Fake Government Agencies
IRS Tax Refund Scams - Fake Refund Email from the Internal Revenue Service
United States
Department of the Treasury
These tax refund scams are most common between January and May, before,
during and after the filing date (April 15th), but the scammers still try them
at other times of the year. Have you received a email from the IRS, telling you that "After the last
annual calculations of your fiscal activity we have determined that you are
eligible to receive a tax refund of $___"; then instructing you to "access
your tax refund, click here"?
It is a scam. The IRS will never, never email you unless you first
contact them. They WILL NOT EVER email you to tell you you owe money or
are due to receive a refund; or for any other reason. Count on it.
And certainly, the IRS can spell "calculator" correctly.
Notice that the link does NOT go to the IRS, but instead to
http://a1f2.com which
is directed to woodbridge-mills.co.uk which is clearly operating a scam and a fraud.
Sample Scam IRS Tax Refund Email:
January 28, 2008, CFR received the following email:
After the last annual fiscal activity we have
determined that you are eligible to receive a tax refund. Please submit the
tax refund request and allow us 6-9 days in order to process it.
To access the form for our tax refund
calulator, please copy/paste
in your browser the link bellow:
http://irs.gov.a1f2.com/refundtax/SearchTAX.php
© Copyright 2008, Internal Revenue Service U.S.A.
Technical Investigation:
According to
Whois.org, this website is owned by a Saudi, who appears to be behind the
scam:
nesma4host
mustafa hussam (info@nesma4host.com)
+966.14163020
Fax: +966.00966504461695
ksa
ulaya
riyadh, saudi arabia
SA
Nesma4host
KSA, Ulaya
Riyadh,
SAUDI ARABIA
Phone: +966 14613352
info@nesma4host.com
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Expiration Date: 2008-11-29
Creation Date: 2005-11-29
Last Update Date: 2007-12-01
Name Servers:
ns1.myrosy.com
ns2.myrosy.com
The nameservers point to www.myrosy.com.
This means that the server (computer) that is holding the website and putting it
on the internet is owned by the people who run myrosy.com.
So now we examine myrosy.com. These scam-hosting servers are registered to
another Saudi (so much for the Saudi's being friends of America!):
Registrant:
myrosy.com Ramzi Shubbar
Safwa
Safwa, EP 31911
SA
Registrar: DOTREGISTRAR
Domain Name: MYROSY.COM
Created on: 02-APR-03
Expires on: 02-APR-09
Last Updated on: 26-JAN-08
Administrative Contact:
Shubbar, Ramzi admin@myrosy.com
Safwa
Safwa, EP 31911
SA
96638
Technical Contact:
, AlAli.Net domain@alali.net
ALALI.NET
KFUPM 1684
Dhahran, EP 31261
Saudi Arabia
96638602573
96638602326
Another Whois service tells
us that the IP address of the server that holds this website is:
207.150.179.44 which is hosted by
OrgName: Sago Networks
OrgID: SAGO
Address: 4465 W. Gandy Blvd
Address: STE 800
City: Tampa
StateProv: FL
PostalCode: 33611
Country: US
We have written to the hosting company and insisted that they take this site
down.
UPDATE February 29, 2008: it appears that the scam pages are down - there is
a generic set of ads appearing there now.
Recommendations:
If you receive a call from this number or any group that claims to represent
a government agency, take down their information, including
the contact's name, phone number, etc. Do NOT give them any personal or
financial information, especially not a credit card, checking or bank account
number, passport number, etc.
Next, look up the direct phone or email address for the agency they
claim to represent and call them. Read them the email and ask if it could
have come from their agency.
While we don't want to encourage people to ignore correspondence from legal
government agencies, it is a safe bet that NO U.S. government agency will make
any first contact with you by email. Certainly not the FBI or IRS.
The IRS
offers this advice:
If you receive an unsolicited e-mail purporting to be from the IRS, take the
following steps:
-
Do not open any attachments to the e-mail, in case they contain
malicious code that will infect your computer.
-
Contact the IRS at 1-800-829-1040 to determine whether the IRS is trying
to contact you about a tax refund.
And please let us know about any
suspicious calls or emails you receive. We look for patterns so that we
can alert the authorities and victims to new scams, before it is too late!
How to Report a Tax Refund Scam Email:
If you receive a suspicious e-mail that claims to come from the IRS,
- Forward it to the IRS
(phishing@irs.gov and
- Send a copy to ConsumerFraudReporting.org (via
the feedback form)
- Please notify the IC3 by filing a complaint at
www.ic3.gov
and
Follow instructions in the link below for sending the bogus e-mail to ensure
that it retains critical elements found in the original e-mail. The IRS can use
the information, URLs and links in the suspicious e-mails you send to trace the
hosting Web site and alert authorities to help shut down the fraudulent sites.
Unfortunately, due to the expected volume, the IRS will not be able to
acknowledge receipt or respond to you.
In the United States, you may also contact:
U.S. Secret Service
Financial Crimes Division
1800 G Street, NW
Room 942
Washington, DC 20223
Phone: (202) 435–5850
Fax: (202) 435–5031
Or contact the local U.S. Secret Service Field Office.
Frequently Asked Questions - 1.13
IRS Procedures: Reporting Fraud
How to Report Abusive Tax Promotions and/or Promoters:
Complete the
referral form which documents the information necessary to report an
abusive tax avoidance scheme. The form can be mailed or faxed to the IRS address
and fax number on the form.
How to Report Abusive CPAs, Attorneys or Enrolled Agents:
Report suspicious actions by tax professionals to the
email address of the IRS Office of
Professional Responsibility.
Overseas
Contact the Foreign Commercial Service (FSC) at the nearest U.S.
Embassy or Consulate. If there is no FCS office, contact the American Citizens
Services Unit of the Consular Section or the Regional Security Office.
For a comprehensive list
of national and international agencies to report scams, see this page.
***
| 
