IRS Warns of Spoof Emails from CEO Posers

IRS Warns of Spoof Emails from CEO Posers

As an employee, when the CEO or other executive asks you to jump, the typical response is “how high?” So if you were to get an email from the CEO asking for a list of employee data, you probably wouldn’t question it. You’d probably send the info as soon as possible and without too much thought.

Cybercriminals who understand the position of power that company executives possess are using these relationships to obtain sensitive employee data. The practice is called “spoofing” because the thieves pose as the CEO or other high level executive, using the real executive’s name in an email to those within the company who have access to W-2s and social security numbers (typically those within payroll or human resource departments). Then these criminals obviously use the data to file false refund returns or sell the data to 3rd parties.

The IRS made a statement yesterday alerting the public of this new kind of phishing scheme:

If your CEO appears to be emailing you for a list of company employees, check it out before you respond. Everyone has a responsibility to remain diligent about confirming the identity of people requesting personal information about employees.

~ IRS Commissioner, John Koskinen

I guess the question some payroll people will have is “what should I do to check it out“? Every company and every office is different. Your response may depend on the formality of your office and the relationship you have with the executive who requested the info. In some circumstances it may not be appropriate to knock on the CEO’s door asking if he/she emailed you. It might be a little awkward emailing back asking the CEO what he plans on doing with the info, or asking if he can authenticate by giving you the name of his favorite childhood pet or his mother’s maiden name.

I suspect that in most cases the email address of the sender will be a dead giveaway. If you don’t recognize the email address, then you can ask the follow up questions or pay the CEO a visit. Having said that, I don’t know for sure that these cybercriminals cannot send emails that appear to be sent from a company email system, in which case it might be wise to ask about the childhood pet anyways. Better safe than sorry, even if the price is a little embarrassment.

IRS Tax Scam Tips

Every tax season the IRS warns taxpayers of tax-time scams and how to avoid them.  The IRS says that “tax scams proliferate during the income tax filing season.”  This year the filing season begins January 31st.  I hope taxpayers take this to heart, but I also hope that they remain vigilant throughout the entire year.

People often ask me if business picks up during tax time, and I usually explain that the IRS’ collection machine runs 24/7 and 365 days per year.  The IRS Collections Department doesn’t really have a “season” so to speak; they work year-round.  We do tend to get more phone calls during the first few months of the year, but this is due to the fact that the tax season is when people tend to think more about their tax issues.  The thought of having to file income taxes again naturally leads to the next thought of having to do something about the prior tax years and tax debts already on the books.

I suppose that a similar phenomenon occurs with tax scammers.  They definitely do their dirty work around the clock and any time of the year.  But they know that they will have more success during the income tax filing season.  Poor, unsuspecting taxpayers are just more likely to pick up the phone, divulge confidential information, and open spammy emails during this time of year.

The common-sense advice that the IRS gives each year can be summarized as follows: Don’t give out your personal information such as passwords, PINs, credit card or bank info via emails or over the phone.  This is not how the IRS operates, and if you do get a phone or email request for such information, it is probably a scam.

"This is George Miller with the IRS…"

It sure was nice of the IRS to warn taxpayers of a “pervasive telephone scam” last week.  The scam artists apparently target recent immigrants, threaten jail time, and run credit card payments over the phone.  The IRS described a number of things to look out for, presumably so we all can  independently determine if the call we received is from a scammer or from an actual IRS representative.  The only problem is sometimes the thieves and the IRS agents share some of the same characteristics.  Let me show you what I mean.

  • Scammers use phony names and IRS badge numbers: Great, but how would we know if the name or badge number is fake?!  The IRS says that they often use common names.  But I know there are plenty of real IRS reps who have common names.  Plus, recent immigrants may not be fully aware what is or is not a common American name.  It might have been helpful if the IRS had given a sample ID number so that taxpayers could at least know if it was the correct number of digits.  Many of the representatives I speak with use 7-digit ID numbers (assuming I have been talking with the IRS for the past 8 years and not phone scammers).
  • Scammers may be able to recite the last 4 digits of the victim’s SSN: So can a real IRS rep.
  • Scammers spoof the IRS toll-free phone number on caller ID: When I have received calls from revenue officers, offer in compromise examiners, and appeals agents, it usually shows “Unknown” on caller ID, so this is good to know.
  • Scammers sometimes follow up the call with a bogus email: Real IRS agents never send emails, so this is actually a dead giveaway.
  • Scammers produce phony call center background noise: I have often heard phones ringing and low chatter that is characteristic of a call center when talking with the IRS, so I’m not sure how helpful this tip is.

