20 de August de 2024
PS-010223-IRS-cash-balance-plans-1423627043-web.jpg

The Internal Revenue Service today issued interim guidance for sponsors of 401(k) and similar retirement plans that provide, or wish to provide, matching contributions based on eligible student loan payments made by their participating employees.

Notice 2024-63 PDF, posted today on IRS.gov, implements section 110 of the SECURE 2.0 Act of 2022, which for the first time permits employers to provide matching contributions for employees based on their payments on student loans.

The 2022 legislation permits employers with a 401(k) plan, 403(b) plan, governmental 457(b) plan or SIMPLE IRA plan to provide matching contributions based on student loan payments, rather than based only on elective contributions to retirement plans, in plan years beginning after Dec. 31, 2023.

Using a question-and-answer format that includes several illustrative examples, the notice addresses a variety of plan-administration issues. Among other issues, the notice addresses:

  • General student loan matching contribution eligibility rules (including dollar and timing limitations).
  • What is required for an employee certification that student loan matching contribution requirements have been met.
  • Reasonable student loan matching contribution procedures that a plan may adopt.
  • Special nondiscrimination testing relief for 401(k) plans that include student loan matching contributions.

The notice applies for plan years beginning after Dec. 31, 2024. In the notice, the IRS said it plans to issue proposed regulations providing further guidance on section 110, but that plan sponsors may rely on the notice until the proposed regulations are issued.

The IRS welcomes public comments on this notice, which provides details on how to submit comments.

Source: IRS-2024-217, Aug. 19, 2024


19 de August de 2024
1629223477260.jpeg

A coalition representing the Internal Revenue Service, state tax agencies and the spectrum of the nation’s tax industry today announced a new joint effort to combat the growth of scams and schemes threatening taxpayers and tax systems.

The new combined effort follows a variety of increased scams and schemes that intensified during the past filing season that aimed to exploit vulnerable taxpayers while enriching fraudsters and promoters.

Convened at the request of IRS Commissioner Danny Werfel, the coalition of federal and state tax agencies along with software and financial companies as well as key national tax professional associations agreed to a three-pronged approach. They will work to expand outreach and education about emerging scams, develop new approaches to identify potentially fraudulent returns at the point of filing and create infrastructure improvements to protect taxpayers as well as federal, state and industry tax systems.

The new task force will be called the Coalition Against Scam and Scheme Threats (CASST).

“Across the spectrum of the tax system, we’ve seen a rising tide of scams and schemes that try to exploit taxpayers and find gaps in government and industry defenses,” Werfel said. “This new collaborative approach will allow the private and public sectors to throw our combined weight against this threat. We will do more to work closely together, share information faster, respond quickly to threats and quickly alert the public to new and emerging threats. Our goal is to have a mass effect on this expanding problem that’s spread on social media and through bad actors.”

The new CASST project has wide support across the nation’s tax community. In addition to the IRS, other participants include state tax agencies represented by the Federation of Tax Administrators as well as the leading software and financial industries working in the tax space and key national tax professional organizations. The Council for Electronic Revenue Communication Advancement, the National Association of Computerized Tax Processors and the American Coalition for Taxpayer Rights are among those that have signed on to support the initiative. In all, more than 60 different groups from the private sector have signed on to the initiative, either individually or as part of a group.

“The FTA membership is dedicated to protecting taxpayers from fraudulent attacks on the country’s tax ecosystem,” said Federation of Tax Administrators Executive Director Sharonne Bonardi. “We are committed to continuing our collaborative efforts by working with the IRS, industry and other stakeholders to implement strategies that allow for proactive detection, prevention and mitigation of scams and schemes deployed by bad actors intending to defraud tax agencies.”

The new coalition is an outgrowth of the Security Summit effort, and while the new collaborative effort will not replace the Summit, the scams coalition will be closely modeled on the Summit. The Security Summit was launched in 2015 by the same groups to stem the growth in tax-related identity theft. The combined effort improved information sharing between the groups, identified common approaches to combat tax-related identity theft, improved internal tax system defenses and conducted extensive public awareness campaigns for taxpayers and tax professionals. While tax-related identity theft remains a concern, the improved protections have protected millions of taxpayers and prevented billions of dollars of fraudulent payments.

