Tax Season Attacks – Part 1

It’s the same routine every year during tax season, employers send out important tax information such as W-2s to their employees, television and radio stations constantly air tax preparation advertisements, and individuals rush to file their tax returns.

This brings out a host of scams against taxpayers. Phishing scams feature attackers trying to impersonate the Internal Revenue Service (IRS). Attackers shoulder-surf taxpayers who are preparing their filings in public, hoping to read sensitive financial information that can be used later. Attackers also look for intact paper tax documents in the trash; these documents are covered in personally identifiable information (PII) that can allow attackers to steal both money and identities.

Optiv’s Global Threat Intelligence Center (gTIC) assesses with HIGH CONFIDENCE that attackers will target Americans’ personal and financial information throughout the tax season. We further assess with MODERATE CONFIDENCE that these attacks could persist throughout the year, in order to victimize individuals who file for extension.

But there are actions you can take to help prevent becoming a victim of these types of attacks. 

AttackRecommendation

Phishing

• Educate taxpayers on locating and responding to phishing attacks disguised as IRS or tax preparation company
• Educate taxpayers on how to identify phishing attacks targeting them, and how to avoid being taken in

Shoulder Surfing

• Avoid flashing personal documents in public places
• Do not prepare or submit taxes from public computers or public wireless networks

Dumpster Diving

• Do not throw documents in public trash cans
• Shred all paperwork that contains personally identifiable information

In our next blog post we will explore the specifics of the first type of attack, phishing.