The IRS Payment Confirmation email — a closer look

Tax Day 2015 is behind us. With the passing of the April 15 deadline, millions of taxpayers are now waiting for, or have already received, refunds. And, what those millions of taxpayers provide is an opportunity for scammers. Hence, we’re now seeing the IRS Payment Confirmation email scam.

What the IRS Payment Confirmation email looks like

You are receiving this notification because your tax refund request has been processed.

Please find attached a copy of the approved 1040A form you have submitted, containing your personal information and signature.

On the last page, you can also find the wire transfer confirmation from the bank.

Transaction type : Tax Refund

Payment method : Wire transfer

Amount : $1471

Status : Processed

Form : 1040A

Additional information regarding tax refunds can be found on our website: http://www.irs.gov/Refunds.

Please note that IRS will never ask you to disclose personal or payment information in an email.

Regards,

Internal Revenue Service

Address: 1111 Constitution Avenue, NW Washington, DC 20224

Website: http://www.irs.gov

Phone: 1-800-829-1040

A closer look at the IRS Payment Confirmation email

I had to think twice when when I received this IRS Payment Confirmation email, but here’s why this one made me think twice:

• I did have a refund coming
• All the links in the email were valid
• The return address was spoofed as “office@irs.gov”.
• The reassurance in the email itself that the IRS would not ask for personal information via email.

Even with those four things going in the scammer’s favor, there were four reasons why I knew this was a fraud.

1. The biggest tip off of all is that the IRS doesn’t send emails like this.
2. The amount cited in the email was incorrect.
3. The email was sent to “taxpayer,” not me.
4. There was a Word doc attached.

Number 4 is the critical point in this scam tip and the lesson to be learned. Any email you receive, unless it’s from someone you know personally, should be suspect if it contains an attachment. This is especially true if the attachment is a Word doc. However, other types of attachments can also include “executable code,” which simply means that once you click on the attachment, you’re in trouble.