Fake IRS Email

General discussion of identity theft issues, including identity theft schemes, phishing scams, and related issues.
User avatar
wserra
Quatloosian Federal Witness
Quatloosian Federal Witness
Posts: 6358
Joined: Sat Apr 26, 2003 7:39 pm

Fake IRS Email

Postby wserra » Sat Jun 25, 2011 6:50 pm

Haven't seen this one before (received in one of the free accounts I use for things like MLM and TP mailing lists), complete with misspellings and grammatical errors.
Department of Treasury Internal Revenue Source

Important information about your tax return
We are unable to process your tax return

We recived your tax return. However, we are unable to process the return as field.

Our records indicate that the person identifiedas the primary taxpayer or spouse on the tax return did not provided all the required documents shown on the tax form. Our records are based on information received from the Social Security Administration.

Based on this information, the tax account for the individual has been locked

What you need to do

Print out the attached notification and list of missing documents, fill it in, add the documents and send the following information to the adress shown in the attached notification.

List of required documents:

1. A copy of this letter
2. Notification letter
3. A photocopy of valid U.S. Federal or State Government issued identification.

Keep this notice for your records. If you need assistance, please don't hesitate to contact us


A zip file was attached. While I am somewhat curious, I'm not about to open it.

The originating IP is 77.114.217.63:
inetnum: 77.114.0.0 - 77.115.255.255
netname: PLUSNET
descr: Polkomtel S.A.
descr: Warszawa
country: PL

Ah, that explains it. It's the Warsaw IRS office.

ETA: when I first posted this, I didn't notice the several more just like it in the account's Spam folder. They somehow got around the filter with this one. Anyway, it seems pretty sure that others have received it by now.
"A wise man proportions belief to the evidence."
- David Hume

Nikki

Re: Fake IRS Email

Postby Nikki » Sat Jun 25, 2011 7:21 pm

If you still have it, please forward it to TIGTA.

User avatar
Cathulhu
Order of the Quatloos, Brevet First Class
Posts: 1233
Joined: Wed Apr 07, 2010 4:51 pm

Re: Fake IRS Email

Postby Cathulhu » Sat Jun 25, 2011 7:54 pm

easy to do, just forward to phishing@irs.gov
Goodness is about what you do. Not what you pray to. T. Pratchett
Always be a moving target. L.M. Bujold

User avatar
wserra
Quatloosian Federal Witness
Quatloosian Federal Witness
Posts: 6358
Joined: Sat Apr 26, 2003 7:39 pm

Re: Fake IRS Email

Postby wserra » Sat Jun 25, 2011 8:32 pm

Done. Thanks.
"A wise man proportions belief to the evidence."
- David Hume

User avatar
The Observer
Further Moderator
Posts: 6653
Joined: Fri Feb 07, 2003 12:48 am
Location: Virgin Islands Gunsmith

Re: Fake IRS Email

Postby The Observer » Thu Jun 30, 2011 12:02 am

The attachment was the payload for that e-mail. Apparently it was a type of keylogger program, called Zeus, that the hackers were hoping would benefit from the general terror caused by getting an message that looked like it was from the IRS.
"I could be dead wrong on this" - Irwin Schiff

"Do you realize I may even be delusional with respect to my income tax beliefs? " - Irwin Schiff


Return to “Identity Theft”

Who is online

Users browsing this forum: No registered users and 1 guest