Category Archives: tax return fraud

Who Stole 3.6M Tax Records from South Carolina?

Posted on by

For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the state’s revenue department in 2012 and stealing tax and bank account information for 3.6 million people. The answer may no longer be a mystery: KrebsOnSecurity found compelling clues suggesting the intrusion was carried out by the same Russian hacking crew that stole of millions of payment card records from big box retailers like Home Depot and Target in the years that followed. Continue reading Who Stole 3.6M Tax Records from South Carolina?→

Man Accused of Selling Personal Information of 65,000 UPMC Employees Arrested in Michigan

Posted on by

Last week, the Department of Justice (DOJ) announced that the individual who allegedly breached the human resource database of University of Pittsburgh Medical Center (UPMC) in 2014 was arrested in Michigan. In a press release, the DOJ accuses Justin S… Continue reading Man Accused of Selling Personal Information of 65,000 UPMC Employees Arrested in Michigan→

Hackers file fake tax returns in scheme to steal IRS refunds

Posted on by

It may be open season for coronavirus scammers, but tax frauds aren’t letting up, either. Attackers tried obtaining large tax refunds by posing as clients of Weber and Company, the California-based accounting firm revealed last week. The scammers apparently accessed clients’ personal data — including, perhaps, Social Security numbers and bank account information — and used that to file fraudulent returns, Weber and Company said in a notification to California’s attorney general. The IRS and the FBI are investigating the matter, the company said. The number of attempted IRS scams tends to increase every year in March and April in the U.S., as legions of crooks try to steal Americans’ refunds. Earlier this month, the IRS said attackers exploiting the COVID-19 crisis could use stolen data to commit tax fraud. In 2016, the IRS said attackers had attempted to breach its online filing portal and steal Social Security numbers. For years, lawmakers have debated the proper response to incidents of this kind. It was not immediately clear […]

The post Hackers file fake tax returns in scheme to steal IRS refunds appeared first on CyberScoop.

Continue reading Hackers file fake tax returns in scheme to steal IRS refunds→

Russian charged with stealing $1.5 million in hacks on U.S. tax preparers

Posted on by

U.S. authorities have charged a Russian citizen in a scam that netted $1.5 million through bogus tax returns between June 2014 and November 2016, the Department of Justice announced Monday. Anton Bogdanov — who went by “Kusok,” according to court documents — is accused of computer intrusion, aggravated identity theft and other wrongdoing as part of his alleged role in a plot to combine hacking with traditional fraud techniques to steal money from the U.S. government. Bogdanov and others leveraged access to hacked computers at private U.S. tax preparation firms to steal individuals’ personal information, exploiting a vulnerability in an unnamed remote access program used by accountants to log in from home and while traveling, according to the indictment. They allegedly would use that access to change the information on victims’ tax returns, and redirect their refunds to debit cards under the thieves’ control, according to the Justice Department. Those debit cards […]

The post Russian charged with stealing $1.5 million in hacks on U.S. tax preparers appeared first on CyberScoop.

Continue reading Russian charged with stealing $1.5 million in hacks on U.S. tax preparers→

Tax scammers impersonating ADP, Paychex with aim to steal financial information

Posted on by

Hackers are trying to steal Americans’ tax information ahead of the April 15 deadline by sending emails that appear to be from trustworthy sources at Paychex, ADP and elsewhere, according to IBM research published Monday. Those messages actually are laced with TrickBot, a malicious software strain that typically infects victims through a malicious Microsoft Excel attachment. TrickBot steals valuable data including banking credentials, allowing thieves to wire themselves money from the victim without immediate detection. It’s delivered in the form of spam emails from Paychex and ADP, exploiting users’ familiarity with those financial companies at the height of tax season. The emails, tracked in early March, landed in inboxes between 11:45 a.m. and 3:45 p.m. Eastern Standard Time, during U.S. working hours. They also were written in English, and used a technique known as typo-squatting, in which a hacker creates a fake website meant to look a legitimate one in […]

The post Tax scammers impersonating ADP, Paychex with aim to steal financial information appeared first on CyberScoop.

Continue reading Tax scammers impersonating ADP, Paychex with aim to steal financial information→

Tax prep firm reaches settlement with FTC over cybersecurity lapses

Posted on by

TaxSlayer, a tax preparation company hacked by a ring of identity thieves in 2015, has agreed to settle a Federal Trade Commission complaint about its cybersecurity and data privacy practices — consenting to adopt a new security program and pay for third-party audits of its services. “Tax preparation services are responsible for very sensitive information, so it’s critical they implement appropriate safeguards,” said Tom Pahl, acting director of the FTC’s Bureau of Consumer Protection in a statement. “TaxSlayer didn’t have an adequate risk assessment plan.” The FTC announced the settlement in a statement Tuesday, saying the company was in violation of the Gramm-Leach-Bliley Act’s Safeguards Rule, which requires financial institutions to implement security safeguards to protect customers’ personal information; and its Privacy Rule, which requires financial institutions to tell customers about their privacy practices — the widely ignored “privacy notices” that they distribute. There is no direct financial penalty, but the company has to bear the […]

The post Tax prep firm reaches settlement with FTC over cybersecurity lapses appeared first on Cyberscoop.

Continue reading Tax prep firm reaches settlement with FTC over cybersecurity lapses→

IRS: Scam Blends CEO Fraud, W-2 Phishing

Posted on by

Most regular readers here are familiar with CEO fraud — e-mail scams in which the attacker spoofs the boss and tricks an employee at the organization into wiring funds to the fraudster. Loyal readers also have heard an earful about W-2 phishing, in which crooks impersonate the boss and request a copy of all employee tax forms. According to a new “urgent alert” issued by the U.S. Internal Revenue Service, scammers are now combining both schemes and targeting a far broader range of organizations than ever before. Continue reading IRS: Scam Blends CEO Fraud, W-2 Phishing→

Fraudsters Steal Tax, Salary Data From ADP

Posted on by

Identity thieves stole tax and salary data from payroll giant ADP by registering accounts in the names of employees at more than a dozen customer firms, KrebsOnSecurity has learned. ADP says the incidents occurred because the victim companies all mistakenly published sensitive ADP account information online that made those firms easy targets for tax fraudsters. Continue reading Fraudsters Steal Tax, Salary Data From ADP→