As December rolls in and the holiday spirit takes over, another season looms on the horizon—tax season. Along with it comes an increase in cybercrime, as scammers gear up to exploit businesses, tax professionals, and individual taxpayers. In anticipation of this, the IRS is hosting its 4th annual National Tax Security Awareness Week to raise awareness about identity theft and help people protect their personal and financial data during this critical period.
Cybercriminals are becoming more sophisticated, and data theft is on the rise, particularly targeting small businesses and tax preparers. According to the IRS, thousands of tax firms have reported data theft cases during recent tax seasons. In light of these growing threats, it’s more important than ever for businesses to update their cybersecurity measures and for individuals to stay vigilant. Below are five of the most common holiday tax scams to be aware of as we approach the 2025 tax season.
1. W-2 Scams (Phishing for Employee Data)
One of the biggest threats that companies face during tax season is the W-2 phishing scam. Cybercriminals typically impersonate a company executive, sending an email to HR or accounting personnel, requesting copies of employee W-2 forms. The email is often phrased in a formal and polite tone to avoid raising suspicion. Once the employee complies, the scammers gain access to sensitive tax information for the entire staff, which they can use for identity theft or file fraudulent tax returns.
How to Protect Yourself
To combat these social engineering scams, companies should implement strong email filtering tools and train their employees to recognize phishing attempts. Make sure your HR and accounting teams are aware of how to verify such requests and flag any suspicious emails.
2. Locked Accounts & Fake Account Notices
Another growing threat involves cybercriminals impersonating tax services like TurboTax or the IRS, claiming that a user’s account has been locked due to suspicious activity. These emails often contain links to fake websites that ask for personal login information. Once scammers have access to these accounts, they can use the information to commit tax fraud or identity theft.
How to Protect Yourself
Always enable multi-factor authentication (MFA) for any financial accounts, and never click on links or provide personal information in unsolicited emails. Instead, visit the official website directly and log in through a secure, bookmarked link to avoid third party risks.
3. Tax Information Update Scams
These scams involve phishing emails that ask taxpayers to update their tax information due to the upcoming tax season. Typically, the email contains a link that directs users to a fraudulent website where they’re asked to input their personal details such as their social security, making them vulnerable to identity theft.
How to Protect Yourself
Never respond to unsolicited emails that ask for sensitive information. Always verify any requests for tax updates by directly contacting your tax service provider, the IRS or the AICPA.
4. Fake Refund Scams (Email & Text Phishing)
One of the most enticing scams for individuals and businesses alike involves promises of fake tax refunds. Scammers send emails or texts claiming that the recipient is owed a refund and provide a link to collect the funds. However, this link typically leads to a fake website designed to harvest personal and financial details.
Here are some more details about these Man-in-the-Middle attacks.
How to Protect Yourself
The IRS will never send an email or text about a refund or federal return. Always verify such claims by directly visiting the official IRS website. Avoid clicking any links in unsolicited communications regarding refunds.
5. Holiday Shopping Scams (Spear Phishing)
The holiday season is prime time for spear phishing attacks, especially for employees who are eager to get their holiday shopping done. Cybercriminals often send highly targeted phishing emails that appear to come from trusted online retailers, using information gathered from the victim’s online activities and social media. The goal is to steal personal information or gain access to company data through compromised email accounts.
How to Protect Yourself
To reduce risk, always use work email strictly for professional communications and avoid using it for personal shopping or subscriptions. Consider using a separate, dedicated browser for financial transactions and shopping as part of your cybersecurity mesh strategy.
Emerging Tax Scams to Watch for in 2025
As we head into 2025, scammers continue to evolve their tactics. One of the newest trends involves using AI-generated phishing emails that are more difficult to detect. These scams can mimic IRS communication, sending extremely realistic fake IRS forms or helpline numbers that lure victims into providing sensitive information.
Additionally, ransomware attacks targeting tax professionals and accounting firms have become more prevalent. Cybercriminals are increasingly focusing on these firms to gain access to large amounts of taxpayer data, which can be held for ransom. So it’s crucial for businesses to leverage reputable and agile cloud accounting tools to assist with automation, while also keeping data secure.
Additional Tips for Businesses and Individuals
To protect your data during the 2025 tax season:
- Use AI-based cybersecurity tools to detect phishing attempts before they reach your inbox.
- Regularly update firewalls and antivirus software to stay protected from evolving threats.
- Ensure that all tax-related communications are encrypted and secured with MFA.
- Encourage employees to avoid using work emails for personal matters, as this can open the door to phishing attacks.
For businesses, it’s critical to work with cybersecurity experts to assess vulnerabilities and ensure sensitive tax data and social security numbers are protected. Implementing strong cybersecurity measures, including email monitoring and filtering, can significantly reduce the risk of falling victim to scams.
Deck the Halls with Cyber Walls
The holidays and tax season can be stressful times, but by staying aware of these common scams and implementing strong security practices, you can protect yourself and your business from tax-related identity theft and data breaches.
Contact Nerds Support to implement tax cybersecurity measures that will protect your business from scams and ensure your sensitive data stays secure throughout the holiday and tax season. Our expert team is here to help you safeguard your company against the evolving threats of 2025.
