student working on laptop computer

Universities are the latest target in tax refund phishing scams

Screenshot of a scam email claiming to be from the IRS
Scammers changed the link and the amount of “refund,” from an initial attempt likely to resemble a more realistic number, and to raise less suspicion than their earlier scam amount ($1400) may have.

The Federal Trade Commission (FTC) recently released a warning to all university students, faculty and staff to be on the lookout for phishing emails claiming to be from the IRS. The scammers claim they have “information about your tax refund payment” and urge you to click on their phishing link. Subjects may include “Recalculation of your tax refund payment” or “Tax Refund Payment,” or similar messaging about tax refunds.

Once on the site, they will ask for your personal information, such as name, Social Security Number (SSN), date of birth and other personal information. They can then sell that information or use it for identity theft (including filing taxes under your name to steal your tax refund).

However, the IRS will never contact you first by email. If they need to contact you, a mailed letter will be the first form of outreach. If you need to confirm the IRS contacted you, call 800.829.1040. 

Screenshot of a form in an IRS scam made to look realistic
The scammers’ website. Notice the official IRS logo, header, and even the IRS’ privacy notice. The website mimics a standard IRS form, using their websites’ font, a Spanish option, a Help button, and even a popup alert stating ‘THIS US GOVERNMENT SYSTEM IS FOR AUTHORIZED USE ONLY’. Source: BleepingComputer.com

The Information Security Office is taking steps to filter and remove the phishing emails before they come to your mailbox. However, if you see any phishing emails in your Case Western Reserve University or personal email inboxes, the FTC recommends the following actions: 

For any security questions, please email the Information Security Office at security@case.edu. If you see any phishing emails, report them as phishing

Sources:

By: Katherine Starr, information security analyst