For this new project targeting scams, the CASST task force has agreed to high-level principles. The purpose of the group will be to better protect taxpayers from falling prey to unscrupulous actors by leveraging multilateral relationships across the tax ecosystem to minimize the filing of fraudulent tax returns.

“CERCA is pleased to work with the IRS and the states to combat the proliferation of ‘scams and schemes’ that are victimizing millions of Americans,” said Shannon Bond, chair of the Council for Electronic Revenue Communication Advancement. CERCA represents companies in the tax software and preparation industries as well as financial service groups and others in the tax community. “Continuing our long partnership with the IRS, CERCA stands shoulder to shoulder with both the federal government and the states to reduce first-party fraud, which threatens the viability of tax systems and imperils vulnerable taxpayers.”

During the past tax season, there has been increased activity involving a variety of scams and schemes harming taxpayers, including the Fuel Tax Credit, household employment taxes and the Sick and Family Leave Credit. The IRS has seen hundreds of thousands of dubious claims come in where it appears taxpayers are claiming credits for which they are not eligible, leading to refunds being delayed and the need for taxpayers to show they have legitimate documentation to support these claims.

Numerous other scams and schemes continue to be seen circulating on social media and are highlighted through efforts including the annual IRS Dirty Dozen list and alerts from the Security Summit partners. The new approach will increase collaborative efforts to raise awareness and education about schemes, not just during tax season but throughout the year.

With the new scam and scheme initiatives, the IRS, states and the private sector will work to put in place new protections by filing season 2025. The combined effort is particularly important because the group has seen instances where scammers look for weak points in government systems and the private sector to exploit. The combined effort will improve defenses across both the private and public sector with a goal of making it more difficult for scammers to slip improper or false tax returns through the system.

The group will also work to make long-term structural changes to fundamentally improve the ability to identify and stop scams. This includes working to improve EFIN and PTIN validation and new steps to combat “ghost preparers,” who prepare tax returns for a fee and do not in any way sign a tax return or disclose their role on the tax return as the preparer. In many cases, these are inflated tax refunds that lead to millions in revenue loss and add risk for taxpayers who file potentially improper claims with only the individual’s name associated with the tax return.

Source: IRS-2024-215, Aug. 16, 2024


13 de August de 2024
The-IRS-is-opening-the-new-tax-season-today-get-ready-because-you-must-file-your-tax-return-before-April-15-to-get-your-tax-refund-quickly-1280x720.jpg

The Internal Revenue Service today reminded taxpayers of the ability to submit electronic requests for relief for certain late-filed international documents.

As part of a step toward full digitalization, the electronic option introduced August 2023, applies to the following filings:

  1. Gain recognition agreements,
  2. Late-filed dual consolidated losses, and
  3. Partnership gain deferral contributions.

How the process works

Requests can be submitted via eFax at 855-582-4842. Guidance for making each request can be found on IRS.gov using the following links:

Benefits for taxpayers and tax administration

The ability for taxpayers to securely communicate with the IRS reduces their correspondence burden while supporting IRS tax administration work. It also helps provide immediate documentation delivery to the IRS.

For IRS employees, transitioning away from the manual mailing process reduces paper documentation and improves processing time, which benefits taxpayers including those living internationally.

Source: IRS-2024-206, Aug. 12, 2024


9 de August de 2024
1683141967209.png

The Internal Revenue Service today posted an early draft of the updated Form 1099-DA, which is the form for brokers to report certain sale and exchange transactions of digital assets that take place beginning in calendar year 2025. Generally, these forms will be sent separately to taxpayers and the IRS in early 2026.

The new draft of Form 1099-DA, Digital Asset Proceeds From Broker Transactions PDF, reflects the final regulations for custodial broker reporting and includes the transitional relief described in Notice 2024-56, Notice 2024-57 and Revenue Procedure 2024-28. Interested parties can provide the IRS with comments about the draft at the forms and publications comments page on IRS.gov.

“This new form will provide more clarity for taxpayers and give them another tool to help them accurately report their digital assets transactions,” said IRS Commissioner Danny Werfel. “We know third-party reporting greatly improves compliance with the nation’s tax law. This step will also help us make sure digital assets are not used to hide taxable income, including in high-income categories, while providing taxpayers who play by the rules more information to accurately report their income.”

