Open season on tax-payers

As any reader of this blog knows, cybercriminals can steal your money not just by putting malware on your machine, but by phishing attacks too. Phishing attacks don’t just target online banking and e-payment systems, but almost any site which asks the user to input sensitive data.

Sites run by national government agencies are a prime example as they often demand a wealth of personal information which goes far beyond a simple user name or account number + PIN. While filling in a tax return online might seem like a great way to save time and paper, it gives cybercriminals a great opportunity to scoop all your details at once – data which could then be used to steal your identity and/or commit further crimes in your name.

We came across one such phishing site recently. Now that 2010 is in full swing, U.S. tax payers can start submitting their tax returns for 2009. (Although the final deadline for submission isn’t until April 15th, the earlier you submit your paperwork, the earlier you’ll receive any rebate due.) And for added convenience, you can do this online, via the official IRS site.

The cybercriminals haven’t missed a trick here: the phishing site is an alarmingly accurate copy of the original, with even the Acrobat Reader toolbar being neatly copied.

It’s likely that there will be an increase in such sites as the deadline for submitting tax returns gets closer. So as always, be on your guard – with attacks like this you could lose far more than your credit card number, which can be easily blocked – and make sure you always check the full address of the site that you’re on, to be sure it’s genuine.