I think this IRS warning is useful, but only by becoming familiar with the entire list of characteristics.  If you receive a call fitting one of the above descriptions, there may not be cause for concern (unless you are asked to provide credit card info).  But if you receive a call with many of the above characteristics, it is probably a phony IRS call and a scam.

Some IRS News & Some FTB News

Internal Revenue Service

The IRS expects the 2014 tax season to be delayed by one to two weeks.  That would mean the new tax season would begin somewhere between January 28th and February 4th.  The reason for the delay?  None other than the historic Fall 2013 government shutdown.

The IRS normally begins tuning and tweaking their complicated tax return processing systems in the fall, even before the start of the 4th quarter.  This year’s system testing period was delayed when the IRS closed its doors during the first half of October.  You should also be aware that the February 4th start date is only an estimate.  The IRS will re-evaluate and confirm the 2014 Tax Season start date in December.

California Franchise Tax Board

We often hear about federal tax scams, but the FTB recently sent out a warning to California residents to keep their eyes and ears open for phishing schemes and identity theft.  There is apparently a scheme which targets elderly taxpayers in Beverly Hills.  The caller, posing as a FTB employee, tells the victim that they were ticketed for a red light violation and their case has been forwarded to the FTB for collection purposes.  As ridiculous as this may sound, the IRS has been given so many additional responsibilities over the years that it’s hard to say what they may have a hand in.  So, why not the FTB too?

The moral of the story is the same as it always is for the IRS: they won’t contact you by email, and they will rarely call you without sending a series of notices first.  You need to be suspicious if either of these things happen to you.

Bold New Tax Scams

Some IRS scam artists are using bolder techniques to get their hands on taxpayers’ personal and financial information.  Emails are very common; we have seen many phony IRS email campaigns over the years.  Deceptive mailers are also prevalent, many of them rising to the level of what I would call a scam.  Far less common is a direct phone call from someone claiming to be an IRS employee, but there has been somewhat of an outbreak of these recently.

Blogger and tax attorney, Kelly Phillips Erb, reported that one of her clients recently got a call from somebody claiming to be from the IRS.  It is Erb’s opinion that IRS scammers are taking advantage of the government shutdown; they feel emboldened by the fact that victims can’t very well call the IRS right now to report them.  A local news source in Minnesota has also recognized an uptick in IRS phone scams, although I don’t agree with them that the test for identifying a phony IRS call is a thick accent.  I have also been informed of a couple IRS phone scams close to home (or perhaps the same one?), one from a client and one from a concerned taxpayer.  The latter was told that the IRS was going to come to his place of employment to arrest him.

Not to get too psychoanalytic or anything, but phony IRS phone calls takes the deception to a whole new level.  Granted, if somebody is tricked into giving up their social security number or credit card number, to them it doesn’t matter if it occurred in an email or over the phone.  The result is the same either way.   However, I do feel like it takes a different type of criminal to be bold enough to swindle somebody in a one-on-one situation.  An email campaign is so impersonal; a criminal can reach thousands of people with a couple clicks of a mouse.  But in a successful phone scam, the criminal needs to utter multiple lies to multiple victims.  It just seems like a much bolder form of tax scam and hopefully it is not a sign of things to come.

Phony IRS Email

Today one of my clients who has a tax debt found the following email in her inbox, which was obviously NOT from the IRS:

Good day,Here is a notice, that you need to pay a penalty because you did not file income tax return by the deadline that is January 31, 2012.

Please note, that IRS [Section 6038(b)(1)] determines a monetary penalty to the amount of $10,000 for each [Form 5471] that is sent after the due date of filing the income tax return, or does not include the exhaustive information determined in [Section 6038(a)].

