30 de October de 2024
e93ebab881e8292f1484806b9b698683.jpg

As National Cybersecurity Awareness Month concludes and preparation for next tax season begins, the Internal Revenue Service and its Security Summit partners today reminded taxpayers to be wary of online threats like identity theft and fraud.

Whether shopping online or browsing social media, people unfamiliar with online security could be putting themselves at risk. Lax online behavior can open the door to swindlers eager to swipe people’s personal information and leave themselves vulnerable to tax-related identity theft.

The IRS and Security Summit alert taxpayers to remain vigilant and to teach children and teens how to recognize and avoid online scams to minimize their chances of falling prey or unwittingly exposing their families to identity theft and tax fraud.

The public-private sector partnership encourages everyone to be aware of the many security vulnerabilities they face online and to review a wide range of resources available to them as October’s National Cybersecurity Awareness Month draws to a close.

Members of the Security Summit – a coalition that includes tax software and financial companies, tax professionals, state tax administrators and the IRS – also offer multiple online safety recommendations to protect taxpayers from tax-related identity theft.

Online safety tips

Options to help protect against cybersecurity attacks include:

  • Recognize scams and report phishing. It’s important to remember that the IRS does not use unsolicited email and social media to discuss personal tax issues, such as those involving tax refunds, payments or tax bills. Don’t reply, open any attachments or click any links. To report phishing, send the full email headers or forward the email as is to phishing@irs.gov; do not forward screenshots or scanned images of emails because this removes valuable information. Then delete the email.
  • Protect personal information. Refrain from revealing too much personal information online. Birthdates, addresses, age and financial information, such as bank accounts and Social Security numbers, are among things that should not be shared freely. Encrypt sensitive files such as tax records stored on computers.
  • Use strong passwords. Consider using a password manager to store passwords.
  • Enable multi-factor authentication (MFA). Use this for extra security on online accounts.
  • Use and update computer and phone software. Enable automatic updates to install critical security updates, including anti-virus and firewall protections.
  • Use a VPN. Criminals can intercept personal information on insecure public Wi-Fi networks. Individuals are encouraged to always use a virtual private network (VPN) when connecting to public Wi-Fi.

Source: IRS-2024-283, Oct. 28, 2024


17 de October de 2024
alert.jpg

Scammers are using fake charities in the wake of Hurricanes Milton and Helene to harvest personal and financial data from unsuspecting taxpayers.

“You should never feel pressured by solicitors to immediately give to a charity,” said Commissioner Danny Werfel in a statement from the IRS, which issued the warning. “Verify if they’re authentic first.”

Tips to verify charities and spot fake ones:

  • Scammers frequently use names that sound like well-known charities to confuse people. Fake charity promoters may also use bogus emails or fake websites or alter or “spoof” their caller ID to make themselves look like a real charity. Ask the fundraiser for the charity’s name, website and mailing address. Check the Tax-Exempt Organization Search tool on IRS.gov to help find or verify legitimate charities.
  • Never work with charities that ask for donations by giving numbers from a gift card or wiring money. It’s safest to pay by credit card or check, and only after verifying the charity is real.
  • Scammers want both money and personal information. Never disclose Social Security numbers, credit card numbers or personal identification numbers
  • Scammers often pressure people into making an immediate payment. In contrast, legitimate charities are happy to get a donation at any time.

The IRS has other background on its Charity and Disaster Fraud page.

Source: Accounting Today
Picture: Tristan Wheelock/Bloomberg


14 de October de 2024
Captura-de-Tela-2024-10-14-as-07.57.57.png

In the wake of the devastating hurricanes that have ravaged Florida and the Southeast in recent weeks, the Internal Revenue Service today reassured victims that it stands ready to provide the tax-related assistance they need to recover from these storms.

IRS.gov has a variety of information to help disaster victims navigate common situations in the aftermath of disasters. The IRS also has a special hotline specifically dedicated to taxpayers with disaster-related tax questions; disaster victims can call the agency’s disaster hotline at 866-562-5227.

Here is a rundown on tax help available from the IRS.

More time to file and pay

The IRS automatically gives taxpayers whose address of record is in a disaster-area locality more time to file returns and pay taxes. Taxpayers get the extra time without having to ask for it.

