IRS Warns of New E-Mail and Telephone Scams Using the IRS Name; Advance Payment Scams Starting

Updated April 21, 2008 Some people have received phone calls about the economic stimulus payments, in which the caller impersonates an IRS employee. The caller asks the taxpayer for their Social Security and bank account numbers, claiming that the IRS needs the information to complete the processing of the taxayer’s payment. In reality, the IRS uses the information contained on the taxpayer’s tax return to process stimulus payments, rather than contacting taxpayers by phone or e-mail. An e-mail claiming to come from the IRS about the “2008 Economic Stimulus Refund” tells recipients to click on a link to fill out a form, apparently for direct deposit of the payment into their bank account. This appears to be an identity theft scheme to obtain recipients’ personal and financial information so the scammers can clean out their victims’ financial accounts. In reality, taxpayers do not have to fill out a separate form to get a stimulus payment or have it directly deposited; all they had to do was file a tax return and provide direct deposit information on the return. IR-2008-11, Jan. 30, 2008 WASHINGTON — The Internal Revenue Service today warned taxpayers to beware of several current e-mail and telephone scams that use the IRS name as a lure. The IRS expects such scams to continue through the end of tax return filing season and beyond. The IRS cautioned taxpayers to be on the lookout for scams involving proposed advance payment checks. Although the government has not yet enacted an economic stimulus package in which the IRS would provide advance payments, known informally as rebates to many Americans, a scam which uses the proposed rebates as bait has already cropped up. The goal of the scams is to trick people into revealing personal and financial information, such as Social Security, bank account or credit card numbers, which the scammers can use to commit identity theft. Typically, identity thieves use a victim’s personal and financial data to empty the victim’s financial accounts, run up charges on the victim’s existing credit cards, apply for new loans, credit cards, services or benefits in the victim’s name, file fraudulent tax returns or even commit crimes. Most of these fraudulent activities can be committed electronically from a remote location, including overseas. Committing these activities in cyberspace allows scamsters to act quickly and cover their tracks before the victim becomes aware of the theft. People whose identities have been stolen can spend months or years — and their hard-earned money — cleaning up the mess thieves have made of their reputations and credit records. In the meantime, victims may lose job opportunities, may be refused loans, education, housing or cars, or even get arrested for crimes they didn’t commit. The most recent scams brought to IRS attention are described below. Rebate Phone Call At least one scheme using the word “rebate” as part of the lure has been identified. In that scam, consumers receive a phone call from someone identifying himself as an IRS employee. The caller tells the targeted victim that he is eligible for a sizable rebate for filing his taxes early. The caller then states that he needs the target’s bank account information for the direct deposit of the rebate. If the target refuses, he is told that he cannot receive the rebate. This phone call is a scam. No legislation has yet been enacted that would allow the IRS to provide advance payments to taxpayers or that determines the details of those payments. Moreover, the IRS does not force taxpayers to use direct deposit. Those who opt for direct deposit do so by completing the appropriate section of their tax return, with bank routing and account information, when they file; the IRS does not gather the information by telephone. Refund e-Mail The IRS has seen several variations of a refund-related bogus e-mail which falsely claims to come from the IRS, tells the recipient that he or she is eligible for a tax refund for a specific amount, and instructs the recipient to click on a link in the e-mail to access a refund claim form. The form asks the recipient to enter personal information that the scamsters can then use to access the e-mail recipient’s bank or credit card account. In a new wrinkle, the current version of the refund scam includes two paragraphs that appear to be directed toward tax-exempt organizations that distribute funds to other organizations or individuals. The e-mail contains the name and supposed signature of the Director of the IRS’s Exempt Organizations business division. This e-mail is a phony. The IRS does not send unsolicited e-mail about tax account matters to individual, business, tax-exempt or other taxpayers. Filing a tax return is the only way to apply for a tax refund; there is no separate application form. Taxpayers who wish to find out if they are due a refund from their last annual tax return filing may use the “Where’s My Refund?” interactive application on this Web site, IRS.gov. The only official IRS Web site is located here at www.irs.gov. Audit e-Mail Another new scam brought to IRS attention contains features not seen before by the IRS. Using a technique calculated to get almost anyone’s attention, the e-mail notifies the recipient that his or her tax return will be audited. This is the first scam of which the IRS is aware that uses this to get the victim to respond. Unusual for a scam e-mail, it may contain a salutation in the body addressed to the specific recipient by name. Most scam e-mails seen by the IRS are sent using the same technique used by spammers, in which hundreds of thousands of messages are sent to potential victims based on Internet address. Because of the volume, the typical scam e-mail is not personalized. This e-mail instructs the recipient to click on links to complete forms with personal and account information, which the scammers will use to commit identity theft. This e-mail is a phony. The IRS does not send unsolicited, tax-account related e-mails to taxpayers. Changes to Tax Law e-Mail This bogus e-mail is addressed to businesses, accountants and “Treasury” managers. It instructs them to download information on tax law changes by clicking on a series of links to publications on businesses, estate taxes, excise taxes, exempt organizations and IRAs and other retirement plans. The IRS believes that clicking on a link downloads malware onto the recipient’s computer. Malware is malicious code that can take over the victim’s computer hard drive, giving someone remote access to the computer, or it could look for passwords and other information and send them to the scamster. There are other types of malware, as well. The urls contained in the link are not legitimate IRS Web addresses. All IRS.gov Web page addresses begin with http://www.irs.gov/. Paper Check Phone Call In a current telephone scam, a caller claims to be an IRS employee who is calling because the IRS sent a check to the individual being called. The caller states that because the check has not been cashed, the IRS wants to verify the individual’s bank account number. The caller may have a foreign accent. In reality, the IRS leaves it entirely up to the individual to choose to cash or not cash a paper check. The IRS has no business need to know, and does not ask for, bank account or similar information, except when taxpayers indicate on their tax return that they are opting for the direct electronic deposit of their refund. In that case, however, it is the individual’s responsibility to provide the IRS with the correct bank routing and account numbers on the tax return; the IRS does not contact taxpayers to verify the information. What to Do Anyone wishing to access the IRS Web site should initiate contact by typing the IRS.gov address into their Internet address window, rather than clicking on a link in an e-mail or opening an attachment. Those who have received a questionable e-mail claiming to come from the IRS may forward it to a mailbox the IRS has established to receive such e-mails, phishing@irs.gov, using instructions contained in an article titled “How to Protect Yourself from Suspicious E-Mails or Phishing Schemes.” Following the instructions will help the IRS track the suspicious e-mail to its origins and shut down the scam. Find the article by visiting IRS.gov and entering the words “suspicious e-mails” into the search box in the upper right corner of the front page. Those who have received a questionable telephone call that claims to come from the IRS may also use the phishing@irs.gov mailbox to notify the IRS of the scam. The IRS has issued previous warnings on scams that use the IRS to lure victims into believing the scam is legitimate. More information on identity theft, phishing and telephone scams using the IRS name, logo or spoofed (copied) Web site is available on this Web site. Enter the terms “phishing,” “identity theft” or “e-mail scams” into the search box in the upper right corner of the front page. Related Items: FS-2008-9, Identity Theft E-Mails Scams a Growing Problem IR-2007-109, IRS Warns Taxpayers of New E-mail Scams Suspicious e-Mails and Identity Theft Subscribe to IRS Newswire

