IRS Impersonated in Identity Theft Scheme

March 23, 2021

IRS email impersonations are widespread across all industries. These attacks vary in scale and victim, targeting both individuals and companies as a whole. This particular attack follows the growing trend of utilizing social engineering strategies for malicious engagement, allowing attackers to easily bypass email security solutions that focus on link or attachment-based threat vectors.

Summary of Attack Target

  • Platform: Office 365
  • Victims: Employees
  • Payload: Link
  • Technique: Impersonation

Overview of the IRS Impersonation Attack

The attacker impersonates the IRS by crafting an automated email informing the applicant that they have been approved for the $1,400 stimulus payment. The email contains a link hidden embedded within the text that reads “Claim your refund now”.


By clicking on the link, the recipient is led to the attacker’s carefully crafted landing page. Here the recipient is prompted to fill out the form, which includes personal information like social security number, date of birth, gross annual income, driver's license number, and electronic filing PIN. With all this information, attackers have everything they need to commit identity fraud. And with an added field of gross annual income, they know which victims likely have the most money to steal.

This impersonation is especially convincing as the attacker’s landing page is identical to the IRS website, including the popup alert that states “THIS U.S. GOVERNMENT SYSTEM IS FOR AUTHORIZED USE ONLY,” a statement that also appears on the legitimate IRS website.

The attacker also attempts to conceal the URL in an effort not to alert the recipient that the link leads to a form hosted on an Amazon domain. If the information is added to the form, the attacker can commit identity theft, among other nefarious acts.

Why the IRS Impersonation Attack is Effective

It is likely that this attack bypassed email gateways because the existing gateways only take threat examples from ongoing and current attacks that are in high volume. Phishing attempts that utilize social engineering are much lower in volume, target specific persons, and are able to be hosted on domains that can be quickly taken down.

Abnormal was able to detect this attack by analyzing 42,804+ signals and this message received an attack score of 85 for a number of reasons. The first was the suspicious link embedded within the text of the email that led to the phishing page. Another signal was the unusual sender, as this email has never been seen sending to this particular organization. In addition to this, the language of the email was analyzed, and the Abnormal platform found suspicious financial vocabulary indicating a possible attempt to steal money from the recipient. As a result, this message is blocked before reaching end users.

To see how Abnormal can protect your employees from identity theft and other fraud, request a demo today.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 06 21 22 Threat Intel blog
Executives are no longer the go-to impersonated party in business email compromise (BEC) attacks. Now, threat actors are opting to impersonate vendors instead.
Read More
B 06 7 22 Disentangling ML Pipelines Blog
Learn how explicitly modeling dependencies in a machine learning pipeline can vastly reduce its complexity and make it behave like a tower of Legos: easy to change, and hard to break.
Read More
B 04 07 22 SEG
As enterprises across the world struggle to stop modern email attacks, it begs the question: how are these attacks evading traditional solutions like SEGs?
Read More
Enhanced Remediation Blog Cover
The most effective way to manage spam and graymail is to leverage a cloud-native, API-based architecture to understand identity, behavior, and content patterns.
Read More
B 05 16 22 VP of Recruiting
We are thrilled to announce the addition of Mary Price, our new Vice President of Talent. Mary will support our continued investment in the next generation of talent here at Abnormal.
Read More
B 06 01 22 Stripe Phishing
In this sophisticated credential phishing attack, the threat actor created a duplicate version of Stripe’s entire website.
Read More
B Podcast Engineering9
In episode 9 of Abnormal Engineering Stories, Dan sits down with Mukund Narasimhan to discuss his perspective on productionizing machine learning.
Read More
B 05 31 22 RSA Conference
Attending RSA Conference 2022? So is Abnormal! We’d love to see you at the event.
Read More
B 05 27 22 Active Ransomware Groups
Here’s an in-depth analysis of the 62 most prominent ransomware groups and their activities since January 2020.
Read More
B 05 24 22 ESI Season 1 Recap Blog
The first season of Enterprise Software Innovators (ESI) has come to a close. While the ESI team is hard at work on season two, here’s a recap of some season one highlights.
Read More
B 05 13 22 Hiring Experience
Abnormal Security is committed to offering an exceptional experience for candidates and employees. Hear about our recruiting and onboarding firsthand from three Abnormal employees.
Read More
B 05 11 22 Scaling Out Redis
As we’ve scaled our customer base, the size of our datasets has also grown. With our rapid expansion, we were on track to hit the data storage limit of our Redis server in two months, so we needed to figure out a way to scale beyond this—and fast!
Read More