“Digital assets greatly increase the complexity of our tax system, and the IRS continues to work to make improvements in this area as part of our larger efforts to transform the agency,” Werfel added. “We will continue working this area to help ensure the tax laws are met while working to reduce burden wherever possible to help taxpayers in this challenging area.”

As part of the process that will lead to a final version of the form, the IRS posted the new draft of Form 1099-DA to IRS.gov along with the instructions for the recipients of the form. The IRS expects to post the draft instructions for filers soon. Once the draft filer instructions have been posted, a notice will be published in the Federal Register to allow for a 30-day comment period.

The IRS issued a news release at the end of June announcing the final regulations on the reporting requirements for custodial brokers regarding digital assets, while informing the public that the agency would soon release an updated form.

Source: IRS-2024-204, Aug. 9, 2024


5 de August de 2024
e50a25806e2ffa1ec33d7b5855e9b63b.png

In the fourth part of a special summer series, the Security Summit partners today reminded tax professionals and taxpayers about the special IRS Identity Protection PIN program and the IRS online accounts that can help protect against tax-related identity theft.

These two tools help protect against the threat of tax-related identity theft, both for the taxpayers who sign up and the tax professionals who hold their sensitive tax information.

Identity Protection PINs, also referred to as IP PINs, serve as a critical defense against identity thieves. The IRS is encouraging all tax pros and taxpayers to establish their IRS Online Account that allows access to IRS account information online, but it also guards against fraudsters trying to trick tax pros and taxpayers into creating such an account.

“To protect against continuing and evolving threats from identity thieves, these two special tools provide an extra layer of security for taxpayers and tax professionals,” IRS Commissioner Danny Werfel said. “The IRS and the Security Summit urge people to sign up for both IP PINs and the Online Account to help protect their valuable information as well as avoid tax problems down the road.”

The IRS, state tax agencies and the nation’s tax industry – working together as the Security Summit – need assistance from tax professionals to let their clients know that IP PINs and the IRS Online Account are available to anyone who can verify their identity.

In addition to enrolling in the IP PIN program, the IRS is encouraging all people to establish their IRS Online Account. Doing so not only provides access to IRS account information that’s now available online, but it also guards against fraudsters trying to trick tax pros and taxpayers into creating such an account. Tax pros also have access to the Tax Pro Account.

This is the fourth week of an eight-part Protect Your Clients, Protect Yourself summer series, part of an annual education effort by the Security Summit, a group that includes tax professionals, industry partners, state tax agencies and the IRS. The public-private partnership has worked since 2015 to protect the tax system against tax-related identity theft and fraud.

Security is a key focus of the Nationwide Tax Forum, being held in five cities this summer throughout the U.S. In addition to the series of eight news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The forums continue today in Orlando, Florida, though the event is already sold out, and carry on the week of August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego. The IRS reminds tax pros that registration deadlines are quickly approaching for the Baltimore and Dallas forums, as San Diego has also sold out.

More than 10.4 million taxpayers have taken the steps to obtain an IP PIN, a six-digit number that once issued to a taxpayer must be included on their tax return prior to filing electronically. Many, many more taxpayers should consider getting one to add another layer of protection against identity theft.

To do so, taxpayers should visit the IRS Get an IP PIN online tool. Doing that will establish a taxpayer’s access to their IRS Online Account, making themselves less likely to fall victim to social engineering schemes that trick taxpayers into setting up an IRS Online Account controlled by a bad actor.

Beginning this summer, taxpayers who enroll in the program will have the ability to unenroll if for some reason they decide they no longer want to participate in the future.

ETAAC notes IP PIN “effectively locks out” many fraudsters

The Electronic Tax Administration Advisory Committee, or ETAAC, is again this year highlighting the importance of the IP PIN to taxpayers and tax professionals, echoing past endorsements from the same independent IRS advisory group.

“The IP PIN method provides strong protection against stolen identity tax refund fraud and effectively locks out many fraudsters from e-filing using that taxpayer’s social security number,” said ETAAC’s annual report to Congress.

