>
The US Internal Revenue Service (IRS) is warning citizens that the number of SMS phishing attacks masquerading as the IRS has skyrocketed recently.
“So far in 2022, the IRS has identified and reported thousands of fraudulent domains linked to multiple MMS/SMS/SMS scams (known as smishing) targeting taxpayers,” the IRS said in a recent report. warning (opens in new tab).
“In recent months, and especially in recent weeks, IRS-themed smishing has increased exponentially.”
Industrial scale
The premise of such scams is simple: a threat actor will obtain a phone number from a US citizen, usually on the black market, and compose a text message claiming that the sender is the IRS, and that the recipient has unpaid bills, blocked bank accounts, possible legal problems or the like. The same text message will also contain a hyperlink, inviting the victim to click and either view the “accusations” or deal with the problem completely.
The link directs the victim to a specially designed landing page, designed to look exactly like pages from different banks, or something similar. There, the victim is enticed to share sensitive information, such as personally identifiable information or payment information.
“This is industrial-scale phishing, so thousands of people are at risk of receiving these scam messages,” the publication was quoted as saying by IRS Commissioner Chuck Rettig.
“In recent months, the IRS has reported multiple large-scale smishing campaigns delivering thousands — and even hundreds of thousands — of IRS-themed messages in hours or a few days, far more than previous activity levels.”
This isn’t the first time a threat actor has posed as US government agencies in phishing attacks. Last July, the Federal Communications Commission (FCC) was forced to issue a similar warning, informing thousands of Americans that someone was impersonating the FCC and going after their personal information.
As with emails from unknown senders, people should be extra careful when receiving text messages from people they don’t know, especially if those messages contain links and a sense of urgency.
Through: BleepingComputer (opens in new tab)