Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/5/2017
10:50 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Businesses Hit by More W-2 Fraud as Cybercriminals Shift Tax Season Targets

Businesses, not individuals, are more frequently targeted with scams as cybercriminals try to cash in on tax season.

Every year, cybercriminals cash in on tax season by targeting individuals, but this year it's a little different. It's businesses that must be extra careful when filing, because businesses are experiencing a rise in tax-related scams, specifically W-2 fraud.

Researchers at IBM X-Force, the tech giant's security research division, discovered more than 1400% growth in general tax-themed spam between December 2016 and March 2017.

"On top of all the usual activity -- consumer tax fraud, filing on others' behalf -- we began to see that businesses are being targeted a lot more," says Limor Kessem, executive security advisor for IBM Security.

In the past, she says, tax fraud on businesses were the purview of only advanced attackers. This year, they saw a rise in social engineering attacks on smaller organizations like schools, non-profits, and restaurants as fraudsters start to aim for the "low-hanging fruit" of the corporate world.

Cybercriminals often collect W-2 data by pretending to be a company exec and emailing HR or payroll for employee information, which is used to file fraudulent returns and collect refunds. In addition, they may also request a wire transfer to a specific bank account.

Attackers who are more technically inclined may bypass the fake emails and breach an organization's servers to steal data directly, says Kessem.

In addition to using W-2 data for their own scams, fraudsters will sell it on the dark web, the report states. The most valuable bundles of information are called "Fullz" and contain the victim's address, contact info, Social Security and driver's license numbers, plus all W-2 and W-9 information. Each record runs for $40-$50 in Bitcoin on the Dark Web.

With all this data for $50 per record, harmful activity doesn't have to stop at tax fraud, Kessem notes. Cybercriminals can buy and use this data for other scams like identity theft or online loan applications.

Tax-related risks increase as the filing deadline approaches. One-third of Americans (54 million people) filed their taxes after April 1 in 2016, giving fraudsters a larger window of opportunity to strike. Tax-related cybercrime won't stop after April 18, 2017.

"There are a number of people filing after the deadline," says Kessem, noting the popularity of extensions. "Criminals don't have to stop then. There are millions who will still be interested in tax-themed emails."

However, their tax scam strategies will shift after the deadline as cybercriminals move from stealing data to infecting machines with malware. Because victims may expect messages indicating problems with their returns, they are more likely to open potentially malicious attachments, Kessem explains.

Researchers believe data sets sold on the Dark Web are a sign that fraudsters are stealing tax info from employer databases -- meaning they get it before the taxpayers. Here are a few steps consumers and businesses can take to protect themselves:

  • Don't delay: File as soon as you receive the paperwork. It can take a while to discover if your data has been compromised. Waiting gives cybercriminals more time to use your information.
  • Ask for verification: Phishing attacks often pretend to come from popular tax filing software vendors. If you plan to file your own taxes online, access the vendor's site directly, and don't click links or open attachments in vendor messages.
  • Don't answer online requests: Fake IRS-themed emails use logos and subject lines to trick taxpayers into responding. The IRS never contacts taxpayers via email, text message, or social media to ask for personal data, so don't reply to requests through these channels.
  • Get an IP PIN: Set up an Identity Protection PIN (IP PIN), which is a 6-digit number the IRS gives to taxpayers to prevent the misuse of their Social Security number on fraudulent tax returns. Check your eligibility here.  

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.