Tax Administrator and Attorney General warn about email scam on taxes
Criminal, claiming to represent Tax Division, promises large sum in return for payment
MAY 29, 2020
PROVIDENCE, R.I. — Rhode Island Tax Administrator Neena Savage and Rhode Island Attorney General Peter F. Neronha today warned taxpayers to be on alert for an e-mail scam in which someone claiming to be from the Rhode Island Department of Revenue's Division of Taxation appears to be billing recipients for Rhode Island income tax.
In the message, which uses a Rhode Island Division of Taxation logo and is titled “RESIDENT INCOME TAX NOTICE”, the emailer claims that a large sum is being held on the taxpayer's behalf at an offshore bank. If the taxpayer agrees to pay 0.5% of that sum, allegedly to cover Rhode Island taxes, the large sum will be transferred to the taxpayer.
“Those who send such e-mails are trying to steal a recipient's money, identity, or both,” Savage said.
“Do not open such e-mails. If you open one by accident, do not respond. Do not open any links or attachments, and please contact law enforcement authorities,” she said.
Neronha urges the public to be vigilant as new scams continue to emerge in the wake of the COVID-19 pandemic.
Security Summit
The Rhode Island Division of Taxation is a member of the Security Summit, which combats identity theft refund fraud to protect the nation's taxpayers.
The Security Summit includes the Internal Revenue Service, state tax agencies, tax-preparation firms, software developers, payroll companies, tax professional organizations, and others.
“The government will not ask you to pay money upfront to receive income tax funds,” Neronha said. “These are challenging times and many people could use some relief. Unfortunately, there are scammers who will try and take advantage of people in need. If you see it, call us. The more information we get from the public, the more we can get the word out to help others.”
The Division is specifically aware of one recent case in which the taxpayer received several emails related to the same scam. One of those emails contained an attachment in which the criminal outlines the steps that the taxpayer must take to claim the large sum.
The amounts cited in the email are significant: If the taxpayer hands over about 71,330 in British pounds (approximately 86,860 in U.S. dollars), the taxpayer would allegedly receive about 14.3 million in British pounds (approximately 17.4 million in U.S. dollars).1
“On confirmation of payment, your funds will be authorized for swift transfer to your bank account. A swift compliance with the above directives is mandatory,” the message says. (A copy of the message is reproduced on the last page of this Advisory.)
In a follow-up email exchange, the criminal asked that the taxpayer send the money, in cash (U.S. dollars), to an address in Jefferson, Louisiana. Fortunately, the taxpayer in this case did not pay the requested amount. Instead, the taxpayer contacted an intermediary, who in turn alerted the Rhode Island Division of Taxation.
“Especially amid the uncertainty and anxiety created by the coronavirus pandemic (COVID-19), taxpayers who are at home and online may be particularly vulnerable. But it is precisely at such a time that taxpayers need to be especially vigilant about fraudulent schemes and scams like this one,” said Savage.
If you see these scams or think you have been the victim of a scam, contact the Rhode Island Attorney General's Consumer Protection Unit at (401) 274-4400, email: consumers@riag.ri.gov, or fill out an online complaint form.
Phishing attacks
Criminal plots such as the one outlined in today's Advisory are sometimes called phishing attacks. Phishing attacks use email or malicious websites to solicit personal, tax, or financial information, or money, by posing as a trustworthy organization. Often, recipients are fooled into believing the phishing communication is from someone they trust.
A criminal may take advantage of knowledge gained from online research and earlier attempts to masquerade as a legitimate source, including presenting the look and feel of authentic communications, such as using an official logo.
“These targeted messages can trick even the most cautious person into taking action that may compromise sensitive data,” Savage said. The scams may contain emails with hyperlinks that take users to a fake site. Other versions contain PDF attachments that may download malware or viruses.
Phishing attacks, especially online phishing scams, are popular with criminals because there is no fool-proof technology to defend against them. Users are the main defense against such frauds. When users see a phishing scam, they should make sure that they don't take the bait. (Awkward wording and/or frequent misspellings can sometimes be signals of a phishing or other such email. Some phishing emails are actually outright solicitations for money.) Following are a few steps to take:
Be vigilant; be skeptical. Never open a link or attachment from an unknown or suspicious source. Even if the email is from a known source, approach with caution. Cybercriminals are adept at mimicking trusted businesses, friends, and family. Thieves may have compromised a friend's email address, or they may be spoofing the address with a slight change in text, such as name@example.com vs. narne@example.com. In the latter, merely changing the “m” to an “r” and “n” can trick people.
Remember: The Rhode Island Division of Taxation does not initiate spontaneous contact with taxpayers by email to request personal or financial information. This includes text messages and social media channels. No legitimate business or organization will ask for sensitive financial information via email. Also keep in mind that the Rhode Island Division of Taxation sends its billings to taxpayers only through the U.S. Postal Service, not by e-mail.
Use security software to protect against malware and viruses. Some security software can help identity suspicious websites that are used by cybercriminals.
Use strong passwords to protect online accounts. Each account should have a unique password. Use a password manager if necessary. Criminals count on people using the same password repeatedly, giving crooks access to multiple accounts if they steal a password.
Other resources
The website of the Federal Trade Commission has an “OnGuardOnline” page that includes free online security tips and resources. Click here to view.
The Internal Revenue Service has a security awareness publication with tips on how to protect all of your digital devices. Click here to view.
The Rhode Island Division of Taxation's Special Investigation Unit has a tax fraud tip line that handles tips about wrongdoing involving state taxes. Call the tax fraud tip line at (401) 574-TIPS or (401) 574-8477 and leave a message. (Callers can leave their names and contact information or remain anonymous.) Or use the unit's online tip form.
“If you come upon suspicious e-mails, it's best to delete them,” Savage said. If you are in doubt about any communication you receive from the Rhode Island Division of Taxation, please call the agency at (401) 574-8829 between 8:30 a.m. and 3:30 p.m. business days.
(Note: A copy of the e-mail in this case is reproduced on the following page.)
FOOTNOTES
1Based on the email message in this case, if the taxpayer gives the criminal 71,327.05 in British pounds (the equivalent of approximately 86,862.08 in U.S. dollars), the taxpayer would allegedly receive 14,265,467 in British pounds (the equivalent of approximately 17,372,485.71 in U.S. dollars). The amounts in the email are stated only in British pounds. The dollar amounts listed in this Advisory assume a recent currency conversion rate of 1 British pound to 1.2178 U.S. dollars, based on a listing of foreign exchange rates published by the Federal Reserve at https://www.federalreserve.gov/releases/h10/current/.
END FOOTNOTES