  • Currently, taxpayers in the entire states of Alabama, Florida, Georgia, North Carolina and South Carolina, and parts of Tennessee and Virginia, who received extensions to file their 2023 returns have until May 1, 2025, to file. Tax-year 2023 tax payments are not eligible for this extension. In addition, May 1 is also the deadline for filing 2024 returns and paying any tax due.

The IRS is offering relief to any area designated by the Federal Emergency Management Agency (FEMA). The current list of eligible localities is always available on the Tax relief in disaster situations page on IRS.gov.

This page also provides disaster updates and links to resources, and information is usually available on the IRS Twitter (now X) account as well.

Disaster payments usually tax-free

Qualified disaster relief payments are generally excluded from gross income. In general, this means that affected taxpayers can exclude from their gross income amounts received from a government agency for reasonable and necessary personal, family, living or funeral expenses, as well as for the repair or rehabilitation of their home, or for the repair or replacement of its contents. See Publication 525, Taxable and Nontaxable Income, for details.

Retirement plan help

Additional relief may be available to affected taxpayers who participate in a retirement plan or individual retirement arrangement (IRA). For example, a taxpayer may be eligible to take a special disaster distribution that would not be subject to the additional 10% early distribution tax and allows the taxpayer to spread the income over three years. Taxpayers may also be eligible to make a hardship withdrawal. Each plan or IRA has specific rules and guidance for their participants to follow.

Disaster loss deduction may be available

In some instances, individuals and businesses in a federally-declared disaster area can qualify for a casualty loss tax deduction. The deduction is available for damaged or destroyed property not covered by insurance or other reimbursement and can result in a larger refund.

A unique feature of this deduction is that taxpayers can choose to claim it on either the return for the year the loss occurred (in this instance, the 2024 return normally filed next year), or the return for the prior year

(the 2023 return filed this year). For individual taxpayers, the deadline for making this election is Oct. 15, 2025.

If deductions exceed a taxpayer’s income, it can result in a net operating loss (NOL). A taxpayer need not have a business to have a NOL from a casualty. A NOL can normally be carried forward and deducted in a future tax year. See Publication 547, Casualties, Disasters, and Thefts and Publication 536, Net Operating Losses (NOLs) for Individuals, Estates, and Trusts, for details.

Free tax transcripts available

The IRS reminds anyone whose tax records were lost or destroyed, or who needs tax records to apply for disaster assistance that they can get a free transcript of their returns from the IRS. Immediate access to these transcripts is available through the Get Transcript link on IRS.gov. Alternatively, taxpayers can use Get Transcript to request that transcripts be mailed to them. They can also call 800-908-9946 to request mail delivery or submit Form 4506-T, Request for Transcript of Tax Return.

As a reminder, taxpayers must have filed all required tax returns in order to qualify for disaster loans or grants for business owners, homeowners and renters from the Small Business Administration.

Free copy of tax return

Disaster-area taxpayers can get a free copy of their tax return by filing Form 4506, Request for Copy of Tax Return. The IRS waives the usual fees and expedites requests for copies of returns for people who need them to apply for disaster-related benefits or to file amended returns claiming disaster-related losses. To speed processing, be sure to notate that this is a disaster-related request and list the state and type of event.

Address change

After a disaster, people might need to temporarily relocate. Those who move should notify the IRS of their new address by submitting Form 8822, Change of Address.

Disaster hotline

Taxpayers with disaster-related tax questions can call the agency’s disaster hotline at 866-562-5227.

Taxpayers should also call this number if they live outside the disaster area but believe they qualify for a disaster-related extension or deadline postponement. This might be true, for example, if their records necessary to meet a deadline occurring during the postponement period are located in the affected area. This also includes workers assisting the relief activities who are affiliated with a recognized government or philanthropic organization.

More information

The IRS encourages affected taxpayers to review all federal disaster relief at DisasterAssistance.gov.

