Clients generally have tax questions when their children head off to college, but there’s one thing that may not make the list: identity theft phishing scams. A quick survey of social media might lead a reasonable person to believe that college students are lazy indigents. It turns out that the echo chamber might not necessarily reflect reality.
In addition to receiving the same run-of-the-mill phishing scams as the rest of the country’s workforce—most have a job, and in many cases work full-time—the Internal Revenue Service is reporting that college students are specifically being targeted with a new tax-related scam.
What is the latest phishing scam that targets college email addresses?
The IRS says that identity thieves are impersonating the IRS in tax-refund scam emails that are being sent to .edu email addresses, which includes students and staff at “both public and private, profit and non-profit institutions.” As with other phishing emails that appear to come from a legitimate source, it can be hard to spot that it’s fake at first glance.
“The suspect emails display the IRS logo and use various subject lines such as ‘Tax Refund Payment’ or ‘Recalculation of your tax refund payment,’” the IRS explains. “It asks people to click a link and submit a form to claim their refund.”
The embedded link leads to a fake website that asks visitors to enter personally identifiable information. Here’s the list of requested data that has been compiled by the IRS:
- Social Security number
- First Name
- Last Name
- Date of Birth
- Prior Year Annual Gross Income (AGI)
- Driver’s License Number
- Current Address
- State/U.S. Territory
- ZIP Code/Postal Code
- Electronic Filing PIN
It’s important to make sure your clients—including their children—understand that it’s never a good idea to click links in unsolicited emails that suddenly appear in their inboxes. Even if those dependents haven’t reached college age, many have mobile devices and email accounts of their own that can be exploited by criminals. And they should never provide private information to an unfamiliar website. (Read more about how to avoid phishing scams on this GruntWorx blog: “IRS Has Tips for Avoiding Tax-Related Scams.”)
As for those who have questions about their tax refund, the IRS says the “Where’s My Refund?” tool on IRS.gov and the IRS2Go mobile application is a safe and easy way to get that info. Users who provide their SSN or ITIN, filing status, and expected refund amount will see one of three statuses: return received, return approved, or return sent. Even better, they won’t have to worry about the IRS selling their PII on a Dark Web auction.
Finally, every suspected tax-related phishing email should be reported to the IRS. That’s how they build a comprehensive list of common strategies deployed by criminals, which they pass along to everyone else. To report a scam email, forward it to firstname.lastname@example.org.