IRS Impersonated in Identity Theft Campaign

December 16, 2020

Although tax season has passed, IRS impersonation scams persist, putting many Americans at risk for identity theft and payment fraud. In this attack, scammers impersonate the IRS by sending out a fake tax form to collect valuable personal and financial information.

Summary of Attack Target

  • Platform: G Suite
  • Victims: VIP and Executives
  • Payload: Attachment / Fax Number
  • Technique: Spoofing / Impersonation

What was the attack?

This email attempts to steal information that could lead to identity theft, claiming that the recipient is a non-resident alien and telling them to fill out a W-8BEN tax exemption form to protect their status. The email instructs the recipient to fill out the provided form in order to maintain their non-resident tax exemption status.

Although this seems to only target non-resident aliens, the email widens its vulnerable audience by specifying that if the recipient is in fact a US citizen, they must indicate so on the form and still complete the form. The attack concludes by instructing the recipient to fax the form, along with a copy of their passport, to the provided fax number. Further investigation reveals that this is a known IRS scam number used to steal valuable information from unsuspecting taxpayers.

While the attached PDF looks legitimate, when compared to the W-8BEN tax form available for download on the IRS website, we see that the form in this email asks for much more personal information, like passport number and bank account details.

Even though the email appears to originate from “”, which is a registered domain for the IRS, further analysis reveals that this email is actually spoofed—authentication fails for this message and the true sender domain is “” This is a Chinese registered domain that has no relation to the IRS.

Should the target bypass this and send the completed form and specified materials, they would release extremely sensitive information that could ultimately lead to identity theft. Additionally, the tax form asks for bank account information which, if filled out, would compromise the account of the victim and possibly lead to financial loss.

Why the IRS Scam is Effective

The email specifies that the recipient must fill out and return the form, along with a passport copy, within seven days in order to rectify their status. This motivates the recipient to act quickly so that, in their haste, they will spend less time assessing the legitimacy of the email. Additionally, the attack contains a PDF attachment that appears inconspicuous, as it does not contain malware or suspicious links that traditional email security platforms would flag.

The attacker uses professional language and a spoofed “” domain to craft a credible impersonation of the IRS. In addition, the attached form looks very similar to the actual W-8BEN tax form. If one does not investigate closely enough, they might not detect the added malicious fields.

Abnormal is able to detect this attack due to the usual sender, the language that is used to steal personal information, and the fact that the sender domain does not match any domains found within the body.

IRS email scams have been around for many years and do not show any sign of relenting. Although the IRS warns on their website that they will never ask for personal tax information via email, these scams continue to defraud taxpayers across all industries.

To see how Abnormal can protect you and your employees from identity theft, request a demo today.

Blog black clock
For SOC analysts, managing an employee-reported phishing mailbox can be a double-edged sword. On one hand, legacy tools have made it easy for employees to report would-be business email compromise (BEC) and credential phishing emails. On the other hand...
Read More
Blog white lines
Threat researchers at Abnormal Security recently discovered a coordinated spear-phishing campaign targeting numerous enterprise organizations. The attackers compromised hundreds of legitimate accounts and are sending emails...
Read More

Related Posts

Blog hiring cybersecurity leaders
As with every equation, there are always two sides and while it can be easy to blame users when they fall victim to scams and attacks, we also need to examine how we build and staff security teams.
Read More
Cover automated ato
With an increase in threat actor attention toward compromising accounts, Abnormal is focused on protecting our customers from this potentially high-profile threat. We are pleased to announce that our new Automated Account Takeover (ATO) Remediation functionality is available.
Read More
Email spoofing cover
Email spoofing is a common form of phishing attack designed to make the recipient believe that the message originates from a trusted source. A spoofed email is more than just a nuisance—it’s a malicious communication that poses a significant security threat.
Read More
Cover cybersecurity month kickoff
It’s time to turn the page on the calendar, and we are finally in October—the one month of the year when the spooky becomes reality. October is a unique juncture in the year as most companies are making the mad dash to year-end...
Read More
Ices announcement cover
Abnormal ICES offers all-in-one email security, delivering a precise approach to combat the full spectrum of email-borne threats. Powered by behavioral AI technology and deeply integrated with Microsoft 365...
Read More
Account takeover cover
Account takeovers are one of the biggest threats facing organizations of all sizes. They happen when cybercriminals gain legitimate login credentials and then use those credentials to send more attacks, acting like the person...
Read More
Blog podcast green cover
Many companies aspire to be customer-centric, but few find a way to operationalize customer-centricity into their team’s culture. As a 3x SaaS startup founder, most recently at Orum, and a veteran of Facebook and Palantir, Ayush Sood...
Read More
Blog attack atlassian cover
Credential phishing links are most commonly sent by email, and they typically lead to a website that is designed to look like common applications—most notably Microsoft Office 365, Google, Amazon, or other well-known...
Read More
Blog podcast purple cover
Working at hyper-growth startups usually means that unreasonable expectations will be thrust on individuals and teams. Demanding timelines, goals, and expectations can lead to high pressure, stress, accountability, and ultimately, extraordinary growth and achievements.
Read More
Blog yellow skyline
No one wants to receive an email from human resources that they aren’t expecting. After all, that usually means bad news. And when we think there may be bad news, cybersecurity training tends to fall by the wayside. Threat actors know this, and they’re taking advantage of human emotions.
Read More
Blog rising building
There is little doubt that business email compromise and other advanced email threats are causing significant damage–both financial and reputational—to organizations worldwide. Because these never-before-seen attacks contain few indicators of compromise, they evade secure email gateways and other traditional email infrastructure...
Read More
Blog purple person outline
Identity theft is not a joke, impacting more than 14 million people each year in the United States alone. Over the course of their lifetime, nearly one-third of all people will become victims of identity theft—often as a result of a corporate data breach. Once attackers have access to identifying information like your full name, address, date of birth, and/or social security number...
Read More