Users login

Create an account »


Users login

Home » Hacking News » IRS tax refund phishing

IRS tax refund phishing

by Nikola Strahija on November 30th, 2005 Phishers are abusing low US government website security and tricking taxpayers into revealing personal information.

E-mails pretending to be notifications of a refund from the US's Internal Revenue Service (IRS) take advantage of security configuration weaknesses on a secondary website run by the Department of Labor, Sophos warns. These emails redirect surfers to a bogus website with users fooled into thinking they remain on a legitimate US government site, said Sophos.

-This phish tells the user that the IRS owes them several hundred dollars and offers a web link from which they can allegedly claim the tax refund, said Graham Cluley, senior technology consultant at Sophos. -But the link in the email simply bounces the user off a US Government website onto a site owned by the criminals, who are ready and waiting to steal their credit card details, Social Security Number and other personal information.

The phishing website used in the attack has now been taken down but the security shortcomings of the US government site targeted in the attack remain, leaving the door open for similar attacks in future.

-The phishers didn't need to hack into or compromise the government website to do this, the website has simply had this vulnerability on it all along, Cluley added.

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »