Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/5/2017
10:50 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Businesses Hit by More W-2 Fraud as Cybercriminals Shift Tax Season Targets

Businesses, not individuals, are more frequently targeted with scams as cybercriminals try to cash in on tax season.

Every year, cybercriminals cash in on tax season by targeting individuals, but this year it's a little different. It's businesses that must be extra careful when filing, because businesses are experiencing a rise in tax-related scams, specifically W-2 fraud.

Researchers at IBM X-Force, the tech giant's security research division, discovered more than 1400% growth in general tax-themed spam between December 2016 and March 2017.

"On top of all the usual activity -- consumer tax fraud, filing on others' behalf -- we began to see that businesses are being targeted a lot more," says Limor Kessem, executive security advisor for IBM Security.

In the past, she says, tax fraud on businesses were the purview of only advanced attackers. This year, they saw a rise in social engineering attacks on smaller organizations like schools, non-profits, and restaurants as fraudsters start to aim for the "low-hanging fruit" of the corporate world.

Cybercriminals often collect W-2 data by pretending to be a company exec and emailing HR or payroll for employee information, which is used to file fraudulent returns and collect refunds. In addition, they may also request a wire transfer to a specific bank account.

Attackers who are more technically inclined may bypass the fake emails and breach an organization's servers to steal data directly, says Kessem.

In addition to using W-2 data for their own scams, fraudsters will sell it on the dark web, the report states. The most valuable bundles of information are called "Fullz" and contain the victim's address, contact info, Social Security and driver's license numbers, plus all W-2 and W-9 information. Each record runs for $40-$50 in Bitcoin on the Dark Web.

With all this data for $50 per record, harmful activity doesn't have to stop at tax fraud, Kessem notes. Cybercriminals can buy and use this data for other scams like identity theft or online loan applications.

Tax-related risks increase as the filing deadline approaches. One-third of Americans (54 million people) filed their taxes after April 1 in 2016, giving fraudsters a larger window of opportunity to strike. Tax-related cybercrime won't stop after April 18, 2017.

"There are a number of people filing after the deadline," says Kessem, noting the popularity of extensions. "Criminals don't have to stop then. There are millions who will still be interested in tax-themed emails."

However, their tax scam strategies will shift after the deadline as cybercriminals move from stealing data to infecting machines with malware. Because victims may expect messages indicating problems with their returns, they are more likely to open potentially malicious attachments, Kessem explains.

Researchers believe data sets sold on the Dark Web are a sign that fraudsters are stealing tax info from employer databases -- meaning they get it before the taxpayers. Here are a few steps consumers and businesses can take to protect themselves:

  • Don't delay: File as soon as you receive the paperwork. It can take a while to discover if your data has been compromised. Waiting gives cybercriminals more time to use your information.
  • Ask for verification: Phishing attacks often pretend to come from popular tax filing software vendors. If you plan to file your own taxes online, access the vendor's site directly, and don't click links or open attachments in vendor messages.
  • Don't answer online requests: Fake IRS-themed emails use logos and subject lines to trick taxpayers into responding. The IRS never contacts taxpayers via email, text message, or social media to ask for personal data, so don't reply to requests through these channels.
  • Get an IP PIN: Set up an Identity Protection PIN (IP PIN), which is a 6-digit number the IRS gives to taxpayers to prevent the misuse of their Social Security number on fraudulent tax returns. Check your eligibility here.  

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30481
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
CVE-2021-20020
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.