Scammers target universities in ongoing IRS phishing attacks

The Internal Revenue Service (IRS) is warning of ongoing phishing attacks impersonating the IRS and targeting educational institutions.

The attacks use tax refund payment baits and mainly focus on universities' staff and students with .edu email addresses.

"The phishing emails appear to target university and college students from both public and private, profit and non-profit institutions," the US revenue service warned.

Tax refunds used as lures

These phishing messages use "Tax Refund Payment" or "Recalculation of your tax refund payment" subject lines to attract the targets' attention and increase the phishers' social engineering attacks' success rates.

Abnormal Security researchers who spotted these attacks in the wild earlier this month said that they bypassed Office 365 security and landed in the mailboxes of between 5,000 and 50,000 targets.

Attackers redirect potential victims to phishing pages using links within asking the recipients to claim their refunds.

After landing on the phishing pages, the targets are then prompted to fill out a form with sensitive personal information, which the attackers can later use to commit fraud.

The taxpayers are asked to provide a wide array of information, including their:

• Social Security number
• First Name
• Last Name
• Date of Birth
• Prior Year Annual Gross Income (AGI)
• Driver's License Number
• Current Address
• City
• State/U.S. Territory
• ZIP Code/Postal Code
• Electronic Filing PIN

"This impersonation is especially convincing as the attacker's landing page is identical to the IRS website including the popup alert that states' THIS US GOVERNMENT SYSTEM IS FOR AUTHORIZED USE ONLY', a statement that also appears on the legitimate IRS website," Abnormal Security revealed.

Targets advised to report and get an Identity Protection PIN

The IRS advises university staff and students who received one of these phishing emails not to click on any of the links embedded within and forward the emails (as file attachments) to phishing@irs.gov.

They should also get an Identity Protection PIN ASAP to block identity thieves from filing fraudulent tax returns in their names using stolen personal information.

This IRS impersonation scam should also be reported to the Treasury Inspector General for Tax Administration for further investigation by IRS' Criminal Investigation division.

Last year, aggressive scammers also impersonated the IRS in emails threatening targets with arrest warrants and legal charges unless they paid fake outstanding amounts related to late or missed payments.

The US Federal Trade Commission (FTC) said last month that the number of identity theft reports doubled in 2020 compared to 2019, reaching a record of 1.4 million reports within a single year.