The Internal Revenue Service (IRS) warned US citizens on Wednesday of a significant rise in texting scams designed to steal personal and financial information.
The agency identified thousands of fraudulent domains used in SMS phishing (smishing) attacks. These attacks have increased ‘exponentially’ in recent months, especially over the past few weeks.
The scam messages often look like they came from the IRS, and advertise fake COVID relief, tax credits, or instructions on how to set up an IRS account.
Some scam messages also ask taxpayers to click a link where phishing websites will attempt to steal their information or unleash malware onto their devices.
The IRS “does not send emails or text messages asking for personal or financial information or account numbers,” the agency said, adding that such messages “should all be red flags for taxpayers.”
Threat actors have used increasingly more advanced methods to cast a wide net and find more victims. One tactic involves using algorithms to automatically generate thousands of fraudulent domains. A recent campaign, for example, used around three dozen email addresses to create over 1,000 fraudulent domains, the service said.
“This is phishing on an industrial scale so thousands of people can be at risk of receiving these scam messages,” said IRS Commissioner Chuck Rettig in a statement on Wednesday.
“Particularly in these cases, the best offense is a good defense,” Rettig added in his statement. “Taxpayers and tax pros need to remain constantly vigilant with suspicious IRS-related emails and text messages. And if you get one, sending the IRS important details from the text can help us disrupt the scams and protect others.”
Taxpayers are urged by the agency to report any smishing scams to phishing@irs.gov. Doing this allows the IRS to report these scams to the appropriate service providers for action, helping to protect other taxpayers who might have received a variant of the same scam.