But the report added that IP PINS should be more widely used, calling it an overlooked tool in the fight against fraud. Underscoring the point, the ETAAC report said only 525,000 taxpayers opted into the IP PIN program in 2022, even though the Federal Trade Commission received more than 1.1 million reports of identity theft that same year.

The importance of someone’s IP PIN can be a tempting target for identity thieves, given the IP PINs’ inherent strength. Summit partners urged taxpayers and tax professionals to be careful and protect the IP PIN from identity thieves, and noted these key tips:

  • Taxpayers should share their IP PIN only with their trusted tax provider.
  • Tax professionals should never store clients’ IP PINs on computer systems. This reduces taxpayer risk if a tax pro’s system is compromised by an identity thief or cyberattack.
  • The IRS will never call, email or text either taxpayers or tax professionals to request the IP PIN. This is a sign of a scam.

Tax professionals who experience a data theft can assist clients by urging them to quickly obtain an IP PIN. Even if a thief already has filed a fraudulent return, an IP PIN would still offer protections for later years and prevent taxpayers from being repeat victims of tax-related identity theft.

Key facts about IP PINs

Here are a few other things taxpayers and tax professionals should know about the IP PIN:

  • It’s a six-digit number known only to the taxpayer and the IRS.
  • The opt-in program is voluntary, though strongly encouraged.
  • In cases of proven identity theft, an IP PIN is assigned to a taxpayer to use for future filings.
  • The IP PIN should be entered on the electronic tax return when prompted by the software product or on a paper return next to the signature line.
  • The IP PIN is valid for one calendar year; a new IP PIN is generated each year.
  • Only taxpayers who can verify their identities may obtain an IP PIN.
  • IP PIN users should never share their number with anyone but the IRS and their trusted tax preparation provider. The IRS will never call, email or text a request for the IP PIN.
  • Tax professionals cannot obtain an IP PIN on behalf of clients. Taxpayers must obtain their own IP PIN.

Taxpayers have the opportunity to opt out if they previously opted into the program. Taxpayers who are confirmed victims of identity theft will not have the option to opt out of the program.

How to get an IP PIN

To obtain an IP PIN, the best option is to start at Get an IP PIN. Taxpayers need to validate their identities through ID.me to access the tool and their IP PIN. Before attempting this thorough process, the IRS recommends taxpayers first check out How to register for IRS online self-help tools.

If taxpayers are unable to validate their identity online and if their income is less than $79,000 for individuals or $158,000 for married couples, they may file Form 15227, Application for an Identity Protection Personal Identification Number PDF. The IRS will call the telephone number provided on Form 15227 to validate their identity. Once verified, the taxpayer will receive an IP PIN via the U.S. Postal Service within four to six weeks.

Taxpayers who cannot validate their identities online or on the phone with an IRS employee after submitting a Form 15227, or who are ineligible to file a Form 15227, may call the IRS to make an appointment at a Taxpayer Assistance Center. They’ll need to bring one picture identification document and another identification document to prove their identity. Once verified, the taxpayer will receive an IP PIN via U.S. Postal Service within three weeks.

The IP PIN process for confirmed victims of identity theft remains unchanged. These victims will automatically receive an IP PIN each year.

Additional resources

If a tax pro or their firm are the victim of data theft, they should:

Tax professionals should also stay connected to the IRS through subscriptions to e-News for tax professionals and its social media sites.

Source: IRS-2024-200, July 30, 2024


30 de July de 2024
Whistleblower-Office.jpeg

In anticipation of National Whistleblower Appreciation Day on July 30, the Internal Revenue Service Whistleblower Office today recognized the important role whistleblowers play in supporting the nation’s tax administration.

Since issuing its first award in 2007 through June 2024, the IRS has paid over $1.2 billion in awards based on the successful collection of $7 billion from non-compliant taxpayers.

“The IRS appreciates the valuable contributions that thousands of whistleblowers have made to help bolster the fair and effective enforcement of our nation’s tax laws,” said IRS Whistleblower Office Director John Hinman. “Information from whistleblowers continues to be an incredibly effective aid to IRS compliance efforts, and we are committed to improving our whistleblower program by increasing our capacity to use high-value whistleblower information effectively, awarding whistleblowers fairly and as soon as possible, and keeping whistleblowers informed of their claim’s status and the basis for IRS decisions on claims.”

