Contact Us At
Has your establishment ever received a notice that feels off? The recent tax notice scam should warn businesses everywhere that threat actors are only getting smarter. Learn more about it here.
A Rise of Phishing Scams During Tax Season
In today's digital-first age, your business likely operates across emails, cloud services, and a myriad of apps. Threat actors know this, and they're exploiting every digital channel you rely on.
Researchers at CYFIRMA identified a new phishing campaign that uses fake income tax assessment notices to infect systems with malware. Let's review how it works:
- The lure: Scammers send an email that looks like a formal tax assessment notice, complete with legal references, financial penalties, and urgency-based language demanding immediate compliance.
- The fake portal: The email prompts the user to click a link to view their tax assessment, and it directs them to a fraudulent website impersonating an official government tax portal.
- The malicious download: From this fake portal, a prompt tricks you into downloading an archived file, such as a ZIP or a disk image file named "Tax_assessment.img."
- Malware installation: Opening this archive triggers a hidden malware loader and a disguised dynamic-link library, which installs a Remote Access Trojan (RAT) in the background.
- System compromise: Once the RAT becomes active on your device, the hackers can remotely monitor your activity, steal sensitive data, and gain sustained, encrypted access to your network.
How To Identify Tax Scams
This particular tax notice scam mainly targeted victims across India. Even if you're not in the region, it never hurts to err on the side of caution and watch out for the warning signs of a phishing attack:
- Messages claiming urgent action is required to avoid penalties or legal action
- Email domains or sender addresses that do not match official tax authority domains
- Offers of large refunds or appeals to emotions to prompt quick responses
- Requests for personal information, such as banking details
- Generic greetings instead of addressing you by name
- Poor grammar or spelling mistakes in the communication
Protect Your Business From Tax Notice Phishing Schemes
Why wait for a slip-up that ruins your company's reputation? Consider the following tax scam prevention tips.
Verify Notice Authenticity
If you receive an unexpected email claiming a tax issue, never click links inside the message. Instead, independently navigate to the official agency portal or consult their customer service directly to check your account status.
Educate and Train Staff
Many business-grade email security services automatically block suspicious attachments and route phishing attempts to your spam folder, but these tools can fail. You should empower your team to pause, verify, and report any suspicious messages that slip through the cracks.
Implement Data Policies
Limit access to sensitive tax and financial systems to only those employees who require it for their roles. Maintain a strict off-boarding process that immediately revokes all software and system access when an employee leaves the company.
Staying One Step Ahead of Tax-Based Phishing Scams
This recent tax notice scam should empower you to stay vigilant.
