Tax Professionals and Taxpayers - Beware of Scammers

[Julio Gonzalez]

The IRS has issued a warning to Tax Professionals to beware of scammers that are trying to steal business and taxpayer information. This could threaten not only the financial well-being of your clients, but also the integrity of your tax practice.

Here are some of the current schemes that scammers are using to go after tax professionals.

• Phishing Attacks Targeting Key Information: Scammers are targeting tax professionals through phishing emails and text messages that appear to be from the IRS in order to obtain sensitive information such as CAF numbers, PTINs and EFINs. They may even create fake websites that look like the IRS in order to steal your login credentials.
• Deception on Social Media: There is a lot of misinformation and scams being circulated on social media. Scammers may even go as far as creating fake W-2s or other tax documents or advertise fake tax credits to lure in taxpayers to share their sensitive information.
• Text, Mail and Phone Schemes: Scammers are targeting tax professionals and taxpayers through phone calls, text messages, and even fake AI generated IRS letters. They try to steal sensitive information including social security numbers, banking information, birth dates, etc.
• The “New Client” Trap: Scammers will pretend to be potential clients and will carefully construct emails to try to steal sensitive information including your PTIN, EFIN, or CAF number. There also could be malicious attachments or links that work to steal your login information or infect your computer.

Here are some ways that you can protect yourself and your clients.

• Stay up-to-date on IRS Communications: If you receive any communication from the IRS, ensure it is coming through a verifiable channel. The IRS will never contact you by text, email or social media to request personal information.
• Education for Your Staff: Be sure your staff knows how to recognize a phishing attempt and how to report it when one occurs. Institute additional phishing attempt trainings with your IT group.
• Increase Cybersecurity: Ensure your software and safety protocols are up-to-date. Implement strong passwords and multi-factor authentication.
• Report All Suspicious Activity: If there is a scammer or phishing attempt, report it to the IRS immediately at phishing @ irs.gov.
• Thoroughly Review All New Client Requests: If you receive an unsolicited email from a potential new client that is asking for sensitive information or is making an urgent request, be wary. Be sure you have verified their identity prior to sharing any sensitive information.

Here’s the IRS article for further information.

Have you had any of these scenarios happen to you? What procedures and processes have you put in place to avoid the scammers?