The IRS Whistleblower Office is strengthening collaboration with all whistleblower program stakeholders. The office also recently updated Form 211, Application for Award for Original Information PDF, and is currently working on a digital submission portal for whistleblower claims, which it plans to have online in 2025.

In Fiscal Year 2023, the IRS paid awards totaling $88.8 million based on whistleblower information attributable to tax and other amounts collected of $338 million. In Fiscal Year 2023, the Whistleblower Office established 16,932 award claims, an increase of 44% compared to the average of the prior four years.

The IRS values the assistance it’s received from whistleblowers and the whistleblower practitioner community. Whistleblower information that the IRS can act on is an important component of effective tax administration and contributes to identifying non-compliance and reducing the tax gap.

Actionable claims contain specific, timely and credible information. A whistleblower may qualify for an award when use of the whistleblower’s information results in proceeds collected. The awards paid to whistleblowers generally range between 15 and 30% of the proceeds collected and attributable to their information.

The IRS Whistleblower Office was established in 2007 to administer claims from whistleblowers that identify taxpayers who may not be complying with tax laws or other laws the IRS administers, enforces or investigates.

National Whistleblower Appreciation Day is recognized on July 30 because America’s first whistleblower law was passed by the Continental Congress on July 30, 1778. The first law related to whistleblowers on tax violations was enacted almost 90 years later in March 1867.

Source: IRS-2024-199, July 29, 2024


24 de July de 2024
IRS-building-stop-light.jpg

Week 3 of Protect Your Clients; Protect Yourself series focuses on security warning signs

In the third part of a special series, the Internal Revenue Service and the Security Summit partners today urged tax professionals to learn the signs of data theft so they can respond quickly to protect their business and their clients.

The IRS and the Security Summit partners continue to see a relentless string of attempts by identity thieves to target tax professionals in hopes of gaining valuable client tax information. With stronger fraud defenses put in place by the IRS and Security Summit partners, identity thieves have shifted their attention to tax pros to get more detailed information to help prepare bogus tax returns.

“We continue to see instances where tax professionals have had their systems compromised, and they didn’t realize it for week or months,” IRS Commissioner Danny Werfel said. “Identity thieves are creative, and they can find ways of quietly penetrating systems. There are important warning signs tax pros should watch out for that can help alert them more quickly to a security issue, and speed is critical to protect clients and their businesses from a security incident.”

The IRS, state tax agencies and the nation’s tax industry – working together as the Security Summit – reminded tax professionals that they should contact the IRS immediately when there’s an identity theft issue while also contacting cybersecurity experts and insurance companies to assist them with determining the cause and extent of the loss.

This is the third week of an eight-part Protect Your Clients; Protect Yourself summer series, part of an annual education effort by the Security Summit, a group that includes tax professionals, industry partners, state tax agencies and the IRS. The public-private partnership has worked since 2015 to protect the tax system against tax-related identity theft and fraud.

These security tips will be a key focus of the Nationwide Tax Forum, being held this summer in five cities throughout the U.S. In addition to the series of eight news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The next forum begins next week in Orlando, Florida, and is already sold out, followed by the week of August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego. The IRS reminds tax pros that registration deadlines are quickly approaching for the Baltimore and Dallas forums, as San Diego has also sold out.

Each year at the tax forums, the IRS hears from tax professionals attending the sessions who realize that they’re victims of a data theft or a security breach, but they hadn’t realized the warnings signs. Here are some things that can help.

Tax pros: Know the warning signs from clients, their systems

Tax pros should be on the lookout for these critical warning signs from their clients:

  • Clients receive notice that an IRS Online Account was created without their consent or that:
    • Someone accessed their IRS Online Account without their knowledge.
    • The IRS disabled their Online Account, either their individual or business Online Account.
  • Tax pro clients receive a tax transcript they didn’t request.
  • Balance due or other notices from the IRS are received that are not correct based on the tax return filed.
  • Clients reach out to the tax pro about calls or emails the tax pro didn’t make.
  • Clients receive refunds without filing a tax return.