Here are other helpful IRS resources:

Source: IRS-2024-266, Oct. 11, 2024


2 de October de 2024
no-dyed-fuel-penalty-in-flordia-irs-says.jpg

In response to disruptions resulting from Hurricane Helene, the Internal Revenue Service will not impose a penalty when dyed diesel fuel with a sulfur content that does not exceed 15 parts-per-million is sold for use or used on the highway throughout Alabama, Georgia, North Carolina, and South Carolina and in the following counties in Florida, Tennessee and Virginia:

Florida: Alachua, Bay, Bradford, Calhoun, Charlotte, Citrus, Collier, Columbia, Dixie, Escambia, Franklin, Gadsden, Gilchrist, Gulf, Hamilton, Hernando, Hillsborough, Holmes, Jackson, Jefferson, Lafayette, Lee, Leon, Levy, Liberty, Madison, Manatee, Marion, Monroe, Okaloosa, Pasco, Pinellas, Santa Rosa, Sarasota, Sumter, Suwannee, Taylor, Union, Wakulla, Walton and Washington counties.

Tennessee: Carter, Cocke, Greene, Hamblen, Hawkins, Johnson, Unicoi and Washington counties.

Virginia: City of Galax, Grayson, Smyth, Tazewell, Washington, Wise and Wythe counties.

This relief is retroactive to Sept. 26, 2024, and will remain in effect through Oct. 15, 2024.

This penalty relief is available to any person that sells or uses dyed diesel fuel for highway use. In the case of the operator of the vehicle in which the dyed diesel fuel is used, the relief is available only if the operator or the person selling such fuel pays the tax of 24.4 cents per gallon that is normally applied to diesel fuel for highway use.

The IRS will not impose penalties for failure to make semimonthly deposits of tax for dyed diesel fuel sold for use or used in diesel powered vehicles on the highway in these areas during the relief period. IRS Publication 510, Excise Taxes, has information on the proper method for reporting and paying the tax.

Ordinarily, dyed diesel fuel is not taxed, because it is sold for uses exempt from excise tax, such as to farmers for farming purposes, for home heating use and to local governments.

The IRS is closely monitoring the situation and will provide additional relief as needed.

Source: IRS-2024-254, Oct. 1, 2024


2 de October de 2024
IRS-deadline-for-taxpayers-in-the-US.jpg

The Internal Revenue Service today announced disaster tax relief for all individuals and businesses affected by Hurricane Helene, including the entire states of Alabama, Georgia, North Carolina and South Carolina and parts of Florida, Tennessee and Virginia.

Taxpayers in these areas now have until May 1, 2025, to file various federal individual and business tax returns and make tax payments. Among other things, this includes 2024 individual and business returns normally due during March and April 2025, 2023 individual and corporate returns with valid extensions and quarterly estimated tax payments.

The IRS is offering relief to any area designated by the Federal Emergency Management Agency (FEMA). Besides all of Alabama, Georgia, North Carolina and South Carolina, this currently includes 41 counties in Florida, eight counties in Tennessee and six counties and one city in Virginia.

Individuals and households that reside or have a business in any one of these localities qualify for tax relief. The same relief will be available to other states and localities that receive FEMA disaster declarations related to Hurricane Helene. The current list of eligible localities is always available on the Tax relief in disaster situations page on IRS.gov.

Filing and payment relief

The tax relief postpones various tax filing and payment deadlines that occurred beginning on Sept. 22, 2024, in Alabama; Sept. 23 in Florida; Sept. 24 in Georgia; Sept. 25 in North Carolina, South Carolina and Virginia; and Sept. 26 in Tennessee. In all of these states, the relief period ends on May 1, 2025 (postponement period). As a result, affected individuals and businesses will have until May 1, 2025, to file returns and pay any taxes that were originally due during this period.

This means, for example, that the May 1, 2025, deadline will now apply to:

  • Any individual or business that has a 2024 return normally due during March or April 2025.
  • Any individual, business or tax-exempt organization that has a valid extension to file their 2023 federal return. The IRS noted, however, that payments on these returns are not eligible for the extra time because they were due last spring before the hurricane occurred.
  • 2024 quarterly estimated income tax payments normally due on Jan. 15, 2025, and 2025 estimated tax payments normally due on April 15, 2025.
  • Quarterly payroll and excise tax returns normally due on Oct. 31, 2024, and Jan. 31 and April 30, 2025.

In addition, the IRS is also providing penalty relief to businesses that make payroll and excise tax deposits. Relief periods vary by state. Visit the Around the Nation page for details.

