I just received two messages from the “Internal Revenue Service” sent to two different email addresses. I am going to get $109.30! The address in the From was “notice@irs.com” while the Reply-To was “no-reply@irss.com” To collect my refund, I go to “http://www.redalkemi.com/try/irs” At that page (on a server based in India) is hard coded the refund amount of $109.30 since I didn’t give any information to them to access my account. The messages were probably sent through infected Windows machines.
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of 109.30 .Please submit the tax refund request and allow us 6-9 days in order to process it.
You can apply for your refund online here.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline. Please be carefull when entering your data.
Regards,
Internal Revenue Service© Copyright 2007, Internal Revenue Service U.S.A..
How many ways did this scam get it wrong?
- No dollar sign in front of the refund amount
- No physical mailing address
- Only 6-9 days to process the refund. Is it even possible for the IRS to work that quickly?
- The IRS never makes notifications via email in the first place
- Typo, no space after a period at the end of a sentence
- Misspelling of careful
- Only go to irs.gov for IRS issues
Remember, never ever give out SS#, any kind of financial account information, or password/login information in response to an unsolicited email.
Whois info trace, leading to some big names who are being abused:
I got the same email today:
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of 109.30 .Please submit the tax refund request and allow us 6-9 days in order to process it.
You can apply for your refund online here.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline. Please be carefull when entering your data.
Regards,
Internal Revenue Service
© Copyright 2007, Internal Revenue Service U.S.A..
I forwarded the email to IRS’ phishing email: phishing@irs.gov
IRS Scam moved…
The IRS Scam I wrote about yesterday is on another server, now in South Africa: http://smtp1.cnwweb.co.za/~admin/irs/ . The from is now service@irs.com, and the reply-t…
Don’t accept email with SPF records saying not to. The DNS records for irss.com clearly state it will never send email.
It is trivial to forge email headers. That doesn’t mean the big names are being “abused” per se. It means you aren’t taking advantage of technological tools that exist to combat that abuse.
Thanks for this blog post, Mike. I just recieved two e-mails, similar to the one you posted, also from “Internal Revenue Service U. S. A.” There were dollar signs in front of my refund amount, but my turnaround time is only 2-3 days! (Amazing!) I became suspicious when I hovered my mouse over the web link in the e-mail. The address that came up was very definitely NOT http://www.irs.gov. Your post saved me from wondering if I really was throwing away money!
My irs refund offer is pretty close to the same. It is from Internal Revenue Service [service@irs.gov], but the response is
“To access the form for your tax refund, please click here”
and the please click here goes to http://kgb.paintball.spb.ru/install/what.php
“© Copyright 2007, Internal Revenue Service U.S.A. All rights reserved.”
The above is what raised a red flag for me. I’m no copyright lawyer, but it has been my understanding that the federal government does not hold copyrights!
I did not check the date on the IRS scam you speak off before I moved it to junk mail and reported it for phising. But, I did do a google search on the service at irs dot gov email address and came up with a multitude of information on the scam. Thank you all for your chiming in – this is a good service.
THIS IS THE EMAIL I JUST OPENED AND DID A GOOGLE SEARCH ON THE EMAIL ADDRESS AND CAME TO YOUR SITE. THANK GOODNESS! BUT APPARENTLY THE SCAMMERS ARE READING YOUR SITE TOO. THE $ SIGN IS NOW IN, ETC. READ ON.
Dear Applicant:
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund under section 501(c) (3) of the Internal Revenue Code. Tax refund value is $203.59.
Please submit the tax refund request and allow us 3-6 days in order to IWP the data received.
▪ If you distribute funds to other organization, your records must show wether they are exempt under section 497 (c) (15). In cases where the recipient org. is not exempt under section 497 (c) (15), you must have evidence the funds will
be used for section 497 (c) (15) purposes.
▪ If you distribute fund to individuals, you should keep case histories showing the recipient’s name and address; the purpose of the award; the maner of section; and the realtionship of the recipient to any of your officers, directors,
trustees, members, or major contributors.
To access the form for your tax refund, please click here
This notification has been sent by the Internal Revenue Service,
a bureau of the Department of the Treasury.
