Tax Preparer Phishing Stole Data From 800 US Customers

A phishing operation targeting U.S. tax preparation businesses exposed tax and personal information belonging to at least 800 customers. The stolen data was later used to seek fraudulent tax refunds and government loans, showing why households should take any security notice from a tax preparer seriously.

What happened

A Nigerian national received an eight-year prison sentence for participating in phishing and fraud schemes, according to BleepingComputer. The attacks targeted tax preparation businesses in New York, Texas and other states between 2019 and 2021.

The attackers used carefully targeted phishing messages to gain unauthorized access to business computers. They then stole customers’ tax records and personally identifiable information.

The group used that information to file fraudulent applications with the IRS, state tax agencies and the Small Business Administration. According to BleepingComputer, the defendant and his associates obtained about $2.5 million in fraudulent tax refunds after requesting $8.4 million. They also collected another $819,000 through fraudulent Economic Injury Disaster Loan applications.

The defendant was also linked to a separate fake investment operation. A court ordered him to pay $3.6 million in restitution and forfeit nearly $11 million, in addition to serving one year of supervised release after prison.

Who is affected

At least 800 customers had tax or personal information stolen from the compromised tax preparation businesses, BleepingComputer reported. The source does not identify the affected firms, list every state involved or describe exactly which data fields were taken from each customer.

The reported intrusions happened from 2019 through 2021, but the sentencing brings renewed attention to information previously stolen from tax offices. Anyone who used a tax preparer during that period should review old breach notices and ask the firm whether their records were involved. A lack of public company names means households cannot determine exposure from the report alone.

What to do now

1. Contact your current or former tax preparer using the phone number on its official website or a previous tax document. Ask whether the business was involved, what information was exposed and when it notified customers.

2. Review tax-agency letters and account activity for refunds, returns or applications you do not recognize. Keep copies of anything suspicious and contact the agency through contact information on its official government website.

3. Check bank, credit-card and loan statements for accounts or transactions you did not authorize. Use the institution’s app or website to open its Security, Dispute or Report fraud section.

4. Change the password for your tax-preparation account if it is still active. In the account’s Security or Sign-in settings, choose a new password that you do not use anywhere else and turn on multi-factor authentication if the service offers it.

5. Ask the tax preparer for written confirmation of the incident and the specific records affected. Save that response with your tax documents so you have a record if fraudulent activity appears later.

6. Be cautious with unexpected messages claiming to offer refunds, tax help or breach assistance. Do not open their links; instead, navigate directly to the tax preparer’s or government agency’s official website.