The Disaster assistance and emergency relief for individuals and businesses page has details on other returns, payments and tax-related actions qualifying for relief during the postponement period. Among other things, this means that any of these areas that previously received relief following Tropical Storm Debby will now have those deadlines further postponed to May 1, 2025.

The IRS automatically provides filing and penalty relief to any taxpayer with an IRS address of record located in the disaster area. These taxpayers do not need to contact the agency to get this relief.

It is possible an affected taxpayer may not have an IRS address of record located in the disaster area, for example, because they moved to the disaster area after filing their return. In these unique circumstances, the affected taxpayer could receive a late filing or late payment penalty notice from the IRS for the postponement period. The taxpayer should call the number on the notice to have the penalty abated.

In addition, the IRS will work with any taxpayer who lives outside the disaster area but whose records necessary to meet a deadline occurring during the postponement period are located in the affected area. Taxpayers qualifying for relief who live outside the disaster area need to contact the IRS at 866-562-5227. This also includes workers assisting the relief activities who are affiliated with a recognized government or philanthropic organization. Disaster area tax preparers with clients located outside the disaster area can choose to use the Bulk Requests from Practitioners for Disaster Relief option, described on IRS.gov.

Additional tax relief

Individuals and businesses in a federally declared disaster area who suffered uninsured or unreimbursed disaster-related losses can choose to claim them on either the return for the year the loss occurred (in this instance, the 2024 return normally filed next year), or the return for the prior year (the 2023 return filed this year). Taxpayers have extra time – up to six months after the due date of the taxpayer’s federal income tax return for the disaster year (without regard to any extension of time to file) – to make the election. For individual taxpayers, this means Oct. 15, 2025. Be sure to write the FEMA declaration number on any return claiming a loss. See Publication 547, Casualties, Disasters, and Thefts, for details.

Qualified disaster relief payments are generally excluded from gross income. In general, this means that affected taxpayers can exclude from their gross income amounts received from a government agency for reasonable and necessary personal, family, living or funeral expenses, as well as for the repair or rehabilitation of their home, or for the repair or replacement of its contents. See Publication 525, Taxable and Nontaxable Income, for details.

Additional relief may be available to affected taxpayers who participate in a retirement plan or individual retirement arrangement (IRA). For example, a taxpayer may be eligible to take a special disaster distribution that would not be subject to the additional 10% early distribution tax and allows the taxpayer to spread the income over three years. Taxpayers may also be eligible to make a hardship withdrawal. Each plan or IRA has specific rules and guidance for their participants to follow.

The IRS may provide additional disaster relief in the future.

The tax relief is part of a coordinated federal response to the damage caused by this storm and is based on local damage assessments by FEMA. For information on disaster recovery, visit disasterassistance.gov.

Source: IRS-2024-253, Oct. 1, 2024


20 de August de 2024
105139760-IMG_9781.jpg

The number of cases of unauthorized access of tax return data at the Internal Revenue Service are rebounding somewhat from a high in 2018, according to a recent evaluation by the Treasury Inspector General for Tax Administration.

In 2023, 125 violation cases of Unauthorized Access, Attempted Access, or Inspection Taxpayer Records within the IRS were recorded by TIGTA. In 2018, a high of 135 cases were recorded. The following year, that number dropped to 115 and has been slowly climbing in subsequent years.

However, the number of instances in which taxpayer information was disclosed has remained low since 2018 when 126 cases were reported. That number dropped in 2019 to 58 cases and has remained low. In 2023, 46 cases were reported.

TIGTA agreed to review how the IRS grants access to and safeguards Federal Tax Information on its various systems in response to a massive leak that was reported in June 2021. FTI includes a taxpayer’s identity, the nature or amount of their income, deductions, exemptions, assets, liabilities, net worth or tax withheld, among other things.

In its reports, TIGTA provides information on unauthorized access cases and the difficulty prosecuting the cases, the systematic issues previously reported, and TIGTA’s recently issued reports and ongoing audits on these issues.

Since 2018, there have been a total of 1,028 UNAX violation cases investigated by TIGTA. Sixty-two percent of those cases were referred but declined for prosecution, 37% were never referred for prosecution, and less than 1% have been accepted for prosecution or are pending prosecution determination.

