Remember the old adage, “If it sounds too good to be true, it probably is.” Then remember that you have never provided the IRS with your email address. So, when the message comes from “the IRS” that says you have a tax refund and takes you to the “IRS” website to enter credit card details - delete it or forward it to the proper authorities. The current one making the rounds takes advantage of a glitch in a government website to take you to that website first, making the email look more legitimate, but it’s really this simple - the IRS sends refund checks automatically in the mail as long as they have your current address. They don’t send refunds out by email. If you want to make sure you’re getting the refunds you have coming make sure IRS has your current address. If you’re still unsure, contact the IRS directly, but don’t click on phishy emails.
A spam e-mail message has been sent around the world telling people they are eligible for a $571.94 tax refund from the IRS. The e-mail offers a link to a fraudulent IRS Web site, but the link actually goes through a legitimate government Web site that only last month was promoted by President Bush.
“This is more advanced than the typical phish, because the Web link really does–at first–take you to the real tax benefit Web site,” said Graham Cluley, senior technology consultant for U.K. security vendor Sophos. “Unfortunately the way the government Web site has been configured allows the phishers to bounce the unwary in their direction.”
The link in the phishing e-mail goes to a forged IRS Web site that asks for a Social Security number, tax return filing code and credit card details including security code and PIN.