Introduction:
It’s no secret that hackers are incredibly clever with their tactics, often taking advantage of trends, events or seasonality. In our previous blogs, we’ve described how hackers take advantage of Christmas and Valentine's day, but it’s less obvious that they take advantage of the tax season. In this blog, we delve into how hackers are using the tax season to conduct attacks, the ways they are exploiting it, the use of AI and how consumers and businesses can protect themselves.
Understanding the Threat:
The rush to meet tax deadlines creates a prime opportunity for cybercriminals. They mimic official communications through phishing emails, fraudulent websites, and scam calls to deceive individuals. These tactics aim to steal financial information or personal data, leveraging the tax season's urgency and complexity. Here is an example of a phishing campaign below:
Hackers' Motives:
Financial gain remains the primary motive, with stolen information used for direct theft or broader identity theft schemes. The sophistication of these scams, from fake tax refund emails to threatening calls, underscores the need for heightened vigilance.
AI's Role in Cyber Scams:
Hackers now employ AI to craft more convincing scams, making fraudulent communications nearly indistinguishable from legitimate ones. Advanced voice-simulation technologies enable scam calls that mimic official tax representatives accurately, presenting a significant challenge in distinguishing between genuine and fraudulent contacts.
Strategies for Protection:
Insurance providers can play a crucial role in educating their customers about these threats. Emphasising that legitimate tax communications will not request sensitive information via insecure channels is critical. Encourage customers to verify the authenticity of tax-related communications and to use secure, verified methods to interact with tax authorities. Additionally, providing resources and tools, like Cyber Xpert, that offer education, personalised alerts, and comprehensive protection can empower customers to navigate tax season securely.
Here are some simple rules your customers can keep in mind:
- Your tax office will never contact you via social media or WhatsApp and will most likely never contact you via SMS or email (depending on your country). Usually, all communications are handled via secure online portals, mail, or by contacting their official phone number.
- Your tax office will never contact you out of the blue, threatening you with legal action
- Your tax office will never send you communications asking you to share sensitive information
- Your tax office should never send you communications asking you to click on links or download files or attachments
When it comes to phishing campaigns, education and scepticism are the main sources of protection for your customers. Encourage them to research common scams by visiting their tax office’s website.
They should never click a link, download an attachment or share sensitive information without fully verifying the source. If a communication is asking them to do this, it's more than likely a scam.
If they are unsure about whether a communication is legitimate, they should contact the official help centre for the tax office to verify. Here are some useful resources you can share with them which include examples of current scams that are in circulation:
HMRC official guidance on tax-related scams
IRS official guidance on tax related scams
Which.co.uk - examples of tax scams
Cyber Risk Solutions
At DynaRisk, we provide a range of cyber risk software and cyber support helpline solutions to the insurance market, to help protect insureds globally, resulting in less cyber attacks and less insurance claims.
To find out more about our all-in-one risk management portal for consumers, click here