Watch Out for Fake Tax 'Rebate' Sites
It's not exactly tax-filing time in the United States, but that doesn't mean online scammers aren't out to capture the money owed to you by Uncle Sam.
A scam Web site spotted recently by Security Fix is one of a steady stream of sites experts say surface year-round aiming to intercept tax refunds, fleece filers of their personal and financial details, and potentially expose e-filers to a later audit by the Internal Revenue Service.
This latest scam page, Rebate4File.com, is one such example. While the typical mid-April deadline for filing federal income taxes is long gone, this one may have surfaced due to the fact that Oct. 15 is a deadline for submitting tax returns for people who have filed for an extension.
This site, erected on Aug. 4, according to Web site domain records, represents one of two main IRS tax scams that we've seen over the years (the site is on a Web host that's home to two other recently registered sites, including "youbeenbanned.com"). While neither of these sites has yet been flagged by the anti-phishing toolbars built into the Internet Explorer 7 or Firefox Web browsers, I'd advise against visiting them for the time being.
The most common of these scams involves an unsolicited e-mail that notifies the recipient that he or she is due a refund from the federal government, and that all they need do to receive the money is supply a credit card number, which will allegedly be credited with the balance due.
The second, increasingly common scam employed by Rebate4File.com is far more nefarious. It involves Web sites that represent themselves as legitimate members of the IRS's sprawling "e-file" program, which allows third-party tax preparers to offer free online tax filing services to certain U.S. citizens.
Advertised via spam e-mail and by spam campaigns that boost the sites' rankings in search engine results, the scam sites look extremely legitimate. Scam sites like Rebate4File.com include the seal of several companies designed to instill trust, such as the IRS's own "e-file" logo, along with another seal from TRUSTe, a Web site security and privacy accreditation group (neither of logos are clickable on the fake site; on legitimate sites they would be and would take a user to the required verification pages.)
If you agree to file your taxes at a site like Rebate4File.com, the site may in fact go ahead and file your taxes with one of the legitimate, free e-filing companies approved by the IRS. The catch is that alongside your personal and financial data, the scammers direct any refunds to bank accounts that they control. So, if you are indeed due a refund, the money gets sent to the scammers' account, not yours.
What's more, the thieves now have every bit of data they'd need about you and/or your family to open new accounts in your name and conduct all manner of identity theft. Worse still, as far as the IRS is concerned, victims may still owe money to the federal government, potentially exposing them to future audits by the IRS.
Due in part to a spike in the number of such scam e-file sites, the IRS recently issued new guidelines for participating e-file companies that would allow the government to quickly distinguish between approved and non-approved e-file vendors. The deadline for the submission of information required to become a certified e-file Web site is tomorrow.
(Note also this variation on the IRS e-mail scam.)
By Brian Krebs |
August 8, 2007; 8:51 AM ET
Fraud
, From the Bunker
, Latest Warnings
, Safety Tips
Previous: Internet Explorer and Your Web Site's Privacy |
Next: Attacks Prompt Update for 'Tor' Anonymity Network
Posted by: Edgar Dworsky | August 8, 2007 9:33 AM
Edgar,
Thanks for pointing out the .com "oops." Aug. 15 is one of the e-file deadlines set by the IRS. See:
RS E-filing Deadline: Midnight Eastern Time, Wednesday, August 15, 2007
http://efile.form990.org/frmefilingdeadline.asp
But alas, that is for certain nonprofits only, not consumers. I have modified the text above to reflect the Oct. 15 deadline.
Posted by: Bk | August 8, 2007 9:44 AM
Have tried both sites. Netcraft flags 'red'= new site (in Denmark?). PhishTank gives 'no comment' and McAfee Siteadvisor states 'not tested yet'.
So far I received no unsollicited e-mails 'cause I have permanently switched-off the acceptance of cookies in my FF 2.0.0.6
Brian, keep up the good work. Your blog has saved me from a lot of trouble since May 2006. Thanks!!
Posted by: KarelJan, Amsterdam | August 8, 2007 1:14 PM
Looking at the domain registration whois info, my guess is the domain was registered using the identity and credit card of an ID theft victim. The practice is becoming more common all the time.
I see the site has been suspended -- that's good.
Posted by: Suzi | August 8, 2007 7:49 PM
Did not fall for the IRS scam telling me that I was due a $108 refund. Instead I reported the fraudulent letter not only to the fraud line online but also took the time on the telephone(took about 40 minutes) to get to a "live IRS person" who gave me an 800 number to which the letter was directly transferred while I was talking to him.
Posted by: Sue | August 13, 2007 12:17 PM
The comments to this entry are closed.
Two corrections:
(1) There is no such August 15th extension date that I am aware of. Automatic extensions are six months -- to October 15.
(2) You linked to irs.COM instead of irs.GOV ! Oopsie!
The proper link to the notice about extensions is:
http://www.irs.gov/newsroom/article/0,,id=169406,00.html