IR-2023-223, Nov. 27, 2023
The holiday season is here and the Internal Revenue Service, state tax agencies and the nation’s tax industry, working together as the Security Summit, kicked off the eighth National Tax Security Awareness Week with tips for taxpayers and tax professionals to avoid scams and protect sensitive personal information.
“As the holidays and tax season approach, this special week highlights that we are entering a period where taxpayers need to be extra careful protecting their sensitive financial and personal information,” said IRS Commissioner Danny Werfel. “Identity thieves are looking for ways to play the Grinch and steal taxpayer information that can help them steal identities and file fraudulent tax returns. The IRS and the Security Summit continue to work to strengthen our internal systems, but taxpayers and tax professionals form a critical first line of defense against identity thieves by securing their tax and financial information.”
Since 2015, the IRS and the Security Summit have used this special week to raise awareness among taxpayers and tax professionals to protect their information while shopping online or viewing emails and texts, especially during the holiday season when criminals are active.
During this week, the Summit partners are focusing on ways that taxpayers and tax professionals can protect themselves from evolving scams and schemes designed to steal personal, financial and tax information. This can help identity thieves file fraudulent tax returns.
The Security Summit reminds everyone to stay safe during both the holiday and tax season with the following tips that can help protect themselves while online and in other settings:
- Shop at sites where the web address begins with “https” – the “s” is for secure communications and look for the padlock icon in the browser window.
- Don’t shop on unsecured public Wi-Fi in places like a mall or restaurant.
- Keep security software for computers, tablets and mobile phones updated.
- Protect the devices of family members, including young children, older adults as well as less technologically savvy users.
- Make sure anti-virus software for computers has a feature to stop malware and that there is a firewall enabled that can prevent intrusions.
- Use strong and unique passwords for online accounts.
- Use multi-factor authentication whenever possible. It helps prevent thieves from easily hacking accounts. The IRS also reminds the tax community that the Federal Trade Commission this summer updated their standards and now requires tax professionals to use multi-factor authentication to protect information.
Other tips for tax professionals, businesses, taxpayers
Earlier this year, the Security Summit’s Protect Your Clients; Protect Yourself campaign encouraged tax professionals to focus on fundamentals and to watch out for emerging vulnerabilities being seen for those practitioners using cloud-based services for their practice. Scammers either trick or hack their way into tax professionals’ computer systems to access client data. Even when tax pros think they have client data stored in a secure cloud, lack of strong authentication can make this information vulnerable.
Additional safeguards for businesses, tax professionals and taxpayers to protect themselves from potential identity theft include:
- Use separate personal and business computers, mobile devices and email accounts.
- Do not send sensitive business information to personal email devices.
- Do not conduct business, including online business banking, on a personal computer or device.
- Do not engage in web surfing, gaming or video downloading on business computers or devices.
- Do not share USB drives or external hard drives between personal and business computers or devices.
- Never connect an unknown/untrusted piece of hardware into the system or network.
- Change passwords often, every three months is recommended.
- Consider using a password management application to store passwords.
- Do not reuse passwords on devices and applications that contain business information.
Common identity theft schemes seen by the IRS, Security Summit partners
The IRS is warning taxpayers to be on the lookout for a surge of tax scams as identity thieves continue pounding out a barrage of email and text messages promising tax refunds or offers to help ‘fix’ tax problems.
The latest email schemes touch on a variety of topics, but many center around promises about a third round of Economic Impact Payments. The IRS continues seeing complaints daily about this scam, which has an embedded URL link that takes people to a phishing website to steal sensitive taxpayer information.
The IRS also commonly receives reports of emails urging people to “Claim your tax refund online,” and text messages that something was wrong with the person’s tax return. These scams are riddled with spelling errors and awkward phrasing, but they consistently try to entice people to click on a link.
Stolen data can be used to file fraudulent tax returns that make it more difficult for the IRS and the states to detect because the fraudulent returns use real financial information. Other data thieves sell the basic tax preparer or taxpayer information on the web so other fraudsters can try filing fraudulent tax returns.
Taxpayers should be wary; remember, don’t click on links from questionable sources. Recipients of these IRS-related scams can report them to phishing@irs.gov.
With holiday season approaching, the IRS reminds people to be careful of gift card scams that can involve taxes. The IRS also reminds people about advice from the Federal Trade Commission to never buy anything from online sellers that accept payment only by gift cards, money transfers through companies like Western Union, MoneyGram or cryptocurrency. Payments made that way are nearly impossible to trace and reverse. Scammers commonly tell people to use those payment methods to pay tax bills so they can get money quickly.
Given the rise of texting scams, taxpayers can check out security recommendations for their specific mobile phone by reviewing the Federal Communications Commission’s Smartphone Security Checker. Since phones are used for shopping and even for doing taxes, remember to make sure phones and tablets are just as secure as computers.
Additional resources
For taxpayers, the IRS encourages people to watch out for common tax-related scams. People can get the latest information on scams by following @IRSnews on X (formerly known as Twitter) as well as other official IRS social media platforms.
For tax professionals, in addition to reviewing IRS Publication 4557, Safeguarding Taxpayer Data, practitioners can also get help with security recommendations by reviewing Small Business Information Security: The Fundamentals, by the National Institute of Standards and Technology. The IRS Identity Theft Central pages for tax professionals, individuals and businesses have important details as well.
Publication 5293, Data Security Resource Guide for Tax Professionals, provides a compilation of data theft information available on IRS.gov.
