Earlier this month the IRS issued an urgent alert to all employers with an extensive W-2 e-mail phishing scam that has spread to the corporate sector and into school districts, nonprofits and other companies.
“This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns,” IRS Commissioner John Koskinen said in the alert. “We need everyone’s help to turn the tide against this scheme.”
RELATED: Cyber Scam on Spear-Phishing
How the W-2 phishing scam works:
Cyber criminals use spoofing techniques to disguise an e-mail to make it look like it comes from an executive at the employee’s company or organization. “The e-mail is sent to an employee in the payroll or human resources departments, requesting a list of all employees and their Forms W-2,” the alert said. This strategy – sometimes referred to as business email compromise (BEC) or business email spoofing (BES) – first appeared during last year’s tax season. This time around, however, the cyber criminals are asking payroll employees to wire transfer funds to a certain account, which has resulted in job loss and thousands of dollars lost.
The latest “State of the Phish” report from Wombat Security Technologies found that while phishing attacks lowered 10 percent overall last year, users in the education industry were still twice as likely to fall for phishing e-mails (clicking through these e-mails 30 percent of the time compared to the national average of 15 percent). These findings suggest that e-mail phishing continues to be a highly effective cyberattack that results in serious damage to a company’s and employee’s critical data and information.
The Consortium for School Networking (CoSN), which is closely monitoring the situation, has issued its own alert, directing its members to the EdTech Strategies web page with real-time updates on the situation. A list of school districts that have been impacted by the W-2 phishing and wire transfer scam is available on the web page here.
Are you a victim of fraud or money scam? Share your story with us on the Money Credit and You Facebook page!
Original article published on www.thejournal.com.
Photo credit: www.patch.com.
