IRS warns of tax phishing scheme

E-mails sent by Web sites claiming to be part the Free File Alliance for filing tax returns online could be phishing scams designed to hijack your tax return

The U.S. Internal Revenue Service is warning taxpayers to be wary of e-mail messages that provide links to supposedly free tax-filing services endorsed by the agency.

The warning comes just before the IRS income tax filing deadline Tuesday. The IRS warned taxpayers of e-mails sent by Web sites "masquerading" as members of the Free File Alliance, a program allowing some taxpayers to file online for free. The only place to access the Free File program is on the site, the IRS said in a statement.

The IRS is investigating allegations that some Web sites claiming to be Free File partners are taking taxpayers' personal information, then depositing the returns into different bank accounts, the IRS said in a news release. The scam is a form of a phishing scam, in which fake e-mails purporting to be from banks or online retailers ask recipients for account numbers and other personal information.

After taxpayers complete their forms, the fake Free Filing site changes the bank account number that the tax refund goes to, said Paul Henry, vice president of technology at Secure Computing, a cybersecurity products vendor.

"They're literally hijacking your tax return," Henry said.

In another scam, Henry got an e-mail recently saying he could speed up his tax return by depositing it into his credit card account. The e-mail asked for his credit card number and his personal identification number.

Henry expects tax scams will be prominent this week, as more people look to file taxes online than ever before. Then, after the tax filing deadline passes, he predicted there will be phishing e-mails claiming to be from the IRS, saying the recipient's filing had an error or the recipient is owed more of a refund than was claimed.

"That typically runs all the way through June," Henry said. "It's a long tax phishing season again this year."

In addition, scammers could take advantage of the Microsoft DNS server vulnerability announced last week to redirect Web browsers from legitimate sites to phishing or other scam sites, Henry said. Taxpayers and other people doing business online should be especially careful that they're going to legitimate sites, he said.

Last week, the Computer & Communications Industry Association warned taxpayers of Web sites with IRS in the domain name that aren't affiliated with the U.S. government. Some commercial sites may be charging taxpayers for services they can get free at, the trade group said.

Henry gave this advice to taxpayers:

* The IRS typically does not communicate by e-mail. If you have questions about an e-mail you received, don't click on the link or paste the link in a browser. Instead, call the IRS. "The IRS does not have every citizens' e-mail address," he said. "The IRS typically works only through mail."

* Don't visit tax advice sites not associated with the IRS. Some sites say they offer free advice or free filing services, then charge customers.

* Make sure computer security software is up to date.

The IRS noted that Free File is available for taxpayers with an adjusted gross income of $52,000 or less. Ninety-five million of the 136 million U.S. taxpayers qualify for Free File.