Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/5/2017
10:50 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Businesses Hit by More W-2 Fraud as Cybercriminals Shift Tax Season Targets

Businesses, not individuals, are more frequently targeted with scams as cybercriminals try to cash in on tax season.

Every year, cybercriminals cash in on tax season by targeting individuals, but this year it's a little different. It's businesses that must be extra careful when filing, because businesses are experiencing a rise in tax-related scams, specifically W-2 fraud.

Researchers at IBM X-Force, the tech giant's security research division, discovered more than 1400% growth in general tax-themed spam between December 2016 and March 2017.

"On top of all the usual activity -- consumer tax fraud, filing on others' behalf -- we began to see that businesses are being targeted a lot more," says Limor Kessem, executive security advisor for IBM Security.

In the past, she says, tax fraud on businesses were the purview of only advanced attackers. This year, they saw a rise in social engineering attacks on smaller organizations like schools, non-profits, and restaurants as fraudsters start to aim for the "low-hanging fruit" of the corporate world.

Cybercriminals often collect W-2 data by pretending to be a company exec and emailing HR or payroll for employee information, which is used to file fraudulent returns and collect refunds. In addition, they may also request a wire transfer to a specific bank account.

Attackers who are more technically inclined may bypass the fake emails and breach an organization's servers to steal data directly, says Kessem.

In addition to using W-2 data for their own scams, fraudsters will sell it on the dark web, the report states. The most valuable bundles of information are called "Fullz" and contain the victim's address, contact info, Social Security and driver's license numbers, plus all W-2 and W-9 information. Each record runs for $40-$50 in Bitcoin on the Dark Web.

With all this data for $50 per record, harmful activity doesn't have to stop at tax fraud, Kessem notes. Cybercriminals can buy and use this data for other scams like identity theft or online loan applications.

Tax-related risks increase as the filing deadline approaches. One-third of Americans (54 million people) filed their taxes after April 1 in 2016, giving fraudsters a larger window of opportunity to strike. Tax-related cybercrime won't stop after April 18, 2017.

"There are a number of people filing after the deadline," says Kessem, noting the popularity of extensions. "Criminals don't have to stop then. There are millions who will still be interested in tax-themed emails."

However, their tax scam strategies will shift after the deadline as cybercriminals move from stealing data to infecting machines with malware. Because victims may expect messages indicating problems with their returns, they are more likely to open potentially malicious attachments, Kessem explains.

Researchers believe data sets sold on the Dark Web are a sign that fraudsters are stealing tax info from employer databases -- meaning they get it before the taxpayers. Here are a few steps consumers and businesses can take to protect themselves:

  • Don't delay: File as soon as you receive the paperwork. It can take a while to discover if your data has been compromised. Waiting gives cybercriminals more time to use your information.
  • Ask for verification: Phishing attacks often pretend to come from popular tax filing software vendors. If you plan to file your own taxes online, access the vendor's site directly, and don't click links or open attachments in vendor messages.
  • Don't answer online requests: Fake IRS-themed emails use logos and subject lines to trick taxpayers into responding. The IRS never contacts taxpayers via email, text message, or social media to ask for personal data, so don't reply to requests through these channels.
  • Get an IP PIN: Set up an Identity Protection PIN (IP PIN), which is a 6-digit number the IRS gives to taxpayers to prevent the misuse of their Social Security number on fraudulent tax returns. Check your eligibility here.  

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.