How Cybercriminals Are Exploiting Technology to Scam Taxpayers

In an era where artificial intelligence (AI) is revolutionizing industries across the board, cybercriminals are not far behind in leveraging this powerful technology for nefarious purposes. The landscape of tax fraud and Internal Revenue Service (IRS) scams is undergoing a dramatic transformation, with AI at the forefront of this criminal evolution.

The Rise of AI-Powered Phishing Attacks

The past few years have witnessed an explosion of AI-enhanced phishing attacks, marking a new era in the world of cybercrime. These attacks are characterized by their unprecedented level of sophistication and personalization, making them increasingly difficult to detect.

One of the most prevalent forms of these attacks involves hyper-realistic phishing emails. Cybercriminals are using AI to craft messages that convincingly impersonate the IRS, tax professionals or financial institutions. These emails are often so well-crafted that even seasoned professionals can be fooled.

Perhaps even more alarming is the rise of deepfake voice calls, also known as vishing (voice phishing). In these scenarios, threat actors employ advanced voice synthesizers and AI-generated cloned voices to mimic IRS agents or company executives. These realistic voice impersonations are used to pressure victims into making urgent tax payments or divulging sensitive information.

Looking ahead, experts predict a surge in the use of AI agents and chatbots to facilitate scams. Within the next two to three years, we can expect to see fraudulent chatbots convincingly impersonate IRS support agents, leading unsuspecting victims to submit personal and financial data.

AI-Automated Tax Fraud and Identity Theft

Beyond phishing, AI is being employed to automate and scale up tax fraud and identity theft operations. Attackers are using AI to generate thousands of fraudulent tax returns and other IRS filings. These operations often utilize stolen Social Security numbers purchased from dark web marketplaces, combined with AI-synthesized personal details, to create convincing fake submissions.

AI is also being leveraged for dark web data mining. Threat actors use AI algorithms to rapidly analyze and correlate stolen tax data available on illicit online marketplaces. This allows them to build more comprehensive profiles of potential victims and create more convincing fraudulent identities.

Taking this a step further, foreign adversaries and organized crime groups are engaging in synthetic identity fraud. This advanced technique involves using AI to create entirely fake taxpayer profiles by mixing real and fabricated data. These synthetic identities are then used to exploit the IRS refund system, generate fake invoices and create fraudulent W-9 forms to reroute company tax refunds to criminal-controlled accounts.

Corporate Defense Strategies

To combat these evolving threats, corporations must adopt a multi-layered defense strategy. Employee awareness and training are crucial, as educating staff on AI-driven scams can significantly reduce the risk of successful attacks. Implementing AI-based fraud detection systems is also vital, as these can identify anomalies in tax forms and filings that might otherwise go unnoticed. Additionally, securing IRS and tax service logins with multi-factor authentication (MFA) can prevent credential stuffing attacks. Implementing strict verification procedures for financial approvals ensures any suspicious transactions are flagged and reviewed. Lastly, monitoring the dark web for compromised company data can provide early warnings of potential threats.

Individual Protection Measures

Individuals can also take proactive steps to safeguard their personal and financial data. Regular credit monitoring is essential to detect any unauthorized activity, and considering a credit freeze can provide an additional layer of protection. When preparing taxes, it’s important to use verified tax form software that is approved by the IRS. Filing electronically and using the IRS Identity Protection PIN (IP PIN) adds an extra layer of security to prevent identity theft. By taking these measures, individuals can significantly reduce their risk of falling victim to AI-powered scams.

Verification and Reporting

When in doubt, always verify IRS communications by calling the official IRS contact number. Never use contact information provided in suspicious emails or voice messages. Report any phishing attempts to the IRS at phishing@irs.gov.

For broader cybercrime issues, individuals and businesses should report suspicious activity to the FBI’s Internet Crime Complaint Center at IC3.gov.

The Future of Tax Security

The rapid evolution of AI-powered tax scams and identity theft presents a significant challenge to taxpayers, businesses and law enforcement alike. However, by staying informed, implementing robust security measures and remaining vigilant, we can collectively work to mitigate these threats. As AI continues to advance, so too must our defenses. The key lies in proactive security measures, ongoing education and prompt reporting of suspicious activities. In this day and age, protecting our personal and financial data is not just a recommendation — it’s a necessity.