New eservices phishing scam

[Lee B]

"The Internal Revenue Service issued a new warning Tuesday to users of its online e-Services cautioning them to beware of a new phishing scam that attempts to trick tax professionals into “signing” a new e-Services user agreement.

The phishing scam is actually trying to steal passwords and data, the IRS warned in an email to tax professionals. The IRS has been trying to migrate to new e-  Services technology with improved authentication and security abilities, but has faced repeated delays. The IRS said that all tax professionals should be aware that as e-Services begins its move later this month to Secure Access authentication and its two-factor protections, cybercriminals are likely to make last-ditch efforts to steal passwords and data prior to the transition.

The scam email claims to come from “e-Services Registration” and says “Important Update about Your e-Services Account” in the subject line. In part, the scam email states, “We are rolling out a new user agreement and all registered users must accept its revised terms to have access to e-Services and its products.” The email asks users to review and accept the agreement but takes them instead to a fake site !"

 

Be careful out there !

[Gail in Virginia]

The internet can be a dark and scary place....

[Catherine]

Well, with the IRS using bleeping EQUIFAX to "verify" who we are, they might as well just open all their systems to all and sundry, fer gosh sake.  *WHAT* were they thinking?  (More to the point, *who* got paid - and what, and how - for that one?)

[Lee B]

When the IRS announced their new "no bid contract" with Equifax, they said it was because Equifax had a "unique set of capabilities." LOL

[SaraEA]

The Security Summit is working!  Today I got two emails from IRS on this scam, one from Accounting Today, and another from NAEA.  The partners in the summit are supposed to share info on new scams with each other and their constituents, and I see that they are in fact doing so.  I don't think any of us would fall for this scam anyway since we know that legit emails from IRS never contain links but tell us to go to IRS.gov and log into our accounts.  Speaking of which, their new website doesn't have the tax pro link.  I used e-services the other day and actually had to google it to get there.  Is it hidden somewhere I don't see?

Yesterday Equifax admitted that almost 11 million driver license numbers were stolen along with everything else.  This is what I've been afraid of.  We still don't know exactly what data were taken, on whom.  Anyone got a letter from Equifax yet telling you that you were a victim?  They said they'd be sending them.  When?  And what good will they do if three months after they discovered the theft they are still learning what data were breached?  With all that non-credit info out there, there is no way IRS will be able to tell the thief from the real taxpayer when those zillions of fake returns get filed.  The crooks will be able to answer more of the identity verification questions correctly than we will.

[Catherine]

13 minutes ago, SaraEA said:

The crooks will be able to answer more of the identity verification questions correctly than we will.

I sent a form out for e-signatures to a client who has the same name as his dad, who died almost TWENTY years ago.  E-signature was cancelled because the "signer was deceased" and I had to re-send with a lower level of authentication.  So there's *another* level of problem.

[Lion EA]

I can never pass those knowledge-based tests, because all the questions end up being about my ex-husband and his second wife.  I don't know what bank has their mortgage or what street they lived on in Syracuse.  I opened a UPS account using my current husband's name, because I knew what street his mother lived on ten years ago and other info about him and his family; have notices come to my email address.  But, I can't open an e-Services account in my husband's name, for instance.  I had to do one of the credit freezes via snail mail, sending in copies of DL, utility bills, etc., to prove who I am, because I couldn't answer the questions. And, in November, I'll go to a SS office (not all that near) with all my ID to prove who I am in person -- required to be in person, because I failed the questions -- so I can open up an online MySSA account.  Very frustrating.

[jklcpa]

Lion, I have that trouble too, but I know enough of the answers to get through the security questions. I run into this every time after clearing my computer's cache.  The question that usually pops up for us is about my husband's address from his first marriage that ended 27+ years ago! At least his ex didn't remarry, so I don't have that complication.  It's totally ridiculous that there isn't a time limit on those things. 

[Lee B]

Another IRS scam announcement:

"Tax professionals and their clients should be aware of a fake insurance tax form scam that is being used to access annuity and life insurance accounts. Cybercriminals currently are combining several tactics to create a complex scheme through which both tax professionals and taxpayers have been victimized."

[Jack from Ohio]

55 minutes ago, cbslee said:

Another IRS scam announcement:

"Tax professionals and their clients should be aware of a fake insurance tax form scam that is being used to access annuity and life insurance accounts. Cybercriminals currently are combining several tactics to create a complex scheme through which both tax professionals and taxpayers have been victimized."

I never send any taxpayer information to ANY third party.  Period.  I will send it to the taxpayer, then they can pass it along to whomever.

[JohnH]

I'm with Jack.  No info to third parties. Anytime or for any reason. 

[Cathy]

My suspicions were confirmed yesterday that IRS doesn't stop an E-Filed returned if an incorrect birthdate is used for a spouse on the E-File Info page.  Remember hearing at seminars that the dates of birth for the taxpayer and spouse were going to help prevent fraud.  Huh....it might indeed help if returns with incorrect birth dates were rejected!  This really doesn't surprise me.