Tax professionals should also watch for these red flags when their business experiences these situations:

  • Slow or unexpected computer or network responsiveness such as:
    • Software is slow or actions take longer to process than usual.
    • Computer cursor moves or changes numbers without touching the mouse or keyboard.
    • Unexpectedly being locked out of a network or computer.
  • Client tax returns are being rejected because their Social Security number was already used on another return.
  • IRS authentication letters (5071C, 6331C, 4883C, 5747C) are being received even though a tax return hasn’t been filed.
  • Getting more e-file receipt acknowledgements than the tax pro actually filed.
  • The IRS disabled the tax professional’s online account.
  • Transcripts are being delivered to the tax pro’s Secure Object Repository (SOR) that they did not order.
  • Notification from the IRS that the tax professional’s Centralized Authorized File (CAF) number has been compromised. If they suffer a data compromise, they should take proactive steps to protect their CAF number and consider requesting a new one to protect themself and their clients.
  • Notification from the IRS regarding a client that they do not represent.

While these are only a few examples, tax pros should ensure they have the highest security possible and be ready to react quickly to protect themselves and their clients. To help tax pros, the Summit partners created the Written Information Security Plan PDF or WISP. The newly updated 29-page, easy-to-understand document was developed by and for tax and industry professionals to help keep client and business information safe and secure.

Tax pros should report data theft immediately

If a tax pro or their firm are the victim of data theft, they should:

  • Report the incident to their local IRS stakeholder liaison. Speed is critical. IRS stakeholder liaisons will ensure all the appropriate IRS offices are alerted. If reported quickly, the IRS can take steps to block fraudulent returns in the clients’ names and will assist tax pros through the process.
  • Visit the Federation of Tax Administrators to find state contact information. Tax professionals can share information with the appropriate state tax agency by visiting the special Report a Data Breach.
  • Tax professionals should be proactive with clients who could have been impacted and suggest appropriate actions, such as obtaining an identity protection PIN or completing a Form 14039, Identity Theft Affidavit PDF, if applicable.

Find more information at Data theft information for tax professionals.

Additional resources

Tax professionals should stay connected to the IRS through subscriptions to e-News for tax professionals and its social media sites.

Source: IRS-2024-193, July 23, 2024


22 de July de 2024
VPTAX-Feature-786-ral_insight_card-Blue.png

The Department of the Treasury and the Internal Revenue Service today issued final regulations updating the required minimum distribution (RMD) rules.

The final regulations reflect changes made by the SECURE Act and the SECURE 2.0 Act impacting retirement plan participants, IRA owners and their beneficiaries. At the same time, Treasury and IRS issued proposed regulations, addressing additional RMD issues under the SECURE 2.0 Act.

While certain changes were made in response to comments received on the proposed regulations issued in 2022, the final regulations generally follow those proposed regulations.

Specifically, Treasury and IRS reviewed comments suggesting that a beneficiary of an individual who has started required annual distributions should not be required to continue those annual distributions if the remaining account balance is fully distributed within 10 years of the individual’s death as required by the SECURE Act. However, Treasury and IRS determined that the final regulations should retain the provision in the proposed regulations requiring such a beneficiary to continue receiving annual payments.

The new proposed regulations include provisions for which Treasury and IRS are soliciting public comments, including provisions addressing other changes relating to RMDs made by the SECURE 2.0 Act. For details on how to submit comments, see the proposed regulations.

Source: IRS-2024-190, July 18, 2024


17 de July de 2024
90.jpeg

In the second installment of a special series, the Internal Revenue Service and Security Summit partners warned tax professionals to be aware of evolving phishing scams and cloud-based schemes designed to steal sensitive taxpayer information.

The IRS and Security Summit partners – representing state tax agencies and the nation’s tax industry – continue to see a steady stream of e-mail and related attacks aimed at the nation’s tax professional community. These are designed to steal sensitive tax and financial information from clients.

The variants of these email attacks routinely number in the hundreds and can target tax professionals whether it’s tax season or not.

“We continue to see a barrage of email and related attacks designed to trick tax professionals and gain access to their sensitive information,” said IRS Commissioner Danny Werfel. “These attempts can be elaborate, multi-layered efforts that look convincing and can easily fool people. Tax professionals need to be wary and educate their employees to use extra caution to protect their clients and their businesses.”

