A barrage of cybercriminal activity is already underway this tax season with a phishing campaign impersonating Intuit, the popular accounting and tax-filing software.
Just this week Intuit posted 2 critical security notices warning users of Intuit’s online tax service not to fall for well crafted and legitimate looking phishing emails. Intuit is one of the leading sites for filing individual tax returns so it should come as no surprise that phishers are aggressively ramping up creative and stealthy ways to trick victims into installing malware or giving up personal data.
What do the emails look like?
The fake emails attempt to impersonate the Intuit Maintenance Team and state that the recipient’s account has been “temporarily disabled” “due to inactivity” and that it’s “compulsory” to restore access to the account within 24 hours.
“This is a result of recent security upgrade on our server and database, to fight against vulnerability and account theft as we begin the new tax season,” according to the email.
Emails directs users to a link to “restore access” to their account after entering some personal information. This of course is fake, as any data entered will be immediately harvested and used against the victim to inflict further harm such as identity theft, stealing tax return refunds or become a target for even more phishing emails.
The Takeaway
Intuit has stated that “This email did not come from Intuit. The sender is not associated with Intuit, is not an authorized agent of Intuit, nor is their use of Intuit’s brands authorized by Intuit.” If you or someone you know does accidentally click on one of these links, they recommend:
Delete the download immediately
Scan your system using an up-to-date anti-virus program
Change your passwords
That’s all great advice, but wouldn’t it be simpler to prevent the damage from occurring in the first place? Having a structured security awareness training program strengthens the human firewall and can prevent attacks like these and even more sophisticated ones to come from being successful.
Not sure where to start? A free Phishing Risk Assessment is available for up to 100 employees here:
Find out where your company stands. After all your staff is being email phished by scammers every day.
Wouldn’t you like to know if they’re falling for any of them?
Stay safe out there.
-A