IRS Email Scam

I recently sent an email about this to my friends. Here’s the post:

If you receive the below email (Get 2008 Economic Stimulus Refund – $1800), delete it! This is a scam!!!! Please be perceptive enough to check into things before you blindly believe these technological lies. Apparently, a half-witted computer tech without morals is trying to capitalize on the stimulus refund from the government. He/she will be phishing for your bank account information & SSN, and will ultimately rob you of your identity.

Email is never the primary way governments, banking institutions and major businesses communicate with you. Remember, email is like a postcard, it’s not secure unless you use encryption (to answer everyone’s question, “Am I using email encryption?” I guarantee you that you would know if you’re using email encryption because you have to install it-or login to a secure webmail server, and it only works if the other person you’re communicating with uses the same type of encryption or has a private or public encryption key).

All it takes is a few tools and in five minutes I can intercept email as it travels across the internet. Again, email is simply a postcard. As it travels anyone with the right tools can intercept and read it. Never send banking information, passwords, or Personal Identifiable Information (PII) via unencrypted email.

Here are a few free email encryption solutions:

1. Hushmail (free secure webmail solution)

2. Google Gmail Encryption with FireFox: FireGPG (You have to login to https://gmail.com when using this encryption with Gmail.) Here’s the instruction on how to setup and use FireGPG encryption with Gmail: http://www.linux.com/articles/62369

3. Greasemonkey Encryption: Firefox Extension

If you have any questions, please visit my IT Security blog at: www.itsecurityadmin.wordpress.com or email me.

Here’s the email:

---

From: service@irs.gov [mailto:service@irs.gov]
Sent: Tuesday, May 13, 2008 3:58 AM
Subject: Get 2008 Economic Stimulus Refund ( $1800 )
Importance: High

Over 130 million Americans will receive refunds as
part of President Bush program to jumpstart the economy.

Our records indicate that you are qualified to receive the
2008 Economic Stimulus Refund.

The fastest and easiest way to receive your refund is by
direct deposit to your checking/savings account.

Please click on the link and fill out the form and submit
before May 13th, 2008 to ensure that your refund will be
processed as soon as possible.

Submitting your form on May 13th, 2008 or later means that
your refund will be delayed due to the volume of requests we
anticipate for the Economic Stimulus Refund.

To access Economic Stimulus Refund, please click here.

© Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.

Spam Reached 96 Percent Of Email in Q4, 2007

Global spam levels measured by Commtouch swelled through the fourth quarter of 2007, hitting a high of 96 percent of all email in October 2007.

