ANNAPOLIS, Md. (August 4, 2017) – Comptroller Peter Franchot is alerting tax professionals and those working within the tax industry about a new phishing email scam impersonating tax software providers and attempting to steal usernames and passwords.
The Internal Revenue Service said this latest scam email variation comes with a subject line of “Software Support Update” and highlights an “Important Software System Upgrade.” It thanks recipients for continuing to trust the software provider to serve their tax preparation needs and mimics the software providers’ email templates.
The e-mail informs the recipients that due to a recent software upgrade, the preparer must revalidate their login credentials. It provides a link to a fictitious website that mirrors the software provider’s actual login page. Instead of upgrading software, the tax professionals are providing their information to cybercriminals who use the stolen credentials to access the preparers’ accounts and to steal client information.
“Cybercriminals never rest and are always trying to get at Maryland taxpayers’ money,” said Comptroller Peter Franchot. “We need every tax professional and taxpayer to keep a close eye on emails that they receive and to make sure every precaution is taken to prevent becoming a victim of these scammers.”
This sophisticated scam yet again displays cybercriminals’ tax savvy and underscores the need for tax professionals to take strong security measures to protect their clients and protect their business. This is the time of year when many software providers issue software upgrades and when tax professionals are working to meet the Oct. 15 deadline for extension filers.
The Security Summit reminds tax professionals that software providers do not embed links into emails asking them to validate passwords. Also, tax professionals and taxpayers are advised to never open a link or an attachment from a suspicious email.
Tax professionals who receive emails purportedly from their tax software providers seeking login credentials should send those scam emails to their tax software provider.
For Windows users, follow this process to help the investigation of these scam emails:
1. Use “Save As” to save the scam. Under “save as type” in the drop-down menu, select “plain text” and save to the desktop. Do not click on any links.
2. Open a new email and attach this saved email as a file.
3. Send a new email containing the attachment to the tax software provider, as well as a copy to Phishing@IRS.gov.
The Comptroller’s Office reminds taxpayers not to reply to emails or phone calls asking for confidential information, most especially Social Security numbers, birth dates, salary information or home addresses. Maryland taxpayers may call 1-800-MD-TAXES or send an email to email@example.com to report a problem.
MEDIA CONTACT: Joe Shapiro, 410-260-7438 (office), 443-871-2244 (cell)
Alan Brody, 410-260-6346 (office), 443-924-1473 (cell)