Source: Accounting Today


5 de August de 2024
e50a25806e2ffa1ec33d7b5855e9b63b.png

In the fourth part of a special summer series, the Security Summit partners today reminded tax professionals and taxpayers about the special IRS Identity Protection PIN program and the IRS online accounts that can help protect against tax-related identity theft.

These two tools help protect against the threat of tax-related identity theft, both for the taxpayers who sign up and the tax professionals who hold their sensitive tax information.

Identity Protection PINs, also referred to as IP PINs, serve as a critical defense against identity thieves. The IRS is encouraging all tax pros and taxpayers to establish their IRS Online Account that allows access to IRS account information online, but it also guards against fraudsters trying to trick tax pros and taxpayers into creating such an account.

“To protect against continuing and evolving threats from identity thieves, these two special tools provide an extra layer of security for taxpayers and tax professionals,” IRS Commissioner Danny Werfel said. “The IRS and the Security Summit urge people to sign up for both IP PINs and the Online Account to help protect their valuable information as well as avoid tax problems down the road.”

The IRS, state tax agencies and the nation’s tax industry – working together as the Security Summit – need assistance from tax professionals to let their clients know that IP PINs and the IRS Online Account are available to anyone who can verify their identity.

In addition to enrolling in the IP PIN program, the IRS is encouraging all people to establish their IRS Online Account. Doing so not only provides access to IRS account information that’s now available online, but it also guards against fraudsters trying to trick tax pros and taxpayers into creating such an account. Tax pros also have access to the Tax Pro Account.

This is the fourth week of an eight-part Protect Your Clients, Protect Yourself summer series, part of an annual education effort by the Security Summit, a group that includes tax professionals, industry partners, state tax agencies and the IRS. The public-private partnership has worked since 2015 to protect the tax system against tax-related identity theft and fraud.

Security is a key focus of the Nationwide Tax Forum, being held in five cities this summer throughout the U.S. In addition to the series of eight news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The forums continue today in Orlando, Florida, though the event is already sold out, and carry on the week of August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego. The IRS reminds tax pros that registration deadlines are quickly approaching for the Baltimore and Dallas forums, as San Diego has also sold out.

More than 10.4 million taxpayers have taken the steps to obtain an IP PIN, a six-digit number that once issued to a taxpayer must be included on their tax return prior to filing electronically. Many, many more taxpayers should consider getting one to add another layer of protection against identity theft.

To do so, taxpayers should visit the IRS Get an IP PIN online tool. Doing that will establish a taxpayer’s access to their IRS Online Account, making themselves less likely to fall victim to social engineering schemes that trick taxpayers into setting up an IRS Online Account controlled by a bad actor.

Beginning this summer, taxpayers who enroll in the program will have the ability to unenroll if for some reason they decide they no longer want to participate in the future.

ETAAC notes IP PIN “effectively locks out” many fraudsters

The Electronic Tax Administration Advisory Committee, or ETAAC, is again this year highlighting the importance of the IP PIN to taxpayers and tax professionals, echoing past endorsements from the same independent IRS advisory group.

“The IP PIN method provides strong protection against stolen identity tax refund fraud and effectively locks out many fraudsters from e-filing using that taxpayer’s social security number,” said ETAAC’s annual report to Congress.

But the report added that IP PINS should be more widely used, calling it an overlooked tool in the fight against fraud. Underscoring the point, the ETAAC report said only 525,000 taxpayers opted into the IP PIN program in 2022, even though the Federal Trade Commission received more than 1.1 million reports of identity theft that same year.

The importance of someone’s IP PIN can be a tempting target for identity thieves, given the IP PINs’ inherent strength. Summit partners urged taxpayers and tax professionals to be careful and protect the IP PIN from identity thieves, and noted these key tips:

  • Taxpayers should share their IP PIN only with their trusted tax provider.
  • Tax professionals should never store clients’ IP PINs on computer systems. This reduces taxpayer risk if a tax pro’s system is compromised by an identity thief or cyberattack.
  • The IRS will never call, email or text either taxpayers or tax professionals to request the IP PIN. This is a sign of a scam.

