Friday June 5, 2026

Washington News

Phishing, Spear Phishing and Whaling

The Internal Revenue Service (IRS) is conducting Nationwide Tax Forums sponsored by the Security Summit in five different cities this summer. The four remaining forums are July 30 in Orlando, August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego.

The registration forms and deadlines are available on IRS.gov. The IRS notes that taxpayers and professional advisors are welcome to attend the forums, but it is expected that they will sell out.

The forums are designed to highlight the latest strategies of fraudsters. There is a a specific focus on protecting tax preparers and their clients. The latest and most successful scams will be covered. Some of the scams to be aware of include:

Phishing/Smishing — Phishing emails or SMS/texts (known as "smishing") are common strategies for a fraudster. One method to increase the probability of success is to send phishing emails to several professionals who are all in the same firm. This increases the likelihood that at least one individual will click on a link and download malware.
Spear Phishing — This is an email strategy known as a "lure." These scams are more difficult to identify. They single out an individual and attempt to craft an email that is especially likely to succeed. The scammer often claims to be a potential client. He or she may engage in a series of emails that appear to be a normal part of business. However, there eventually will be an email with a link to documents that supposedly have been requested by the tax professional. This link will download the malware.
Clone Phishing — The latest phishing scam involves hacking an email message from a client to the tax professional. Since a regular email is not encrypted or protected, a hacker may be able to intercept an email from a client to the tax professional. The scammer then re-sends the email and pretends to be the actual client. This makes the tax professional think the email is from a known client increasing the likelihood that they click on a link and download malware. The malware enables the fraudster to use client data, file false returns and claim improper tax refunds.
Whaling — A whaling attack is similar to spear phishing. However, these attacks are focused on leaders of organizations or executives who have access to important business information. Whaling attacks will frequently target individuals who are in a finance or human relations office. The whaling email may claim to be from an officer or director of the organization and asks the finance or HR staff person for critical information.

The IRS warns professionals to be on the lookout for red flags or warning signs. If you receive an unexpected email or text that claims to come from a colleague, a bank, a credit card company or your tax software provider, check out the source before clicking on links or responding. A scammer may also decide to send a duplicate email that is very similar to the email you have just received from a trusted individual. The duplicate will contain an attachment or link that downloads the malware.

Another effective strategy for scammers is to claim urgency. They may indicate your password to an important website has expired and must be renewed immediately. Finally, be careful if there is an email address that includes misspellings. Some scammers have been quite successful with email addresses that are identical, except there is a "0" that replaces the "o" in the email address.

IRS Commissioner Danny Werfel notes, "There are major red flags that can be easily overlooked, so tax professionals and taxpayers should be extra careful and look closely when they receive an email from an official looking source."

Tax preparers are reminded they are required by the Federal Trade Commission to use multi-factor authentication for access to client personally identifiable information (PII). Professionals should develop a Written Information Security Plan (WISP). This plan will help protect your clients and yourself from fraudsters and scammers.