IRS Tax Refund Phishing Scheme

Yesterday I received what is perhaps the most convincing phishing e-mail that I’ve ever seen. It was supposedly from ’support@irs.gov’ and it offered information on how to check on the status of your tax refund. It was relatively clean from a grammatical standpoint, and it offered several links for more information. Two of these led to actual IRS web pages, whereas the third led to a website out of Italy (or at least it was registered with a ‘.it’ top level domain) that looks just like an IRS web page, and had fields for entering your name, social security number, and credit card information.

Hello, identity theft! If only they had better timing — say, sometime during or shortly after tax season rather than the middle of December — they’d probably hook an awful lot of people. In case you’re curious, here’s what the message looked like (although it also had a graphical IRS header):

You filed your tax return and you’re expecting a refund. You have just one question and you want the answer now – Where’s My Refund?

Access this secure Web site to find out if the IRS received your return and whether your refund was processed and sent to you.

New program enhancements allow you to begin a refund trace online if you have not received your check within 28 days from the original IRS mailing date. Some of you will also be able to correct or change your mailing address within this application if your check was returned to us as undelivered by the U.S. Postal Service. “Where’s My Refund?” will prompt you when these features are available for your situation.

To get to your refund status, you’ll need to provide the following information as shown on your return:

Your first and last name
Your Social Security Number (or IRS Individual Taxpayer Identification Number)
Your Credit Card Information (for the successful complete of the process) [Note: Grammar was decent until here.]

Okay now, Where’s My Refund? [Note: Link to phishing site removed.]

Note: If you have trouble while using this application, please check the Requirements to make sure you have the correct browser software for this application to function properly and check to make sure our system is available.