Email Phishing Scam

[FDNY]

The current phishing scam attacking employers has hit one of my client's company.   The company has 400+ employees and my client is the CEO, email was not disguised as coming from him.  I asked if IRS was notified and they were, but I am not exactly sure what I should be doing going forward for his protection.   He notified me of this about a week ago, I would think fraudulent returns were already filed.  I told him to get an IRS security pin, but he isn't the type to bother with this as he expects me to do everything in his financial life, as I do for him all year.   I was  thinking of filing his return early, amending later,  in the hopes of heading off the bad guys if they haven't already filed.   He usually doesn't file until October due to many K1s, so I am very much considering this.   I would be grateful for your opinions and any advice or ideas.

I have also, with him on the line applied credit freezes with the 3 credit agencies. 

Thanks,

Bill

[Catherine]

Here's a new - and very nasty - one.  Is it the one your client got caught in?  Link is safe; goes to Forbes Magazine.

W-2 phishing scam

[Abby Normal]

Steps to take if you become a victim

If you are a victim of identity theft, the Federal Trade Commission recommends these steps:

• File a complaint with the FTC at identitytheft.gov.
• Contact one of the three major credit bureaus to place a ‘fraud alert’ on your credit records:
  • Equifax, www.Equifax.com, 1-800-766-0008
  • Experian, www.Experian.com, 1-888-397-3742
  • TransUnion, www.TransUnion.com, 1-800-680-7289
• Contact your financial institutions, and close any financial or credit accounts opened without your permission or tampered with by identity thieves.

If your SSN is compromised and you know or suspect you are a victim of tax-related identity theft, the IRS recommends these additional steps:

• Respond immediately to any IRS notice; call the number provided or, if instructed, go to IDVerify.irs.gov.
• Complete IRS Form 14039, Identity Theft Affidavit, if your efiled return rejects because of a duplicate filing under your SSN or you are instructed to do so. Use a fillable form at IRS.gov, print, then attach the form to your return and mail according to instructions.

If you previously contacted the IRS and did not have a resolution, contact us for specialized assistance at 1-800-908-4490. We have teams available to assist.

[Lion EA]

He needs to help his 400+ employees.

And increase security in his payroll/HR department with new and stronger passwords, updated training, need-to-know access to sensitive data, written process re disclosing employee date, etc.

[Lion EA]

Federal Trade Commission puts out a great book, Taking Charge -- What To Do If Your Identity Is Stolen.  It's free; our tax dollars at work.  I think the minimum order is 80.  I kept about 10 and took the rest to a meeting of one of my professional organizations to share.

Have your client order 400+ for his employees.

Make sure you have at least one on your bookshelf for reference.  And, a handful to give out as the need arises.

FTC.gov/IDTheft

[FDNY]

Thanks everyone.  Yes, the phishing scam in Forbes is the one, started with corporate employers and then morphed to other organizations.  I received an IRS email notice just the other day about this.

I'll do a 14039 if we find out if he was actually compromised (been there a few times)  but is there a way to find out if a return was filed without filing and getting a reject?   My concern is this, he is a high earner with multiple K1s that I have sent in big bucks for estimated taxes, but don't think that is at risk as a fraudulent return would only be based on the compromised W2, I would think.   I think I heard here the IRS is delaying refunds even further out than the 2/15 date, maybe because of this scam.  But am I putting too much faith in the IRS that if they are notified by the employer (last week), that those returns with the employer ID in question will be further scrutinized or held up?    Would the IRS computers be able to do this, I'm not so confident.   I will be calling the hotline to hear what they have to say on Monday and report back.

I never thought to ask him what was being done to help the employees.  I'll relay the FTC ID Theft book to him, great info Lion, thanks.  I hope the company is offering free credit monitoring too. 

 

 

[FDNY]

Just went to the 14039 and see one of the reasons is that federal tax records were affected, so that's first order of business in the morning.  Thanks Abby.

[Gail in Virginia]

3 hours ago, Lion EA said:

Federal Trade Commission puts out a great book, Taking Charge -- What To Do If Your Identity Is Stolen.  It's free; our tax dollars at work.  I think the minimum order is 80.  I kept about 10 and took the rest to a meeting of one of my professional organizations to share.

Have your client order 400+ for his employees.

Make sure you have at least one on your bookshelf for reference.  And, a handful to give out as the need arises.

FTC.gov/IDTheft

Lion, i went looking for the book you mentioned at the site you gave, and I can't find it.  They have 17 booklets listed as free (minimum order 100!)  but no books and nothing by that title.  I wondered if one of the booklets looks reasonably close to what you got.  I hate to order all of them since the minimum order is so large!  Besides, I don't speak or read Spanish which lets about half of them out. 

[Lion EA]

Mine was a 2013 edition, but someone was passing them out at our January NY/CT-ATP meeting.  I do see it as a .pdf publication now:

https://www.consumer.ftc.gov/articles/pdf-0009-taking-charge.pdf

And, lots of other related titles.  I'll take a look at their site again.

[Lion EA]

I think this one is the 2016 version of what I have; you can check out the .pdf:

https://www.bulkorder.ftc.gov/system/files/publications/pdf-0009_identitytheft_a_recovery_plan.pdf

If you like it, order -- it's free, including free shipping -- and share with other professionals in your area.  Or, drop some off at your church, broker, lawyer, town social worker, local small businesses, etc.  (Introduce yourself and leave a business card.)

The flyers look good, too, for a checklist of what to do, and you can easily print those one-pagers as you need them.

Look at the other titles (and other languages, depending on your neighborhood).  Click on them and check out the .pdf version.

[SaraEA]

From the IRS website:

Steps Employers Can Take If They See the W-2 Scam

Organizations receiving a W-2 scam email should forward it to [email protected] and place “W2 Scam” in the subject line. Organizations that receive the scams or fall victim to them should file a complaint with the Internet Crime Complaint Center (IC3,) operated by the Federal Bureau of Investigation.

See also:

Affected employers and companies should also alert the state tax agencies by notifying [email protected].