Tax Hacks: How Seasonal Scams Cause Yearlong Problems

Tax season is marked with malware campaigns, tax fraud, and identity theft, with money and data flowing through an underground economy.

For most Americans, Tax Day is a red-flag deadline on the calendar. For cybercriminals, its one day out of a season marked with scams to deceive victims out of money and personal data.
Seasonal threats are common among cybercriminals, who often exploit holidays, news, or global events for attack opportunities, says Limor Kessem, IBM global executive security adviser with its X-Force team. One of the biggest lures is tax season in the United States. They start in January, and they drag it out until May, even June, she says. After Tax Day, they can capitalize on people waiting to receive responses on their tax returns, refunds, or payment notifications.
Tax fraud is an old problem manifesting in new ways as more people file taxes online. The IRS expects more than 90% of tax returns will be prepared electronically using tax return software,
RiskIQ reports
in its 2019 Tax Season Threat Roundup. People eager to cash in on tax returns are promising targets for cybercriminals, who spoof popular e-filing tools to exploit them.
IBM X-Force researchers recently discovered several of these ongoing tax-themed campaigns, three of which affect businesses as well as consumers. Attackers attempt to trick victims with messages appearing to be from major accounting, tax, and payroll services, including ADP and Paychex. Malicious Microsoft Excel attachments packed Trickbot, a common banking Trojan that infects devices to steal data and follow up with wire fraud from the owners account.
Trickbot itself it very focused on businesses, says Kessem of the enterprise angle. Theyre out to empty those business accounts. While organizations have long been targeted with banking Trojans, the emergence of Trickbot in tax season campaigns is fairly new this year, she adds.
Researchers from IBM X-Force believe the size of the firms spoofed indicates attackers will likely be successful in tricking their customers. Businesses and individuals who use services from ADP and Paychex will likely expect to receive emails from their service providers around tax season, they
point out
.
All the attackers need is one person to believe a fake email, and theyre in. They want to get that one foothold, Kessem says. They want someone who will believe their email and get infected with the malware. From there, Trickbot is equipped to move laterally on a network.
Its one of many campaigns with malware payloads mixed into tax-related emails. Late last year, Proofpoint researchers
detected
campaigns luring targets with urgent subject lines (Your IRAS 2018 Tax Report, IRS Update for 1099 Employees). These malicious messages, which typically rely on advanced social engineering techniques to alarm their victims, distributed a variety of remote access Trojans: Orcus RAT, Remcos RAT, and NetWire among them.
Tax Fraud? Theres An App for That
Taxpayers filing via a mobile app should be on alert for fraudulent apps, RiskIQ reports. While most apps for tax filing are secure and dont store data on the device, fake mobile apps often impersonate popular tax-filing services to get people to give up sensitive data. While many are hosted on third-party stores, theyve also been seen on official Google and Apple app stores.
There are ways to spot fake apps, RiskIQ researchers point out, using a fraudulent H&R Block app as an example. For starters, there is no developer listed – a major red flag – and it requires more permissions than necessary: record audio, camera access, and download data without notification. The app could effectively spy on the unknowing user, even if that person isnt using his phone.
The Industry of Identity Fraud
You dont need to be a skilled hacker to hack Tax Day, Carbon Black found in a
new report
on tax fraud and identity theft on the Dark Web. Cybercriminals have long sold identity and banking data online. Now researchers say the economy around tax identity theft has grown.
Identity theft has really gone beyond a pickpocket or creation of a credit card in your name, says Tom Kellermann, chief cybersecurity officer at Carbon Black. I would call it robbery of your financial future. They can commandeer … your financial identity and use it in perpetuity.
Its easy and cheap for even unskilled hackers to pull off: Dark Web marketplaces sell W-2 and 1040 forms for between $1.04 and $52. Names, Social Security numbers, and birthdates are similarly inexpensive, with prices ranging from $0.19 to $62. For $1,000, a relatively inexperienced hacker can buy authenticated access to a US bank account, file a fake tax return, claim the refund, and cash out through a cryptocurrency exchange to get a $100+% return on investment.
The evolution in tax fraud can be seen in lower prices for tax identity theft on the Dark Web, sellers working to differentiate their products, and new products being developed. And identity theft can lead to credit card and home equity loan fraud, which pack long-term damage.
Wealth goes beyond the money [victims] have; its lines of credit that can be established in their name, Kellermann says. Home equity fraud is easy with a stolen W-2; victims dont know until its too late. This highlights the fact that if you can compromise someones W-2s, the first step is to get the refund, and the second and third steps are far more nefarious, he adds.
Related Content:
Stop Mocking & Start Enabling Emerging Technologies
Microsoft Patch Tuesday Fixes Windows Bugs Under Attack
6 Essential Skills Cybersecurity Pros Need to Develop in 2019
7 Malware Families Ready to Ruin Your IoTs Day

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Tax Hacks: How Seasonal Scams Cause Yearlong Problems