IRD warns of fake tax email

Phishing scams, hijacking of TM accounts, keyloggers and all manner of other nasties. This is the place to report them and get help if you've been hit.
User avatar
Rob@BNZFraud
Members
Posts: 5
Joined: Thu Dec 30, 2010 9:19 pm
First Name: Rob

Re: IRD warns of fake tax email

Post by Rob@BNZFraud » Mon Jan 24, 2011 1:37 am

Grrr, why must they make it so difficult to protect our cardholders! Thanks again for your great work, hopefully I'll get enough time to delve further into this. Wellington Anniversary weekend and my workload triples.

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: IRD warns of fake tax email

Post by Foggyone » Thu Jan 27, 2011 10:22 pm

Doing the rounds again.

Uses an html attachment which points to http://kxn1s.com/" onclick="window.open(this.href);return false; .

BNZ advised
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
digidog
Site Admin
Posts: 15014
Joined: Wed May 05, 2004 2:25 am
First Name: Alfie
Location: Otago
Contact:

Post by digidog » Thu Jan 27, 2011 10:45 pm

That domain is so fresh it was only registered today. Naturally registrant details
are concealed - in this case by myprivateregistration.com - which appears to be
owned (oddly enough) by Melbourne IT.

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: IRD warns of fake tax email

Post by Foggyone » Fri Jan 28, 2011 12:13 am

This code included on the bottom of the page

Code: Select all

<script language="JavaScript" src="http://l.yimg.com/d/lib/smb/js/hosting/cp/js_source/whv2_001.js"></script><script language="javascript">geovisit();</script><noscript><img src="http://visit.webhosting.yahoo.com/visit.gif?us1296173410" alt="setstats" border="0" width="1" height="1"></noscript>
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
dobby
Members
Posts: 3336
Joined: Wed Apr 05, 2006 7:48 am
First Name: Dobby
Location: Wellington

Re: IRD warns of fake tax email

Post by dobby » Sun Jan 30, 2011 6:27 pm

Woman loses $32,000 in 'tax refund' scam
Last updated 05:00 31/01/2011
A Southland woman has been swindled out of $32,000 after falling prey to an India-based scam.

The woman, who did not want to be named, said she had been left embarrassed, furious and felt betrayed after finally realising what she believed was a tax refund was nothing more than trickery.

It began early this month with a phone call telling her she had overpaid tax, but to get it she needed to transfer money to an account through the Western Credit Union.

The man who called sounded convincing and said he was from the Justice Department, she said. "I had no reason to be suspicious."

The first payment was for $290, gradually increasing, with the pot at the end of the rainbow also increasing to a $71,000 refund.

Twenty payments were made to the scammers with all the money going overseas to India, the woman said.

Three different people had called her saying they were from the Reserve Bank and a "government department".

She had no idea how they got her details and they rang her landline and her cellphone.

The woman knew some would think she was foolish to have paid anything and she certainly felt that way now, she said. "It's a horrible feeling, I am just gutted. I should have asked for evidence."

It took the woman's children to rouse suspicion which led to the end of the scam.

Her daughter overheard her on the phone to one of the scammers and asked what she was making the payments for.

They contacted the Reserve Bank which said it was a scam and to stop the payments.

It even got to the point that one of her daughters invoked power of attorney, cancelling her mother's credit cards and withdrawing funds leaving just enough so she could buy groceries.

"Which was a horribly difficult thing to do. I've had sleepless nights over this whole thing," the daughter said.

It was on Friday that the realisation sunk in that she had lost $32,000 and wouldn't see a cent of it again, leaving her stunned.

But on Saturday another man called asking why she did not make the last payment.

Although entitled to say something stronger, she told him they weren't getting any more money.

"Obviously I feel stupid but I had no reason not to believe them. I suppose I'm too trusting."

Senior Sergeant Dave Raynes, of Invercargill, said the woman was not alone as the target of an increasing numbers of scams.

It appeared the scam that the woman fell for was the same as one that was rampant in the south last year, when complaints to police peaked at 30 a week.

People needed to be on guard at all times to protect their personal information, because if the scam was offshore, police could do little about it, he said.
Ad Feedback

Phone numbers, bank details, even dates of birth could be all that scammers needed, he said.

