It’s about that time of year again where we all start to file our taxes with many of us hoping to get a refund. At the same time, this is when people begin to prey on the less technically savvy by stealing their personal inform or also known as phishing scams.
I just received this e-mail about getting a tax refund and the funny thing is that it is targeted at a US citizen while I’m here in Canada.
Subject: Tax Refund (Message ID V3418364T73)
Date: Tue, 4 Mar 2008 09:34:07 -0500
MIME-Version: 1.0
Content-Type: text/html; charset=”Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000A Secure Way to Receive Your Tax Refund
After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a tax refund of *$873.20*. Please submit the tax refund request and allow us 3-9 days in order to process it.A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here
*Note:* For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.Regards,
Internal Revenue ServiceCopyright 2008, Internal Revenue Service U.S.A. All rights reserved.
I decided to visit the site anyways for the sake of documentation. Typically what these scams do is that they copy the pages and files from the real sites to make it appear as if you are on the official site as seen here:
Of course, a lot of people assume it is legitimate and then proceed to fill out the forms that request for a great deal amount of personal details such as your social insurance number and credit card information.
You know what is going to happen next if you do that. Basically, you will get no refund and someone else will more than likely try to use your personal details to open accounts under your name and you’ll have one big messy situation of identity theft.
For phishing scams in general, one of the easiest non technical way to find out if the site you are on is legitimate is to simply look at the url address on your browser. For example, in this situation the real site is located at http://www.irs.gov/ . If we take a look at the url as shown in this screenshot you would notice that we are on a completely different site.
That is usually the easiest sign that you are being tricked. Of course, it is better to just delete these types of e-mails. Just be extra careful.