When it comes to tax season, we often think of filing returns, deductions, income, and other financial considerations. However, there is another crucial factor that we all need to consider during this time, the rise in identity theft.
In 2023, the FTC received over sixty thousand reports of identity theft relating to tax fraud and that number may continue to grow(1). Many people are unaware of the increased cybersecurity risk during tax season but a scam can lead to devastating consequences like the exposure of your social security number (SSN) or someone stealing your tax refund. It’s important to protect your private information and the best way to start is by understanding online safety and the state of tax scams in 2025.
Understanding the Tax Season Threat Landscape
Scammers have continued to evolve in their methodologies and are now difficult to detect. They use the latest technology to deceive their victims and steal their information. However, these cybercriminals tend to re-use their tactics and that is how we can identify what is and isn’t a tax scam.
Common Tax Scams Targeting Individuals
Since 2002, the IRS has released an annual list of common tax scams to watch out for, otherwise known as the Dirty Dozen. The online safety campaign is an effort to raise awareness about the present cybersecurity risks and protect taxpayers from falling for these evolving schemes. Here are the common tax scams to watch out for that is related to identity theft (2).
One: Phishing Scams
Phishing scams are when criminals use deceptive communication tactics to trick their victims into providing valuable private information. They are the most common scams to see online and can be incredibly effective when used during tax season.
Often posing as the IRS, the scammer will send the victim a message portraying an urgent situation to get them to click on a phishing link. The link, however, is full of malware and gives the scammer access to your device. There are three main ways that scammers contact their victims.
- Email: A fraudster will send an email claiming to be from a legitimate organization. The email entices victims into responding or complying with the email instructions by using scare tactics like threatening false criminal charges or tax fraud.
- Smishing or “SMS Phishing”: A text from the IRS that notifies you of important tax details is always a red flag. Scammers will use evocative language to entice victims into clicking on a link in the text. This can include “suspicious account details”, “unexpected tax refunds”, or “a problem with your tax returns”.
- Vishing or “Voice Phishing”: Scammers can also call to pressure victims into providing their private information over the phone in fraudulent urgent scenarios.
An important note is that the IRS will primarily contact you by mail and will never initiate contact with you by phone, email, or SMS(3). You can give the IRS permission to contact you through SMS or email but they will still send you mail alongside those communications.
Two: Ghost Tax Return Preparers
Tax preparers are used by individuals to make filing taxes easier. However, not all tax preparers should be trusted. Some use the title to scam unsuspecting victims only to disappear afterward. Often, the preparer will charge a fee based on the size of the tax refund and will promise to make the refund as big as possible. Another red flag is that they will refuse to sign or include an IRS Preparer Tax Identification Number (PTIN) as required by law.
Three: New Client Scams
These types of tax scams are more recent and target tax professionals. In this scam, cybercriminals pose as a regular taxpayer seeking out help from a professional. The scammer sends the tax pro an email that includes a malicious attachment or URL to access the victim’s systems. This gives the hacker access to not only the tax professional’s information but also their client’s sensitive information.
Four: Scammers Helping Create an IRS Individual Online Account
This tax scam targets the elderly and those unfamiliar with technology. Criminals will pretend to be a helpful third-party that offers to help create an online account on the official IRS website. Then, these scammers will steal the victim’s personal information. The IRS makes creating an online account simple and no help from a third-party is needed. They also have resources to help users create an account on their website.
Five: Fake Charities
Bogus charities are an annual problem, especially during a crisis or natural disaster. These fake organizations are created to receive money and personal information from other taxpayers.
Remember, In order for a taxpayer to claim a deduction from donations to charities, it must be officially recognized by the IRS.
The Psychological Tactics Used by Cybercriminals
As we build cybersecurity measures against the current tactics by scammers, the cybercriminal’s methods also evolve. However, the psychological tactics used remain a constant in all of their tax scams. Here are some of the psychological tactics used by scammers.
- Creating a sense of urgency and fear: During tax season, criminals will use the threat of committing tax fraud and account issues as an emotional basis to contact you. This is only to scare you into doing something rash like clicking a link in a text message.
- Exploiting the complexity of tax laws: Taxes can be complex, especially with additional income or investments. Many people turn to tax professionals to handle their taxes for them so they don’t have to think about it.
- Leveraging trust in official-looking communications: By looking like an official email or text from a legitimate organization, scammers can fool many people into falling for their schemes. It’s a quick way to gain trust. However, the devil is in the details and there will often be misspellings, blatantly fake email addresses, and strange word choices that give it away.
Practical Cybersecurity Measures for Taxpayers
With tax season comes an increase in people sending their personal information around. It’s vital to protect yourself during this time but understanding how can be a bit difficult. Luckily, we have some practical cybersecurity measures to avoid being a victim of these tax scams.