Tax professionals who experience a data theft can assist clients by urging them to quickly obtain an IP PIN. Even if a thief already has filed a fraudulent return, an IP PIN would still offer protections for later years and prevent taxpayers from being repeat victims of tax-related identity theft.

Key facts about IP PINs

Here are a few other things taxpayers and tax professionals should know about the IP PIN:

  • It’s a six-digit number known only to the taxpayer and the IRS.
  • The opt-in program is voluntary, though strongly encouraged.
  • In cases of proven identity theft, an IP PIN is assigned to a taxpayer to use for future filings.
  • The IP PIN should be entered on the electronic tax return when prompted by the software product or on a paper return next to the signature line.
  • The IP PIN is valid for one calendar year; a new IP PIN is generated each year.
  • Only taxpayers who can verify their identities may obtain an IP PIN.
  • IP PIN users should never share their number with anyone but the IRS and their trusted tax preparation provider. The IRS will never call, email or text a request for the IP PIN.
  • Tax professionals cannot obtain an IP PIN on behalf of clients. Taxpayers must obtain their own IP PIN.

Taxpayers have the opportunity to opt out if they previously opted into the program. Taxpayers who are confirmed victims of identity theft will not have the option to opt out of the program.

How to get an IP PIN

To obtain an IP PIN, the best option is to start at Get an IP PIN. Taxpayers need to validate their identities through ID.me to access the tool and their IP PIN. Before attempting this thorough process, the IRS recommends taxpayers first check out How to register for IRS online self-help tools.

If taxpayers are unable to validate their identity online and if their income is less than $79,000 for individuals or $158,000 for married couples, they may file Form 15227, Application for an Identity Protection Personal Identification Number PDF. The IRS will call the telephone number provided on Form 15227 to validate their identity. Once verified, the taxpayer will receive an IP PIN via the U.S. Postal Service within four to six weeks.

Taxpayers who cannot validate their identities online or on the phone with an IRS employee after submitting a Form 15227, or who are ineligible to file a Form 15227, may call the IRS to make an appointment at a Taxpayer Assistance Center. They’ll need to bring one picture identification document and another identification document to prove their identity. Once verified, the taxpayer will receive an IP PIN via U.S. Postal Service within three weeks.

The IP PIN process for confirmed victims of identity theft remains unchanged. These victims will automatically receive an IP PIN each year.

Additional resources

If a tax pro or their firm are the victim of data theft, they should:

Tax professionals should also stay connected to the IRS through subscriptions to e-News for tax professionals and its social media sites.

Source: IRS-2024-200, July 30, 2024


22 de July de 2024
VPTAX-Feature-786-ral_insight_card-Blue.png

The Department of the Treasury and the Internal Revenue Service today issued final regulations updating the required minimum distribution (RMD) rules.

The final regulations reflect changes made by the SECURE Act and the SECURE 2.0 Act impacting retirement plan participants, IRA owners and their beneficiaries. At the same time, Treasury and IRS issued proposed regulations, addressing additional RMD issues under the SECURE 2.0 Act.

While certain changes were made in response to comments received on the proposed regulations issued in 2022, the final regulations generally follow those proposed regulations.

Specifically, Treasury and IRS reviewed comments suggesting that a beneficiary of an individual who has started required annual distributions should not be required to continue those annual distributions if the remaining account balance is fully distributed within 10 years of the individual’s death as required by the SECURE Act. However, Treasury and IRS determined that the final regulations should retain the provision in the proposed regulations requiring such a beneficiary to continue receiving annual payments.

The new proposed regulations include provisions for which Treasury and IRS are soliciting public comments, including provisions addressing other changes relating to RMDs made by the SECURE 2.0 Act. For details on how to submit comments, see the proposed regulations.

Source: IRS-2024-190, July 18, 2024


17 de July de 2024
90.jpeg

In the second installment of a special series, the Internal Revenue Service and Security Summit partners warned tax professionals to be aware of evolving phishing scams and cloud-based schemes designed to steal sensitive taxpayer information.

The IRS and Security Summit partners – representing state tax agencies and the nation’s tax industry – continue to see a steady stream of e-mail and related attacks aimed at the nation’s tax professional community. These are designed to steal sensitive tax and financial information from clients.

The variants of these email attacks routinely number in the hundreds and can target tax professionals whether it’s tax season or not.

