October is Cybersecurity Awareness Month. The IRS and the Security Summit partners warn everyone to be on the lookout for scams and schemes that could put sensitive tax data at risk, especially IRS-themed texting scams aimed at stealing personal and financial information.
So far in 2022, the IRS has identified and reported thousands of fraudulent domains tied to multiple text scams, known as smishing, targeting taxpayers. Recently, IRS-themed smishing has increased significantly.
Smishing campaigns target mobile phone users, and the scam messages often look like they’re coming from the IRS, with fake messages, known as “lures,” offering COVID relief, tax credits or help setting up an IRS online account. Recipients of these IRS-related scams can report them to phishing@irs.gov.
In the latest smishing activity, the scam texts ask taxpayers to click a link or call a telephone number where criminals will collect their personal or financial information. The IRS does not send emails or text messages asking for personal, financial information or account numbers.
Taxpayers should continue reporting these scams to the IRS. Their reporting allows the agency to report the scams to the appropriate service providers for action, protecting other taxpayers who might receive a variant of the same scam.
How to report IRS-related smishing
The IRS maintains phishing@irs.gov to process complaints tied to IRS, Treasury and tax-related online scams. Taxpayers should not report smishing involving other agencies or brands to this email address.
Reporting IRS-themed texts to the agency allows security professionals to track and disrupt these scams.
Here’s how people can capture and report the details of IRS related smishing:
- Create a new email to phishing@irs.gov.
- Copy the caller ID number, or email address.
- Paste the number, or email address into the email.
- Press and hold the SMS/text message and select “copy.”
- Paste the message into the email; screenshots can be sent if necessary.
- If possible, include the exact date, time, time zone and telephone number that received the message.
- Send the email to phishing@irs.gov.
Recipients can also copy and forward scam SMS/text messages to wireless providers and send the text to 7726 (SPAM). This helps the provider spot and block similar messages in the future.
Taxpayers and tax pros can also report IRS-related smishing to the Treasury Inspector General for Tax Administration using their IRS Impersonation Scam Reporting form and the Federal Trade Commission through their Complaint Assistant to make the information available to investigators.
Anyone receiving any scamming incidents, successful and attempted, should also report the incidents to the Internet Crime Complaint Center.
Businesses should put in place safeguards and watch out for tax-related scams. Most cyberattacks are aimed at small businesses with fewer than 100 employees.
Here are some reminders:
- Beware of various scams, especially the W-2 scam that attempts to steal employee income information.
- IRS protective masking of sensitive information on business transcripts.
- A Business Identity Theft Affidavit – Form 14039-B – is now available for all businesses to report theft to the IRS.