New scams, new weapons from the IRS to fight client ID theft

The Internal Revenue Service and its Security Summit partners are renewing warnings to tax professionals about new and evolving schemes aimed at stealing business and taxpayer information.

Among the schemes they’re warning about:

• The “new client” scheme. In a spear phishing scam, fraudsters pretend to be real taxpayers seeking tax pros’ help with their taxes.
• EFINs, PTINs, CAF numbers. Phishing by scammers trying to obtain identification numbers used by tax professionals.
• Phone, text and correspondence schemes. Several of these schemes are common right now that can target not just taxpayers, but potentially tax pros and their clients (three are described below).
• The “Zero Tax” call. Callers promise to wipe out tax debt for clients, and they request people’s Social Security numbers as part of their pitch.
• Social media scams. These circulate inaccurate or misleading tax information that can involve creating common tax documents that are false, like a Form W-2, or claiming credits to which the taxpayer is not entitled such as the Fuel Tax Credit, Sick and Family Leave Credit and Household Employment Credits.
• Bucks for info. Scammers reach out by phone or text message to dupe people into handing over sensitive financial information in exchange for a false promise of IRS money.
• Artificial intelligence. Scammers will use AI to create fake IRS letters mailed to client victims.

Tax pros who discover they’re victims of a security breach should contact their local IRS Stakeholder Liaison, who will alert the appropriate IRS offices. If incidents are reported quickly, the IRS can take steps to block fraudulent returns in the clients’ names and will assist tax pros through the process.

Tax pros can also share information with the appropriate state tax agency by visiting the Report a Data Breach page from the Federation of Tax Administrators. Tax pros should also understand the Federal Trade Commission’s Data Breach Response requirements as part of their overall information and data security plan.

The IRS/Security Summit’s remaining summer information campaign will cover what phishing scams might look like, written security plans for tax pros and security tools such as multifactor authentication.