“We continue to see a barrage of email and related attacks designed to trick tax professionals and gain access to their sensitive information,” said IRS Commissioner Danny Werfel. “These attempts can be elaborate, multi-layered efforts that look convincing and can easily fool people. Tax professionals need to be wary and educate their employees to use extra caution to protect their clients and their businesses.”

This is the second release in an eight-part “Protect Your Clients; Protect Yourself” summer series, part of an annual education effort by the Security Summit, a group that includes tax professionals, industry partners, state tax agencies and the IRS. The public-private partnership has worked since 2015 to protect the tax system against tax-related identity theft and fraud.

These security tips will be a key focus of the Nationwide Tax Forum, which will be in five cities this summer throughout the U.S. In addition to the series of eight news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The remaining forums begin July 30 in Orlando, August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego.

The IRS reminds tax pros that registration deadlines are quickly approaching for several of the forums, and Orlando is already sold out.

Phishing, spear phishing, clone phishing and whaling

One of the most common threats facing tax pros are phishing and related scams. These are designed to trick the recipient into disclosing personal information such as passwords, bank account numbers, credit card numbers or Social Security numbers.

Tax professionals and taxpayers should be aware of different phishing terms and what the email scams might look like:

  • Phishing/Smishing – Phishing emails or SMS/texts (known as “smishing”) attempt to trick the recipient into clicking a suspicious link, filling out information or downloading a malware file. Often phishing attempts are sent to multiple email addresses at a business or agency increasing the chance someone will fall for the trick.
  • Spear phishing – A specific type of phishing scam that bypasses emailing large groups at an organization, but instead identifies potential victims and delivers a more realistic email known as a “lure.” These types of scams can be trickier to identify since they don’t occur in large numbers. They single out individuals, can be specialized and make the email seem more legitimate. Scammers can pose as a potential client for a tax professional, luring the practitioner into sharing sensitive information.
  • Clone phishing – A newer type of phishing scam that clones a real email message and resends it to the original recipient pretending to be the original sender. The new message will have either an attachment that contains malware or link that tries to steal information from the tax professional or recipient.
  • Whaling – Whaling attacks are very similar to spear phishing, except these attacks are generally targeted to leaders or other executives with access to secure large amounts of information at an organization or business. Whaling attacks can also target people in payroll offices, human resource personnel and financial offices.

Security Summit partners continue to see instances in which tax professionals have been particularly vulnerable to emails posing as potential clients. In the “new client” scam, the criminals use this technique to trick practitioners into opening email links or attachments that infect computer systems with the potential to steal client information. Similar schemes are seen with whaling situations where scammers try to obtain a large amount of information with legitimate-looking email requests.

Warning signs of a scam

Regardless of the type of phishing attempt, tax pros can protect themselves and their organization by being aware of these scams and looking for warning signs like these:

  • An unexpected email or text claiming to come from a known or trusted source such as a colleague, bank, credit card company, cloud storage provider, tax software provider or even the IRS and other government agencies.
  • Receiving a duplicate email from what appears to be a known trusted source that contains a new attachment or hyperlink.
  • A message, often with an urgent tone, urging the receiver to open a link or attachment. These messages have a false narrative, like someone’s password has expired or some other urgent action is needed.
  • An email address, number or link that’s slightly misspelled or has a different domain name or URL (irs.com vs. IRS.gov). A closer look at these email addresses – like hovering the cursor over the email address – can show slight variations on legitimate addresses.

“There are major red flags that can be easily overlooked, so tax professionals and taxpayers should be extra careful and look closely when they receive an email from an official looking source,” Werfel said.

Cloud-based schemes remain a threat

Tax professionals using cloud-based systems that store information or run tax preparation software should use multi-factor authentication to help safeguard that data. The Federal Trade Commission now requires all practitioners to secure sensitive client personally identifiable information (PII) using multi-factor authentication.

Specifically, the Security Summit continues to see attacks that take advantage of cloud-based systems and compromise personal information. Multi-factor authentication options provide an additional layer of security to access a system by using a phone, text messages or tokens. Since email is easier for identity thieves to access, having these layers of security helps guard against potential vulnerabilities.

