Fake IRS Email

General discussion of identity theft issues, including identity theft schemes, phishing scams, and related issues.
User avatar
wserra
Quatloosian Federal Witness
Quatloosian Federal Witness
Posts: 7550
Joined: Sat Apr 26, 2003 6:39 pm

Fake IRS Email

Post by wserra »

Haven't seen this one before (received in one of the free accounts I use for things like MLM and TP mailing lists), complete with misspellings and grammatical errors.
Department of Treasury Internal Revenue Source

Important information about your tax return
We are unable to process your tax return

We recived your tax return. However, we are unable to process the return as field.

Our records indicate that the person identifiedas the primary taxpayer or spouse on the tax return did not provided all the required documents shown on the tax form. Our records are based on information received from the Social Security Administration.

Based on this information, the tax account for the individual has been locked

What you need to do

Print out the attached notification and list of missing documents, fill it in, add the documents and send the following information to the adress shown in the attached notification.

List of required documents:

1. A copy of this letter
2. Notification letter
3. A photocopy of valid U.S. Federal or State Government issued identification.

Keep this notice for your records. If you need assistance, please don't hesitate to contact us
A zip file was attached. While I am somewhat curious, I'm not about to open it.

The originating IP is 77.114.217.63:
inetnum: 77.114.0.0 - 77.115.255.255
netname: PLUSNET
descr: Polkomtel S.A.
descr: Warszawa
country: PL
Ah, that explains it. It's the Warsaw IRS office.

ETA: when I first posted this, I didn't notice the several more just like it in the account's Spam folder. They somehow got around the filter with this one. Anyway, it seems pretty sure that others have received it by now.
"A wise man proportions belief to the evidence."
- David Hume
Nikki

Re: Fake IRS Email

Post by Nikki »

If you still have it, please forward it to TIGTA.
Cathulhu
Order of the Quatloos, Brevet First Class
Posts: 1257
Joined: Wed Apr 07, 2010 3:51 pm

Re: Fake IRS Email

Post by Cathulhu »

easy to do, just forward to phishing@irs.gov
Goodness is about what you do. Not what you pray to. T. Pratchett
Always be a moving target. L.M. Bujold
User avatar
wserra
Quatloosian Federal Witness
Quatloosian Federal Witness
Posts: 7550
Joined: Sat Apr 26, 2003 6:39 pm

Re: Fake IRS Email

Post by wserra »

Done. Thanks.
"A wise man proportions belief to the evidence."
- David Hume
User avatar
The Observer
Further Moderator
Posts: 7502
Joined: Thu Feb 06, 2003 11:48 pm
Location: Virgin Islands Gunsmith

Re: Fake IRS Email

Post by The Observer »

The attachment was the payload for that e-mail. Apparently it was a type of keylogger program, called Zeus, that the hackers were hoping would benefit from the general terror caused by getting an message that looked like it was from the IRS.
"I could be dead wrong on this" - Irwin Schiff

"Do you realize I may even be delusional with respect to my income tax beliefs? " - Irwin Schiff