Don’t Take the Bait; Spear Phishers Trying to Reel in Big Tax Returns

Taxpayers, company accountants and IT admins, take heart: The IRS isn’t the only group that’s interested in your tax return. Criminals leverage unencrypted email, poor firewalls, and general social engineering to steal taxpayers’ and organizations’ returns in hopes of garnering a refund and/or nonpublic information (NPI)—and it’s arguably easier for them to do it than filing a return.

Email should be considered as secure as the server it’s hosted on, which–depending on the server–could be either extremely secure or extremely vulnerable. Normally, a cybercriminal looking to steal some returns will try to hack the server, which is why it’s good practice (and, in some cases, federally or state-mandated) to transmit financial information, including corporate tax returns, via encrypted messaging. If cybercriminals can’t get access to the server, their next best option is to target those who have access, like an IT admin.

January to mid-April is the prime time for criminals to try to convince susceptible employees to hand over private company information, including tax returns, company bank account information, and employee information including healthcare and W-2 files. Many organizations naively believe that this could never happen to them. However, a quick search online can usually show the prevalent dangers of these sorts of attacks. Companies like Snapchat, Seagate, Polycom, Advance Auto Parts, and, yes, even hospitals, schools, and utility companies have all been victims of spear phishing.

At AppRiver, we have seen the spike in phishing traffic already occurring this tax season. The beginning of the year is typically when taxpayers anticipating big refunds rush to have their returns filed, while taxpayers who owe usually procrastinate until the last second. For these reasons we anticipate that phishing traffic will continue to dwindle until the very end of tax season, with perhaps another small push toward the deadline.

So, how do criminals identify a potential target? It’s easy. First, they’ll search for a company on social media sites like Facebook and LinkedIn. Nowadays, it’s more uncommon than not for social media users to list their employment on their social media profiles, or even have a dedicated online resume (on LinkedIn, for example). In a company with more than 50 employees, odds are at least one person from finance has listed his or her employment on a social media account.

After choosing a target, the criminal will either spoof the company’s domain to create an email address that appears to come from a high-level executive, like the CEO, or create a similar one that most employees wouldn’t catch. An example would be using .net instead of .com, or adding an extra letter in the domain.

When an outside criminal crafts an email in such a way that it looks to be internal, some users will trust them without digging deeply enough. And that’s the core component to spear phishing. A criminal doesn’t need to be a hacker or gain access to secure internal systems. If someone can send convincing, legitimate-appearing emails, employees may hand over sensitive information and be none the wiser.

While right now this tactic is used to get W2s, NPI and tax returns, tactics along the same lines are used year-round–for example, using wire transfer fraud emails to dupe employees to wire tens of thousands of dollars from companies’ accounts to dummy accounts set up by the criminals. The FBI refers to these as Business Email Compromise (BEC) messages. The broader interpretation is any external email that claims to be from an internal user (like the CEO) who wants an employee to do something that compromises the integrity of business operations. This is a very dangerous attack vector because of how successful it is. The total damage companies face is in the millions each year.

So how does one avoid spear phishing, wire transfer fraud and BEC year round?

Unfortunately, there’s no panacea when it comes to blocking spear phishing attempts. However, there are some steps an organization can take to combat them:

Guest blogs such as this one are published monthly and are part of MSPmentor’s annual platinum sponsorship.