While we can’t speak for the rest of the Internet, we do see the inbox sift out roughly six good messages out of 300 at any given time at SecurityProNews.

That puts us in the neighborhood email security vendor Commtouch observed. Global spam levels measured by the company for the year hit an astonishing peak of 96 percent.

Astonishing unless one is sitting in the lead-lined writing room at our international HQ, watching the wonderful SpamBayes plug-in go to work on an inbox freshly opened in the morning. Commtouch said on their blog they “monitor unfiltered data streams of Internet email traffic, not including internal corporate traffic. This open traffic is analyzed to find the ratio of spam to legitimate email messages.”

The cruft collecting in inboxes, unless one has a product cleaning it on a continual basis, can contain any number of unwanted pests. Minor annoyances like plaintext stock-pumping emails pale in comparison to the malware-linked spam leading to infections and possible takeover by a remote server.

Those takeovers tend to connect a victimized PC to a broad network of other corrupted machines. These devices function as a botnet, which increasingly in these times provide outlets for the distribution of the Storm worm, a ferociously prolific pest that could be on millions of computers worldwide.

Link

Sunbelt, Dell Unsheathe Ninja Blade

An email security appliance from Sunbelt debuted on Dell’s PowerEdge server line; the device takes the spam fight to the gateway and off the desktop.

We have held the opinion for some time that the email security fight should not be waged on the desktops of people, whether a single at-home individual or a multinational corporation with thousands of email users.

Various purveyors of security solutions think the same way. Slam the door shut on spam, phishing, and malware link-bearing messages at the gateway, rather than worrying about someone clicking on something they should not in the email client.

Sunbelt Software and Dell paired on one such gateway approach. Their newly released Ninja Blade device incorporates antispam technology from Cloudmark, and antivirus from BitDefender to complement the Message Transfer Agent on-board.

Sunbelt also noted Ninja Blade works real-time with Active Directory and LDAP, which will speed up the initial configuration and deployment period needed to place it in service in those environments.

The launch puts Sunbelt in direct competition with one of the bigger fish in the email security appliance market, that being Barracuda Networks. Sunbelt CEO Alex Eckelberry said in a statement Ninja Blade would have a competitive price point; the four Ninja Blade products start at $1,995, plus support and maintenance plans.

Link

Top 12 Windows Spam Filters

1. POPFile – Spam Filter

POPFile is a powerful and flexible email classification POP and NNTP proxy that you can use to filter spam efficiently and categorize good mail automatically. Unfortunately, POPFile can grow a bit heavy on memory and cpu load if you have trained on lots of mail.

2. Death2Spam – Spam Filter

Death2Spam is an extremely accurate, safe and easy to use spam (and virus) filtering service that seamlessly and silently eliminates junk mail before it even reaches your email program.

3. eXpurgate – Spam Filter

eXpurgate is an effortless but highly effective spam (and virus) filtering service. Its only real shortcoming is that eXpurgate relies on forwarding and requires two different email accounts.

4. SpamPal – Spam Filter

SpamPal makes it easy to use spam blacklists with any email account. Bayesian and scoring filters add further spam protection.

5. MailWasher Pro – Spam Filter

MailWasher Pro is a highly competent, usable, secure and time-saving spam filtering tool. Combining multiple approaches, MailWasher Pro achieves a solid spam detection rate and protects you from viruses to some extent, too.

6. Spamihilator – Spam Filter

Spamihilator is a pretty, easy to use anti-spam tool that works with any email client and, thanks to Bayesian filters, has a good detection rate.

7. K9 – Spam Filter

K9 is a wonderfully precise, easy to use and fast learning Bayesian spam filtering tool. It’s a pity this gem only works with POP accounts and lacks remote administration.

8. Cactus Spam Filter – Spam Filter

Cactus Spam Filter is a really easy to use and pretty precise spam filter. It’s a pity it only works with POP accounts and does not leverage its power for further pre-sorting the good mail.

9. Spam Bully – Spam Filter

Spam Bully is a great and efficient anti-spam tool. If you train it well, Spam Bully can rid your Inbox of unwanted emails almost completely.

10. Spamato – Spam Filter

Spamato filters POP and IMAP accounts for spam with the potential for high precision and plug-ins that make it easy to use in Outlook and Mozilla Thunderbird. Unfortunately, Spamato can be a bit overwhelming with its multitude of options and little help.

11. Spam Interceptor – Spam Filter

Spam Interceptor is an elegant, easy to use and flexible, but most of all effective spam filtering solution. Its combination of multiple strategies works great — unfortunately for POP accounts only.

12. SpamExperts Desktop – Spam Filter

SpamExperts Desktop identifies and eliminates spam precisely and, thanks to its plugging right into the email transport, works without configuration with any email program and just about any email account.

It’s a pity SpamExperts Desktop is a tad slow to process mail (though that can be countered by having it download mail periodically), and the process that lets you correct the filter’s errors could be improved.