You will be released from the penalty provided that the taxpayer shows that the failure to meet the deadline for filing was caused by substantial reasons.

Please enter our official site for more details.

Kind regards,
Internal Revenue Service United States
Department of the Treasury

As you can probably imagine, the link (“Please enter our official site”) does not take you to the IRS website.  Had she clicked on the link, she could have compromised her computer files or possibly subjected her computer to a virus.  It is important to keep in mind that the IRS does not send unsolicited emails.

Another Round of Fake IRS Emails

Don’t be fooled by scam emails purporting to be from the IRS. The IRS does not communicate with taxpayers by email, so you can be sure that anything appearing to be from the IRS is a scam. IRS scam emails often contain links which, if opened, can damage your computer or compromise your private information.

The latest scam email originated in Saudi Arabia, contains the subject line “Tax refund important information,” and the following content:

After the last annual calculations of your financial activity we have concluded that you are eligible to get a tax refund of $464.
You may submit the tax refund application and give us 3-9 days in order to process it.

A refund can be hindered for many different reasons.
E.g., submitting invalid records or not meeting a deadline.

To get information about your tax refund please open this link.

Tax Refund Department
Internal Revenue Service

 Thanks to the Taxgirl, Kelly Philips Erb, for spreading the word about these nefarious emails.

The Latest Phishing Expedition

Phishing: “a scam typically carried out by unsolicited email and/or websites that pose as legitimate sites and lure unsuspecting victims to provide personal and financial information.” A phishing victim often finds himself burdened with tax problems that are not his own. See IRS website for full detailed information about phishing and everything you need to know about identity theft.

Be on the lookout for the following email subject lines in your inbox:

“Urgent update of tax information is requested”


“Tax information required within 30 days.”

It is recommended that you delete these emails immediately because it’s a scam. If you do decide to risk opening the email, the text will look something like this:

Dear Account Holder,

In our continuing effort to guarantee that exact data is being sustained on our systems, as well as to provide you better quality of service; INTUIT INC. has participated in the Internal Revenue Service [IRS] Name and TIN Matching Program.

We have discovered, that your name and/or Taxpayer Identification Number, that is stated on your account does not correspond to the data on file with the Social Security Administration.

In order to check the data on your account, please click here.


Corporate Headquarters
2632 Marine Way
Mountain View, CA 94043

Thanks to Kelly Philips Erb for pointing out these scam emails from time to time. If bloggers will repost these scams all over the internet, maybe we can minimize the damage to innocent taxpayers.

Beware of Bogus IRS Emails

I have said this before, but it bears repeating. Any emails you might receive purporting to be from the IRS are more than likely spam. The IRS does not communicate with individual taxpayers in this manner. You should forward any such email to and then delete the emails without opening them.

Apparently there is another batch of bad emails being dispersed this week. Thanks tKelly Phillips Erb at Forbes for the heads up. One is from “” and the other is from “support” Hopefully you’re not so curious that you would risk infecting your computer, or worse, giving up personal information to identity thefts. But, if you can’t stand not knowing what the emails say, this is the gist of it:

“Important information about your tax return. We are unable to process your tax return. We recived your tax return. However, we are unable to process the return as field. Our records indicate that the person identified as the primary taxpayer or spouse on the tax return did not provided all the required documents shown on the tax form. Our records are based on information received from the Social Security Administration. Based on this information, the tax account for the individual has been locked.” The message is full of typos, which could make you wonder if it really isn’t from the government. But it goes on to request personal financial information. Its definitely a scam.

IRS-impersonation Scam Emails

The IRS has emphatically stated that they do not send out unsolicited emails. So, if you receive an email that appears to be from the IRS, but requests personal / financial information, then chances are it is a scam. People who fall prey to these emails may become victims of identity theft if they give up the requested information to the scammer or if they unknowingly open up their computers to malicious software.

If you receive an email requesting personal information that appears to be from the IRS, do not open it and do not click on any links. You should immediately forward the email to, then delete the email. If you believe you have become a victim of identity theft, contact our tax relief firm and we may be able to help you.