pick it up and it says it’s about your taxes... hang
up.
The IRS doesn’t call people, you have to initiate that call.
And again, if they do see a problem with your taxes, they’ll send you snail mail.
Not email, not a call.
I’m sure a lot of folks, myself included, have seen these scams in action and think
“shoot I’d never fall for that”, but you aren’t constantly going to be on high
alert.
There will be days when your attention is taken up by other factors in your life, or
you’re too busy to pay attention, or maybe you just want the problem to go away quickly
instead of scrutinizing something to tell if it’s a scam.
We’re all humans and
we all make mistakes, even the most privacy and security minded folks out there.
So use this video as a reminder that anything can happen and please share it with the people
who matter most to you.
I hope it saves someone from a headache this year.