Sincerely Yours,
Director, Exempt. Organization
Rulings and Agreements Letter
Internal Revenue Service
——————————————————————————–
Note:
▪ If you received this message in your SPAM/BULK folder, that is because of the restrictions implemented by your ISP
▪ For security reasons, we will record your ip address, the date and time.
▪ Deliberate wrong imputs are criminally pursued and indicted.
© Copyright 2007, Internal Revenue Service U.S.A.
XIKMQVLWEMOZSXMWBIKXHZXXIUNORFPYKWBLVI
and by the way…notice all the spelling errors above!!!!
Thanks for sharing that one Ellyn. And also note the last line of random letters, that is probably a hash buster, to try to fool spam fighting systems.
They are getting better. This one even pulls an IRS graphic from: src=”http://www.irs.gov/irs/cda/common/images/irslogo.gif”>
After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a tax refund of $109.23.
Please submit the tax refund request and allow us 3-9 days in order to
process it.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here(src=”http://www.irs.gov/irs/cda/common/images/irslogo.gif”> )
Note: Deliberate wrong inputs will be prosecuted by law.
Regards,
Internal Revenue Service
© Copyright 2007, Internal Revenue Service U.S.A. All rights reserved.
——————————————————————————–
This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. If you are the intended recipient, please be advised that the content of this message is subject to access, review and disclosure by the sender’s Email System Administrator.
——————————————————————————–
I don’t use my Hotmail account for any business dealings. That’s how I know not to open anything from people like this, Ebay, etc.. And take a look at the spelling in the closing…
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $129.72.
Please submit the tax refund request and allow us 3-9 days in order to process it.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.
To access your tax refund, please click here
Best Regards,
Tax Refund Deparment
Internal Revenue Service
I received the one “notice@irs.gov” on 2/11/08. I have always been very careful to not send anything out on the internet. For some unknown reason, I did respond to this and provided the info requested. I have spent an entire week trying to cover my actions. I will always be looking over my back to see if someone has stolen my identify.
I also received this email. Google didn’t recognize this as spam until about 20 minutes later when an actual Google popup came up, and I also realized the page link wasn’t yellow (encrypted).
Link: http://www.demotoko.duitgoogle.com/pas.php?certegy_vm=trueportlet_change_1_actionOverrideFchaseonlineFchangeFsigninDetails_windowLabel_portlet_signin_pageLabel_page_signin
Due to my inability to determine the fact that the United States Treasury banners and website were fraudulent, I applied for my refund only to awaken to the fact that I had been wiped out. The scammers emptied my account and shut down the web site, never to be seen again. Thank heavens for my friendly banker, that took compassion and replaced our money, bounce fees, transfers and every penny we were robbed of. The only evidence of the scam was a withdrawl showing on my account in the name of WWW.BUY-SECURE.COM and some commentary bout “euro exchange” rates…………….
I received the email today with subject header “Tax Refund” from “Internal Revenue Service”
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $114.60. Please submit the tax refund request and allow us 6-9 days in order to process it.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here
Regards,
Internal Revenue Service
This is the one i received
We are pleased to inform you that upon reviewing your
fiscal activity, we have determined that you are eligible to
receive a tax refund of $439,54.
To access the online form for your tax refund, please click here
Your Individual Taxpayer Identification Number: *** ** ***
Because this letter could help resolve any questions regarding
your exempt status, you should keep it in your permanent
records.
If you distribute funds to other organizations, your records must
show whether they are exempt under section 497 (c) (12). In
cases where the recipient organization is not
exempt under section 497 (c) (12), you must have evidence the
funds will be used for section 497 (c) (12) purposes.
If you distribute fund to individuals, you should keep case
histories showing the recipient’s name and address; the
purpose of the award; the manner of section; and the
relationship of the recipient to any of your officers, directors,
trustees, members, or major contributors.
Sincerely,
Natasha Morgan
Director, Tax Refunds Department
(the *** ** *** was a ss # not matching my own) now why would they send this scam with a made up ss# obviously im gonna know whats up if it isn’t the right #
Another scam I came across yesterday was via Craigslist. A person selling his minivan, I replied to the ad asking for more pictures and his phone number so I can call and discuss…and the weirdest reply from the seller (aka fraudster), he sent pictures, did not give a phone number and proceeded to say he needed to sell it fast as he got transferred to Canada and that is why it is so cheap and that I needed to supply him my ebay userid so he could set up a sale via ebay!