Strengthening Your Online Defenses
The first step to protecting yourself online is to build up your defenses. Your passwords are the cornerstone of your security. However, hackers have multiple ways to discover passwords or get you to divulge your login credentials unwittingly. Make sure your passwords are strong and unique for each account. Data breaches can expose your login credentials to scammers who will use them to get into your other accounts.
Two-factor authentication is also an essential way to keep your accounts secure from breaches. This process is when you are required to verify your identity as an account owner in two different ways.
As a counter measure to clicking a malicious link, you can install reputable antivirus and anti-malware programs. These programs will help you quickly detect and remove any infections on your device.
Identifying and Avoiding Phishing Attempts
Unfortunately, avoiding phishing attempts entirely is not plausible. Spam will always be sent to your email or phone and it’s important to recognize these tax scams before you interact with them. There are common flaws to look for with phishing attempts.
- Check the email addresses from legitimate organizations.
- Any message that seems too good to be true like a large tax refund is likely a scam.
- Hover over links included in emails to look at their destinations. Always go directly to the main website instead of clicking on email links as a precautionary measure.
- Never click on attachments from unknown senders.
- Verify any notice in SMS or email with the legitimate organization. For example, you can verify a notice from Netflix of your account being on hold by going to Netflix.com.
Safe Practices for Filing Your Taxes Online
When it comes to filing your taxes online, you can use safe procedures to make sure your taxes are securely sent to the IRS. There are reputable tax services that are trusted by the IRS and can be used to file your taxes for free. Websites like FreeTaxUSA, 1040.com, TaxAct and more are all free to use as long as you meet the income requirements(4). Make sure any tax website you are using is legitimate, trusted, and has plenty of positive feedback.
Filing taxes requires a lot of sensitive information that you want encrypted. Public wi-fi is an unsecure network and sending private information over it can expose you to hackers. Fortunately, even though public wi-fi is unsecure, most websites today are encrypted. You can tell what websites are secure by looking for the lock symbol in the address bar.
Protecting Your Sensitive Information
Your taxes have a lot of sensitive information and in the wrong hands, can have devastating consequences. Once your taxes are filed and accepted, make sure you shred or physical tax documents before throwing them away. It’s also recommended to file your taxes online so that your tax documents aren’t intercepted in the mail. You should also monitor your accounts for suspicious behavior. This can be in your credit reports, bank statements, any notice of a tax return that you did not file, etc.
What to Do if You Become a Victim
Having your social security number exposed is a nightmare. There is a constant anxiety about what the thieves could be doing to affect your finances, credit, taxes, and so much more. However, there are ways to respond to these attackers and mitigate the damage being caused.
Reporting Identity Theft and Tax Fraud
Identity thieves can mess up a lot of your life without you even knowing. However, there is a guide on immediate steps to take in the case of identity theft or a tax scam. Here is how you should report that your SSN or Individual Tax Identification Number (ITIN) has been stolen.
- Report the stolen SSN or to Identitytheft.gov, the federal website for identity theft recovery.
- If you had your tax return rejected because it has already been filed, call the number on the notice that the IRS sent to you in the mail.
- Complete form 14039, an Identity Theft Affidavit, on the IRS website(5).
The FTC only recommends filing a report with them after the thief has misused your identity. You should also report the identity theft to the local police. They can help you with the recovery plan from IdentityTheft.gov. Making a police report may help businesses remove fraudulent debt from your account as well(6).
Recovering Your Data and Finances
Sometimes people have their identity stolen through a malware attack in which their other data is also stolen. The hacker can then hold their files for ransom or destroy the files entirely. When it comes to data recovery, we never recommend to pay any ransom. Instead, use a reputable data recovery program to recover your files.
In the case of stolen finances, make sure to monitor your credit card and bank statements for any suspicious activity. Call your bank immediately if you see something suspicious and they will work with you to stop any more money from being taken.
Digital Forensics Corp: Your Cybersecurity Partner
At Digital Forensics Corp., cybersecurity is our main concern. Our team of experts can make sure your devices and accounts are secure from online attacks. We can also educate you on the types of scams to look out for across different platforms. If you’ve already been a victim to a scam, our cyber specialists can purge your devices from any harmful malware and perform data recovery for your files. We have over a decade of experience working on cybersecurity solutions and can’t wait to bring our expertise to you. Contact us today!
Sources:
- https://www.ftc.gov/system/files/ftc_gov/pdf/CSN-Annual-Data-Book-2023.pdf
- https://www.irs.gov/newsroom/dirty-dozen
- https://www.irs.gov/privacy-disclosure/irs-privacy-guidance-about-email-contact
- https://www.irs.gov/newsroom/dirty-dozen-tax-scams-for-2025-irs-warns-taxpayers-to-watch-out-for-dangerous-threats
- https://www.irs.gov/help/tax-scams/report-a-tax-scam-or-fraud
- https://www.identitytheft.gov/Info-Lost-or-Stolen
DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.