This is the second release in an eight-part “Protect Your Clients; Protect Yourself” summer series, part of an annual education effort by the Security Summit, a group that includes tax professionals, industry partners, state tax agencies and the IRS. The public-private partnership has worked since 2015 to protect the tax system against tax-related identity theft and fraud.

These security tips will be a key focus of the Nationwide Tax Forum, which will be in five cities this summer throughout the U.S. In addition to the series of eight news releases, the tax professional security component will be featured at the forums, which are three-day continuing education events. The remaining forums begin July 30 in Orlando, August 13 in Baltimore, August 20 in Dallas and September 10 in San Diego.

The IRS reminds tax pros that registration deadlines are quickly approaching for several of the forums, and Orlando is already sold out.

Phishing, spear phishing, clone phishing and whaling

One of the most common threats facing tax pros are phishing and related scams. These are designed to trick the recipient into disclosing personal information such as passwords, bank account numbers, credit card numbers or Social Security numbers.

Tax professionals and taxpayers should be aware of different phishing terms and what the email scams might look like:

  • Phishing/Smishing – Phishing emails or SMS/texts (known as “smishing”) attempt to trick the recipient into clicking a suspicious link, filling out information or downloading a malware file. Often phishing attempts are sent to multiple email addresses at a business or agency increasing the chance someone will fall for the trick.
  • Spear phishing – A specific type of phishing scam that bypasses emailing large groups at an organization, but instead identifies potential victims and delivers a more realistic email known as a “lure.” These types of scams can be trickier to identify since they don’t occur in large numbers. They single out individuals, can be specialized and make the email seem more legitimate. Scammers can pose as a potential client for a tax professional, luring the practitioner into sharing sensitive information.
  • Clone phishing – A newer type of phishing scam that clones a real email message and resends it to the original recipient pretending to be the original sender. The new message will have either an attachment that contains malware or link that tries to steal information from the tax professional or recipient.
  • Whaling – Whaling attacks are very similar to spear phishing, except these attacks are generally targeted to leaders or other executives with access to secure large amounts of information at an organization or business. Whaling attacks can also target people in payroll offices, human resource personnel and financial offices.

Security Summit partners continue to see instances in which tax professionals have been particularly vulnerable to emails posing as potential clients. In the “new client” scam, the criminals use this technique to trick practitioners into opening email links or attachments that infect computer systems with the potential to steal client information. Similar schemes are seen with whaling situations where scammers try to obtain a large amount of information with legitimate-looking email requests.

Warning signs of a scam

Regardless of the type of phishing attempt, tax pros can protect themselves and their organization by being aware of these scams and looking for warning signs like these:

  • An unexpected email or text claiming to come from a known or trusted source such as a colleague, bank, credit card company, cloud storage provider, tax software provider or even the IRS and other government agencies.
  • Receiving a duplicate email from what appears to be a known trusted source that contains a new attachment or hyperlink.
  • A message, often with an urgent tone, urging the receiver to open a link or attachment. These messages have a false narrative, like someone’s password has expired or some other urgent action is needed.
  • An email address, number or link that’s slightly misspelled or has a different domain name or URL (irs.com vs. IRS.gov). A closer look at these email addresses – like hovering the cursor over the email address – can show slight variations on legitimate addresses.

“There are major red flags that can be easily overlooked, so tax professionals and taxpayers should be extra careful and look closely when they receive an email from an official looking source,” Werfel said.

Cloud-based schemes remain a threat

Tax professionals using cloud-based systems that store information or run tax preparation software should use multi-factor authentication to help safeguard that data. The Federal Trade Commission now requires all practitioners to secure sensitive client personally identifiable information (PII) using multi-factor authentication.

Specifically, the Security Summit continues to see attacks that take advantage of cloud-based systems and compromise personal information. Multi-factor authentication options provide an additional layer of security to access a system by using a phone, text messages or tokens. Since email is easier for identity thieves to access, having these layers of security helps guard against potential vulnerabilities.

