It's officially tax season, and April 15 is fast approaching. Sure, waiting until the last minute to file is tempting, especially if you owe the government money, but security experts say procrastinators should beware.
Rushing last-minute through this annual chore could put you at risk for more than just making costly mistakes -- it could also make you more likely to fall for tax season-related scams and other attempts to steal your refunds and personal information.
While consumers have long needed to worry about scammers and cybercriminals looking to capitalize on tax season, experts say their threat is only growing as they increasingly harness the power of artificial intelligence tools to boost both the scale and sophistication of their attacks.
"A lot of these social engineering scams are getting more real, more believable," said Abhishek Karnik, head of threat research for McAfee.
For example, a person could receive a phone call from someone claiming to be an IRS agent with what sounds like an American accent. But they're a scammer calling from another country and may not actually be a native English speaker.
With the help of AI tools, scammers can change their voice and speech patterns to sound more convincing, turning what might have been an easily spotted scam into something much more dangerous, Karnik said.
And more people are falling for those scams. Nearly one in four people polled for a McAfee survey released Thursday say they or someone they know has lost money to a tax scam. In addition, 87% of people polled say they're concerned about the use of AI in generating more -- and more realistic -- tax scam messages and fraudulent content.
While most of the AI-generated scam messages McAfee researchers see now come in the form of recorded phone calls, Karnik said it's only a matter of time before even more convincing real-time audio and video deepfakes become the norm.
Meanwhile, scammers also use AI to boost their production of scam text and email messages. These also might attempt to impersonate the IRS, but they could pretend to be from one of the big tax software brands like TurboTax or H&R Block.
But instead of sending victims to the company's real website, scammers usher them to a fake one that collects their money or their most private personal data. Karnik said victims could also end up with malware on their computers if they're tricked into downloading fake tax preparation software.
Truman Kain, a security researcher at the cybersecurity firm Huntress, says one new tax scam cybersecurity researchers are seeing this year is one that falsely promises $1,400 stimulus payments.
The scam stems from the IRS' December announcement that it would send payments to filers who didn't receive them during the pandemic.
Kain said scammers pounced on that announcement. "They know people are wondering if they qualify for it, so they're sending fake IRS texts to steal personal information," Kain said.
But the IRS has already made the bulk of those payments, and it's doing them automatically, so those who qualify don't need to submit any personal information to get theirs. But that isn't stopping scammers from sending fake IRS text messages saying that they do.
When people click on the link in the scam texts, they're usually taken to a fake IRS website that asks them to hand over personal information like their Social Security number and banking information.
"That's everything a scammer needs to commit full-blown identity theft," Kain said.
On top of that, scammers can also use the information to file a tax return in your name and steal your potential refund.
How to avoid tax scams
That all may sound daunting, but experts say that most scams can be avoided if people just take a moment to stop and think.
Here are a few tips from the IRS and the experts for staying alert.
Don't panic: Taxes are stressful, but scammers will try to take advantage of your anxiety by adding a sense of urgency to their messages. They might say your refund is in jeopardy or that you might face jail time if you don't hand over your information, make a payment or download their software right away. Demands like these are big red flags, Karnik says.
File early: The IRS accepts the first return they receive, Kain says. The earlier you file, the less time cybercriminals have to use your identity to commit fraud. Don't forget, if you need more time, you can file for an extension.
Watch out for phishing and smishing: The IRS never sends unsolicited emails or texts. Skip the links and attachments and go straight to the IRS or the applicable state and city websites. In general, don't reply to emails or texts sent from unknown sources. And definitely don't open attachments from people you don't know or send them your personal information like your Social Security number or tax ID.
Be wary of weird payment methods: Requests for tax payments in cashiers checks, wire transfers, gift cards or cryptocurrency are all scams. The IRS doesn't accept any of these, Karnik says.
Know who you're dealing with: If you're self-filing online, make sure you're using a reputable service and make sure you're using the right website for that service. If you hire someone to do it for you, make sure they're who they say they are. Check credentials and qualifications using the IRS Directory of Federal Tax Return Preparers.
Get a PIN: Taxpayers who can validate their identities with the IRS can obtain an identity protection PIN, a six-digit code that prevents a cybercriminal from filing a fraudulent tax return with your Social Security number. This is an especially good idea if you've been a victim of fraud in the past, Kain says.
Always use good passwords and 2FA: These are both a must for any account related to your tax returns and documents. Make sure you're using good antivirus software and that it, along with your operating system, is up to date. While you're at it, back up your tax information to a removable drive or encrypted cloud storage. Paper copies and drives should be securely stored.
Shred everything: Tax documents that are no longer needed must be properly destroyed. Dumpster diving still happens. Don't be tempted to toss them in the trash or recycling.
Fight back against fraud: If you discover someone has filed a tax return in your name, complete a paper return and include form 14039 (Identity Theft Affidavit). Report the fraud to local law enforcement and the Federal Trade Commission. Monitor your credit reports and account statements and contact the three major credit bureaus to ask for a freeze so that no one can request new credit in your name.
English (US) ·