How tax return fraud works
Apr. 15th, 2014 04:20 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
thewayneIn this post by Krebs, he explains how criminals are pre-empting the tax returns of Americans. I have no idea if this is also being done in other countries, a lot would rely upon whether those countries have the ability to electronically file returns.
In brief, the criminals steal information from a company's HR department through various hacking approaches. They get the social security numbers, dates of birth, info on dependents, etc., of employees, then they electronically transmit a tax return to the IRS, using H&R Block's service, and get the refund transmitted to a disposable credit card. When the victim sends in their return, they're informed by the IRS that they've already received a return for them. Then the fun begins for the victim: tons of government paperwork, notifying authorities, etc. The IRS has the ability to apply for a PIN that must be supplied with returns before they'll be accepted, but it appears that you have to be a victim of this type of fraud first before you can apply, and it looks like the PIN may only be good for one year.
In one case mentioned in the article, the unidentified company's HR systems were being hosted on a cloud, this also seems to be a common factor.
The way the fraudsters get their money is a bit cumbersome, but it works out for them in the end. The credit card with the fraudulent money on it is used to buy merchandise, which is either returned for cash or sold for cash, making the money disappear. The money mule (the person with the card) gets a percentage of sales, then uses Western Union or similar service to transmit the money to the criminals. The mule is also a criminal, as they're aiding and abetting a felony, but some of them are not aware of what they're involved in. A lot of spam messages for 'owning your own business at home' are sometimes fronts for these operations.
Obviously there's nothing an individual can do to protect their employer's HR department, about the only thing the average person can do is file their tax returns as early as possible. In the United States, anyone who owes you a tax form is required by law to get it to you by the end of January, usually you have all in hand by the middle of the month. So don't procrastinate.
http://krebsonsecurity.com/2014/04/crimeware-helps-file-fraudulent-tax-returns/
In brief, the criminals steal information from a company's HR department through various hacking approaches. They get the social security numbers, dates of birth, info on dependents, etc., of employees, then they electronically transmit a tax return to the IRS, using H&R Block's service, and get the refund transmitted to a disposable credit card. When the victim sends in their return, they're informed by the IRS that they've already received a return for them. Then the fun begins for the victim: tons of government paperwork, notifying authorities, etc. The IRS has the ability to apply for a PIN that must be supplied with returns before they'll be accepted, but it appears that you have to be a victim of this type of fraud first before you can apply, and it looks like the PIN may only be good for one year.
In one case mentioned in the article, the unidentified company's HR systems were being hosted on a cloud, this also seems to be a common factor.
The way the fraudsters get their money is a bit cumbersome, but it works out for them in the end. The credit card with the fraudulent money on it is used to buy merchandise, which is either returned for cash or sold for cash, making the money disappear. The money mule (the person with the card) gets a percentage of sales, then uses Western Union or similar service to transmit the money to the criminals. The mule is also a criminal, as they're aiding and abetting a felony, but some of them are not aware of what they're involved in. A lot of spam messages for 'owning your own business at home' are sometimes fronts for these operations.
Obviously there's nothing an individual can do to protect their employer's HR department, about the only thing the average person can do is file their tax returns as early as possible. In the United States, anyone who owes you a tax form is required by law to get it to you by the end of January, usually you have all in hand by the middle of the month. So don't procrastinate.
http://krebsonsecurity.com/2014/04/crimeware-helps-file-fraudulent-tax-returns/
no subject
Date: 2014-04-16 04:50 am (UTC)