IRS Impersonated in Identity Theft Scheme

March 23, 2021

IRS email impersonations are widespread across all industries. These attacks vary in scale and victim, targeting both individuals and companies as a whole. This particular attack follows the growing trend of utilizing social engineering strategies for malicious engagement, allowing attackers to easily bypass email security solutions that focus on link or attachment-based threat vectors.

Summary of Attack Target

  • Platform: Office 365
  • Victims: Employees
  • Payload: Link
  • Technique: Impersonation

Overview of the IRS Impersonation Attack

The attacker impersonates the IRS by crafting an automated email informing the applicant that they have been approved for the $1,400 stimulus payment. The email contains a link hidden embedded within the text that reads “Claim your refund now”.

By clicking on the link, the recipient is led to the attacker’s carefully crafted landing page. Here the recipient is prompted to fill out the form, which includes personal information like social security number, date of birth, gross annual income, driver's license number, and electronic filing PIN. With all this information, attackers have everything they need to commit identity fraud. And with an added field of gross annual income, they know which victims likely have the most money to steal.

This impersonation is especially convincing as the attacker’s landing page is identical to the IRS website, including the popup alert that states “THIS U.S. GOVERNMENT SYSTEM IS FOR AUTHORIZED USE ONLY,” a statement that also appears on the legitimate IRS website.

The attacker also attempts to conceal the URL in an effort not to alert the recipient that the link leads to a form hosted on an Amazon domain. If the information is added to the form, the attacker can commit identity theft, among other nefarious acts.

Why the IRS Impersonation Attack is Effective

It is likely that this attack bypassed email gateways because the existing gateways only take threat examples from ongoing and current attacks that are in high volume. Phishing attempts that utilize social engineering are much lower in volume, target specific persons, and are able to be hosted on domains that can be quickly taken down.

Abnormal was able to detect this attack by analyzing 42,804+ signals and this message received an attack score of 85 for a number of reasons. The first was the suspicious link embedded within the text of the email that led to the phishing page. Another signal was the unusual sender, as this email has never been seen sending to this particular organization. In addition to this, the language of the email was analyzed, and the Abnormal platform found suspicious financial vocabulary indicating a possible attempt to steal money from the recipient. As a result, this message is blocked before reaching end users.

To see how Abnormal can protect your employees from identity theft and other fraud, request a demo today.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More
B Podcast Engineering8
In episode 8 of Abnormal Engineering Stories, Kevin interviews Saminda Wijegunawardena, an engineering leader who is no stranger to fast-growing enterprise startups.
Read More
B 04 04 22 Webinar Recap Krebs
High-impact emails are on the rise and secure email gateways (SEGs) don’t have the functionality to mitigate them. Learn how your SEG is letting you down.
Read More
B 04 19 22 Facebook Phishing
While phishing emails have long been a popular way to steal Facebook login credentials, we’ve recently seen an increase in more sophisticated phishing attacks.
Read More