Additional resources

For tax professionals who are victim of any of these schemes or identity theft, the IRS urges them to quickly contact their IRS stakeholder liaison to provide details of the situation. Tax professionals can also share information with the appropriate state tax agency by visiting a special Report a Data Breach page with the Federation of Tax Administrators.

Quickly reporting these incidents can not only protect the tax pro’s clients, but it can also help provide critical information quickly to help prevent these attacks from hitting others in the tax community.

Tax professionals should also understand the Federal Trade Commission’s data breach response requirements PDF as part of their overall information and data security plan. There’s a new requirement to report an incident to the FTC when 500 or more people are affected within 30 days of the incident.

To help taxpayers navigate these issues and meet the requirement to have a security plan, the Security Summit has prepared a sample Written Information Security Plan. This template can help tax pros, including smaller practitioners, protect themselves from ongoing security threats.

Tax professionals should also review IRS Publication 4557, Safeguarding Taxpayer Data PDF, for more information.

Other resources include Small Business Information Security: The Fundamentals PDF, by the National Institute of Standards and Technology and the IRS’ Identity Theft Central pages for tax pros.

Publication 5293, Data Security Resource Guide for Tax Professionals PDF, provides a compilation of data theft information available on IRS.gov. The IRS also encourages tax professionals to stay connected to the IRS for its latest updates and alerts through subscriptions to e-News for tax professionals and its social media sites.

 

Source: IRS-2024-188, July 16, 2024


15 de July de 2024
GSPHgwsagAQYT3f.jpg-large-1280x720.jpeg

The Internal Revenue Service would like to remind car dealers and sellers to be aware of evolving phishing and smishing scams that could impact day-to-day operations of the business.

In light of the recent ransomware attack aimed at car dealers, the IRS is warning individuals and businesses to remain vigilant against these attacks. Fraudsters and identity thieves attempt to trick the recipient into clicking a suspicious link, filling out personal and financial information or downloading a malware file onto their computer.

Scammers are relentless in their attempts to obtain sensitive financial and personal information, and impersonating the IRS remains a favorite tactic. The IRS urges car dealerships to be extra cautious about unsolicited messages and avoid clicking any links in an unsolicited email or text if they are uncertain.

Phish or smish: Don’t take the bait

The IRS continues to see a barrage of email and text scams targeting businesses and individual taxpayers. The IRS and the Security Summit partners continue to remind taxpayers, businesses and tax professionals to be alert for a wide variety of these scams and schemes. Businesses such as car dealerships should remain alert for targeted email and text scams aimed to disrupt their computer systems.

These businesses should be alert to fake communications posing as legitimate organizations. These messages arrive in the form of unsolicited texts or emails to lure unsuspecting victims to provide valuable information that can lead to identity theft or malicious malware installed on computer systems. There are two main types:

  • Phishing: An email sent by fraudsters claiming to come from a legitimate source. The email lures the victims into the scam with a variety of ruses such as enticing victims to provide sensitive information.
  • Smishing: A text or smartphone SMS message where scammers often use alarming language such as, “Your account has now been put on hold,” or “Unusual Activity Report,” with a bogus “Solutions” link to restore the recipient’s account.

Never click on any unsolicited communication as it may surreptitiously load malware. It may also be a way for malicious hackers to load ransomware that keeps the legitimate user from accessing their system and files.

In some cases, phishing emails appear to come from a legitimate sender or organization that has had their email account credentials stolen. Setting up two-factor or multi-factor authentication with their email provider will reduce the risk of individuals having their email account compromised.

Posing as a trusted organization, friend or family member remains a common way to target individuals and businesses for various scams. Individuals and businesses should verify the identity of the sender by using another communication method, for instance, calling a number they independently know to be accurate, not the number provided in the email or text.

What to do

  • Never respond to phishing or smishing or click on the URL link.
  • Don’t open any attachments. They can contain malicious code that may infect the computer or mobile phone.
  • Don’t click on any links. If a taxpayer inadvertently clicked on links in a suspicious email or website and entered confidential information, visit the IRS’ identity protection page.
  • Send the full email headers or forward the email as-is to phishing@irs.gov. Don’t forward screenshots or scanned images of emails because this removes valuable information.
  • Delete the original email.

Source: IRS-2024-186, July 11, 2024