Additional resources

For tax professionals who are victim of any of these schemes or identity theft, the IRS urges them to quickly contact their IRS stakeholder liaison to provide details of the situation. Tax professionals can also share information with the appropriate state tax agency by visiting a special Report a Data Breach page with the Federation of Tax Administrators.

Quickly reporting these incidents can not only protect the tax pro’s clients, but it can also help provide critical information quickly to help prevent these attacks from hitting others in the tax community.

Tax professionals should also understand the Federal Trade Commission’s data breach response requirements PDF as part of their overall information and data security plan. There’s a new requirement to report an incident to the FTC when 500 or more people are affected within 30 days of the incident.

To help taxpayers navigate these issues and meet the requirement to have a security plan, the Security Summit has prepared a sample Written Information Security Plan. This template can help tax pros, including smaller practitioners, protect themselves from ongoing security threats.

Tax professionals should also review IRS Publication 4557, Safeguarding Taxpayer Data PDF, for more information.

Other resources include Small Business Information Security: The Fundamentals PDF, by the National Institute of Standards and Technology and the IRS’ Identity Theft Central pages for tax pros.

Publication 5293, Data Security Resource Guide for Tax Professionals PDF, provides a compilation of data theft information available on IRS.gov. The IRS also encourages tax professionals to stay connected to the IRS for its latest updates and alerts through subscriptions to e-News for tax professionals and its social media sites.

 

Source: IRS-2024-188, July 16, 2024


15 de July de 2024
GSPHgwsagAQYT3f.jpg-large-1280x720.jpeg

The Internal Revenue Service would like to remind car dealers and sellers to be aware of evolving phishing and smishing scams that could impact day-to-day operations of the business.

In light of the recent ransomware attack aimed at car dealers, the IRS is warning individuals and businesses to remain vigilant against these attacks. Fraudsters and identity thieves attempt to trick the recipient into clicking a suspicious link, filling out personal and financial information or downloading a malware file onto their computer.

Scammers are relentless in their attempts to obtain sensitive financial and personal information, and impersonating the IRS remains a favorite tactic. The IRS urges car dealerships to be extra cautious about unsolicited messages and avoid clicking any links in an unsolicited email or text if they are uncertain.

Phish or smish: Don’t take the bait

The IRS continues to see a barrage of email and text scams targeting businesses and individual taxpayers. The IRS and the Security Summit partners continue to remind taxpayers, businesses and tax professionals to be alert for a wide variety of these scams and schemes. Businesses such as car dealerships should remain alert for targeted email and text scams aimed to disrupt their computer systems.

These businesses should be alert to fake communications posing as legitimate organizations. These messages arrive in the form of unsolicited texts or emails to lure unsuspecting victims to provide valuable information that can lead to identity theft or malicious malware installed on computer systems. There are two main types:

  • Phishing: An email sent by fraudsters claiming to come from a legitimate source. The email lures the victims into the scam with a variety of ruses such as enticing victims to provide sensitive information.
  • Smishing: A text or smartphone SMS message where scammers often use alarming language such as, “Your account has now been put on hold,” or “Unusual Activity Report,” with a bogus “Solutions” link to restore the recipient’s account.

Never click on any unsolicited communication as it may surreptitiously load malware. It may also be a way for malicious hackers to load ransomware that keeps the legitimate user from accessing their system and files.

In some cases, phishing emails appear to come from a legitimate sender or organization that has had their email account credentials stolen. Setting up two-factor or multi-factor authentication with their email provider will reduce the risk of individuals having their email account compromised.

Posing as a trusted organization, friend or family member remains a common way to target individuals and businesses for various scams. Individuals and businesses should verify the identity of the sender by using another communication method, for instance, calling a number they independently know to be accurate, not the number provided in the email or text.

What to do

  • Never respond to phishing or smishing or click on the URL link.
  • Don’t open any attachments. They can contain malicious code that may infect the computer or mobile phone.
  • Don’t click on any links. If a taxpayer inadvertently clicked on links in a suspicious email or website and entered confidential information, visit the IRS’ identity protection page.
  • Send the full email headers or forward the email as-is to phishing@irs.gov. Don’t forward screenshots or scanned images of emails because this removes valuable information.
  • Delete the original email.

Source: IRS-2024-186, July 11, 2024