Vulnerabilities / Threats

4/6/2018
02:00 PM
Robert Block
Robert Block
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Protect Yourself from Online Fraud This Tax Season

Use these tips to stay safe online during everyone's least-favorite time of the year.

'Tis the season — the tax season … or should we say the tax fraud and risk season? While you might be concerned about preparing your taxes correctly, you should also be concerned about preparing them safely. While online tax filing is on the increase, there also has been an increase in tax software and online filings being attacked. You and tax preparers need to be vigilant in the pursuit of tax fraud and do as much as reasonably possible to understand how attackers are looking to take advantage and then apply appropriate actions.

Using high-level tools and tactics, cybercriminals can access information in your tax filings in the following ways.

  • Compromised account: Attackers can crack or leverage a compromised password and gain access to your online account. This is a common attack tactic. In fact, 81% of breaches leverage a compromised credential, according to Verizon's 2017 Data Breach Investigations Report.
  • Account fraud: Attackers register for a new account with socially engineered information and act as you.
  • Account takeover: Attackers gain access to your email and then initiate a password reset to change the password to your account, essentially gaining access and locking you out.  

We recently looked at the data from a large tax preparer's authentication attempts in a 30-day period during the 2016 tax season. Out of over 1 million user access attempts, more than 13,600 were either denied access or were asked for additional authentication to provide further proof of identity due to a high-risk score. That means 1.3% of all access attempts were suspicious or malicious.

Sixty days into the 2017 tax season, that same preparer had 1.5 million user authentication attempts with more than 28,700 of them being either denied access or asked for more authentication. That is, of all access attempts, nearly 2% were deemed suspicious or malicious, and were handled effectively.

If this tax preparer hadn't used an access management service, this 1% to 2% of suspicious or malicious activity could have gone undetected for weeks, and at best discovered only after some attacker-based activity took place.

So, what can you do to protect yourself? Here are tips to stay safe online during the tax season:

1. Enable multifactor authentication. More and more tax services are offering, at a minimum, two-factor authentication. Where possible, utilize additional authentication log-in options. If you're using tax preparers, ask them how they intend on protecting your information. If they can't answer, you might want to consider having your taxes prepared by someone else.

2. Best password practice. If your preparers don't offer seamless multifactor authentication protection and you still decide to do business with them, make sure you have a strong password that is unique and includes numbers and symbols — and never use it across multiple sites or accounts.

3. Don't be fooled by phishing emails. Ever receive suspicious emails asking for personal information or offering an outrageous discount or tax refund? Never open them without doing a basic authenticity check. If it seems too good to be true, it probably is.

4. Be wary of public Wi-Fi. Cybercriminals can easily see individuals' information on public Wi-Fi networks. Avoid inputting financial or sensitive personal information when connected to a public hotspot. Wait until you're at home or on a trusted network. 

5. Keep up to date. Keeping systems patched and updated ensures the best chance of known security issues. This is true for the operating system, antivirus software, and additional resources such as home routers. This also includes cellphones and tablets and anything else you might use to prepare and file tax documents.

Related Content:

 

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

As Senior VP of Identity Strategy at SecureAuth and Core Security, Robert Block is responsible for executing strategic vision of preventing the misuse of stolen credentials. Block has over 19 years of IT experience — of which 15 years have been focused on identity and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
7 Ways to Keep DNS Safe
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Locked device, Ha! I knew there was another way in.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14337
PUBLISHED: 2018-07-17
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.
CVE-2018-14329
PUBLISHED: 2018-07-17
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.
CVE-2018-14331
PUBLISHED: 2018-07-17
An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my.
CVE-2018-14333
PUBLISHED: 2018-07-17
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" delimiters, which might make it easier for attackers to obtain sensitive information by leveraging an unattended workstation on which TeamViewer has ...
CVE-2018-14334
PUBLISHED: 2018-07-17
manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766.