Government Scams: IRS Tax Refund Scams

Fake Government Agencies
IRS Tax Refund Scams - Fake Refund Email from the Internal Revenue Service
      United States Department of the Treasury

These tax refund scams are most common between January and May, before, during and after the filing date (April 15th), but the scammers still try them at other times of the year. Have you received an email from the IRS, telling you that "After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $___"; then  instructing you to "access your tax refund, click here"?

It is a scam.  The IRS will never, never email you unless you first contact them.  They WILL NOT EVER email you to tell you you owe money or are due to receive a refund; or for any other reason. Count on it.

And certainly, the IRS can spell "calculator" correctly.

Notice that the link does NOT go to the IRS, but instead to http://a1f2.com which is directed to woodbridge-mills.co.uk which is clearly operating a scam and a fraud. 


Sample Scam IRS Tax Refund Email:

January 28, 2008, CFR received the following email:

After the last annual fiscal activity we have determined that you are eligible to receive a tax refund. Please submit the tax refund request and allow us 6-9 days in order to process it.

To access the form for our tax refund calulator, please copy/paste in your browser the link bellow:

http://irs.gov.a1f2.com/refundtax/SearchTAX.php

Copyright 2008, Internal Revenue Service U.S.A.


Technical Investigation:

According to Whois.org, this website is owned by a Saudi, who appears to be behind the scam:

nesma4host
   mustafa hussam (info@nesma4host.com)
   +966.14163020
   Fax: +966.00966504461695
   ksa
   ulaya
   riyadh,  saudi arabia
   SA

Nesma4host

KSA, Ulaya
Riyadh,
SAUDI ARABIA
Phone: +966 14613352
info@nesma4host.com

Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com 

Expiration Date: 2008-11-29
Creation Date: 2005-11-29
Last Update Date: 2007-12-01

Name Servers:
    ns1.myrosy.com
    ns2.myrosy.com

The nameservers point to www.myrosy.com. This means that the server (computer) that is holding the website and putting it on the internet is owned by the people who run myrosy.com.

So now we examine myrosy.com. These scam-hosting servers are registered to another Saudi (so much for the Saudi's being friends of America!):

Registrant:
   myrosy.com Ramzi Shubbar
   Safwa
   Safwa, EP  31911
   SA

   Registrar: DOTREGISTRAR
   Domain Name: MYROSY.COM
      Created on: 02-APR-03
      Expires on: 02-APR-09
      Last Updated on: 26-JAN-08

   Administrative Contact:
      Shubbar, Ramzi  admin@myrosy.com 
      Safwa
      Safwa, EP  31911
      SA
      96638

   Technical Contact:
      , AlAli.Net  domain@alali.net
      ALALI.NET
      KFUPM 1684
      Dhahran, EP  31261
      Saudi Arabia
      96638602573
      96638602326

Another Whois service tells us that the IP address of the server that holds this website is: 207.150.179.44 which is hosted by

OrgName:    Sago Networks
OrgID:      SAGO
Address:    4465 W. Gandy Blvd
Address:    STE 800
City:       Tampa
StateProv:  FL
PostalCode: 33611
Country:    US

We have written to the hosting company and insisted that they take this site down.

UPDATE February 29, 2008: it appears that the scam pages are down - there is a generic set of ads appearing there now.


Recommendations:

If you receive a call from this number or any group that claims to represent a government agency, take down their information, including the contact's name, phone number, etc. Do NOT give them any personal or financial information, especially not a credit card, checking or bank account number, passport number, etc.

Next, look up the direct phone or email address for the agency they claim to represent and call them.  Read them the email and ask if it could have come from their agency.

While we don't want to encourage people to ignore correspondence from legal government agencies, it is a safe bet that NO U.S. government agency will make any first contact with you by email. Certainly not the FBI or IRS.

The IRS offers this advice:

If you receive an unsolicited e-mail purporting to be from the IRS, take the following steps:

  • Do not open any attachments to the e-mail, in case they contain malicious code that will infect your computer.
  • Contact the IRS at 1-800-829-1040 to determine whether the IRS is trying to contact you about a tax refund.

And please let us know about any suspicious calls or emails you receive.  We look for patterns so that we can alert the authorities and victims to new scams, before it is too late!


How to Report a Tax Refund Scam Email:

If you receive a suspicious e-mail that claims to come from the IRS,

  1. Forward it to the IRS (phishing@irs.gov and
  2. Send a copy to ConsumerFraudReporting.org (via the feedback form)
  3. Please notify the IC3 by filing a complaint at www.ic3.gov and

Follow instructions in the link below for sending the bogus e-mail to ensure that it retains critical elements found in the original e-mail. The IRS can use the information, URLs and links in the suspicious e-mails you send to trace the hosting Web site and alert authorities to help shut down the fraudulent sites. Unfortunately, due to the expected volume, the IRS will not be able to acknowledge receipt or respond to you.

In the United States, you may also contact:

U.S. Secret Service
Financial Crimes Division
1800 G Street, NW
Room 942
Washington, DC 20223

Phone: (202) 4355850

Fax: (202) 4355031

Or contact the local U.S. Secret Service Field Office.

Frequently Asked Questions - 1.13 IRS Procedures: Reporting Fraud

How to Report Abusive Tax Promotions and/or Promoters:
Complete the referral form  which documents the information necessary to report an abusive tax avoidance scheme. The form can be mailed or faxed to the IRS address and fax number on the form.

How to Report Abusive CPAs, Attorneys or Enrolled Agents:
Report suspicious actions by tax professionals to the email address  of the IRS Office of Professional Responsibility.

 

Overseas

Contact the Foreign Commercial Service (FSC) at the nearest U.S. Embassy or Consulate. If there is no FCS office, contact the American Citizens Services Unit of the Consular Section or the Regional Security Office.

For a comprehensive list of national and international agencies to report scams, see this page.

 


***  

Summer allergies  air filter