A new week, a new scam. Hackers are trying to take advantage of TurboTax customers who may already be worried about tax fraud after a scare last week.
TurboTax suspended electronic filing of state returns for about a day after there was a spike in reports of fraud. After investigating, the popular tax preparer said that it has not been breached itself, and began filing forms again Friday evening.
But there’s another issue.
On Monday parent company Intuit warned it has discovered three different email scams that are aimed at TurboTax customers.
The emails can look legitimate, but they’re not coming from TurboTax. One scam claims that someone has made three suspicious attempts to log into your TurboTax account. It provides a link where you must provide personal information before logging back into your account. The other scams also ask you to resubmit personal information before logging back into TurboTax.
Often the scam’ emails are coming from a mysterious email address. In these cases the messages came from kapuaponi@hawaiiantel.net, loer@gardener.com, and carden@ptd.net.
TurboTax says you should not respond to emails asking for account, password, banking, or credit card information.
These fake emails, known as phishing scams, are not new. Intuit has warned of nine since the beginning of the year. It had warned of six by this time last year.
Fraud is most likely to occur early on in tax season, before a lot of people have filed their tax returns.
TurboTax customers who believe they may have received a fake email, should forward the message to Intuit at spoof@intuit.com.
Meanwhile, some TurboTax users may still have to deal with the fallout of last week’s issue, when thousands of suspicious state tax returns were filed.
TurboTax has not said how many were flagged last week, but there was a significant spike. In Alabama, for example, 16,000 were deemed suspicious, while 17,000 were flagged during the entire tax season there last year. The state is now investigating how many of these are actually fraudulent.
TurboTax said its own system has not been breached, but that doesn’t help explain the spike. The reality is that there are plenty of places where criminals can get stolen personal information. And all you need to file a fake tax return is a name and Social Security number.
It happened to Ohio resident Ben Meddles. When he used TurboTax to file his tax return last week, it was rejected because someone else had already filed it, beating him to the punch.
Apparently that person asked that his refund be sent to a bank account in California, one that isn’t his. Meddles now has to file a police report, as well as forms with the FTC, IRS, and Attorney General’s office to straighten out the situation. He could be waiting for this tax refund for up to six months.