My BS o’meter took off like a rocket as why in the world would he want my ebay userid as he could simply email me his ebay listing and I could bid on it or ‘buy it now’ AND he failed to include his phone number in his reply and in a second request I emailed him for his phone number.
Just an fyi – be alert if looking for a car online! Cheers, Tammy
This is what I got and when I clicked on it, every link in the irs.gov site came back to the info page. I thought it was real.
We are pleased to inform you that upon review of your fiscal activity we have determined that you are eligible to receive a tax refund of $949.30 under section 501 (c) (3) of the Internal Revenue Code. Please submit the tax refund request and allow us 3-6 days in order to process it.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
To access the online form for your tax refund, please access the IRS e-file form.
Note: For security reasons, we will record your ip-address, the date and time. Deliberate wrong inputs are criminally pursued and indicted.
Individual Taxpayer Identification Number: 346 66 2715
Because this letter could help resolve any questions regarding your exempt status, you should keep it in your permanent records.
If you distribute funds to other organizations, your records must show whether they are exempt under section 497 (c) (12). In cases where the recipient organization is not exempt under section 497 (c) (12), you must have evidence to prove that the funds will be used for section 497 (c) (12) purposes.
If you distribute funds to individuals, you should keep case histories showing the recipient’s name and address; the purpose of the award; the manner of section; and the relationship of the recipient to any of your officers, directors, trustees, members, or major contributors.
Sincerely,
David Morgan
Director, Tax Refunds Department
©2008 IRS (Internal Revenue Service)
Search News
IRS e-file notification refundThursday, September 18, 2008 7:06 PM
From: “Internal Revenue Service” Add sender to Contacts To: undisclosed-recipients
We are pleased to inform you that upon review of your fiscal activity we have determined that you are eligible to receive a tax refund of $949.30 under section 501 (c) (3) of the Internal Revenue Code. Please submit the tax refund request and allow us 3-6 days in order to process it.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
To access the online form for your tax refund, please access the IRS e-file form.
Note: For security reasons, we will record your ip-address, the date and time. Deliberate wrong inputs are criminally pursued and indicted.
Individual Taxpayer Identification Number: 346 66 2715
Because this letter could help resolve any questions regarding your exempt status, you should keep it in your permanent records.
If you distribute funds to other organizations, your records must show whether they are exempt under section 497 (c) (12). In cases where the recipient organization is not exempt under section 497 (c) (12), you must have evidence to prove that the funds will be used for section 497 (c) (12) purposes.
If you distribute funds to individuals, you should keep case histories showing the recipient’s name and address; the purpose of the award; the manner of section; and the relationship of the recipient to any of your officers, directors, trustees, m
David Morgan
Director, Tax Refunds Department
©2008 IRS (Internal Revenue Service)
I got this email today, I’m so glad I googled it before I got scammed into it! Thank you so much!
After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a tax refund of $620.50.
Please submit the tax refund request and allow us 3-6 days in order to
process it.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here
Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.
Regards,
Internal Revenue Service
Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.
I would like to inform you that there is complain about www.buy-secure.com whom I made the payment for some items in July 2008 since than I did not recieved the items and no more corespondance since than I would like to contact but unsucssesfull .
Hey i got something Similar, funny thing is why would i be getting a stimulus check when i’m not even a US Citizen/resident. I live in Australia. this is the email I recieved today….
From: Internal Revenue Service
Date: 11/07/08 03:02:48
To: undisclosed-recipients:,
Subject: IRS Notification – Stimulus refund
The Secure Way to Receive Your Stimulus Payment
After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a Stimulus Payment.
Please submit the Stimulus Payment Online Form in order to process it.
A Stimulus Payment can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.
To access the form for your Stimulus Payment, please click here
Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.
Regards,
Internal Revenue Service
Copyright 2008, Internal Revenue Service U.S.A. All rights reserved. .