He believed technology, information sharing and cheap phonecalls were the most likely causes of the spike in scams circulating in the past few years.

The audacity of the scammers meant even police were sometimes targeted, he said.

The message to everyone was if it seemed too good to be true it probably was, Mr Raynes said.

http://www.stuff.co.nz/national/crime/4 ... efund-scam" onclick="window.open(this.href);return false;
Idealism increases in direct proportion to your distance from the problem.

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: IRD warns of fake tax email

Post by Foggyone » Sun Jan 30, 2011 6:47 pm

Dobby wrote:She had no idea how they got her details and they rang her landline and her cellphone.
It's known as identity theft, and is one of the biggest crimes that the internet is used for.
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
rusticdog
Members
Posts: 147
Joined: Thu Aug 03, 2006 3:34 am
Location: Christchurch
Contact:

Re: IRD warns of fake tax email

Post by rusticdog » Mon Jan 31, 2011 1:38 am

Ouch, considering the $290 was the first payment amount, 32k is a big hit.


It is disappointing though to read in the article...
The man who called sounded convincing and said he was from the Justice Department, she said. "I had no reason to be suspicious."
"Obviously I feel stupid but I had no reason not to believe them. I suppose I'm too trusting."

There were some big red flags in this, really really big red flags, with flashing red neon lights....and dancing girls....I wonder if it's worth adapting ScamChecker for these kinds of things, specifically for NZ, actually I'll start a new thread [edit: here http://scambusters.co.nz/forum/viewtopic.php?f=9&t=5854" onclick="window.open(this.href);return false; ] about that so I don't go off topic :)

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: IRD warns of fake tax email

Post by Foggyone » Mon Mar 21, 2011 5:57 pm

Using HTML attachments, something that was commented on in this thread some time ago, has now apparently reached the radar of the journalists who write about security, scams etc.

Phishing HTML attachments bypass browser detection Posted on 17 March 2011.

Good to see the journos are finally catching up to the old news
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

The Latest

Post by Foggyone » Mon Jun 20, 2011 11:27 pm

Couple lose hundreds of thousands in scam
In the incident last Wednesday, Detective Sergeant Dave Grace of the Waikato police fraud squad said a 'well spoken' Indian man called the couple claiming to be from Inland Revenue.

Police would not confirm details but said victims were often told they had been overtaxed, were due a refund and asked to wire money to an offshore account via Western Union.
For further information visit The Ministry of Consumer Affairs website.

It's just another example of the long running and wildly popular Nigerian scam.
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

A Correspondent Writes

Post by Foggyone » Mon Aug 22, 2011 8:07 am

Doesn’t look right to me   wnxtkh@company.info and not addressed to anyone??????
 
 
From: customer.service@ird.govt.nz [mailto:]
Sent: Monday, 22 August 2011 2:37 p.m.
To: admin@online-ird.govt.nz
Subject: Inland Revenue - GST return (GST101)
 
Dear valued member,
 
After the last annual calculations of your fiscal activity, we have determined that you
are eligible to receive a tax refund of 54.90 NZ Dollars. Please submit the tax refund
request and allow us 2-3 days in order to process it.
Click link below to submit your tax refund request.

Care - Live Phishing Address 
www.ird.govt.nz/income-tax-individual/r ... port/help/
 
 
Note : A refund can be delayed a variety of reasons, for example submitting invalid
records or applying after deadline.
 
Inland Revenue
PO Box 39050
Wellington Mail Centre
Lower Hutt 5045
Standard phish seeking cc or debit card details together with drivers licence.

The details are being aggregated to a file at http://65.60.241.121/online-nz-update-c ... gov/nz.txt" onclick="window.open(this.href);return false;.
I see quite a few have been caught. Donald Duck is me!

Advised BNZ who will act accordingly. Rob is not on duty at present!!!!!!

Only one respondent in my free calling area. I have alerted him.
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
Rob@BNZFraud
Members
Posts: 5
Joined: Thu Dec 30, 2010 9:19 pm
First Name: Rob

Re: IRD warns of fake tax email

Post by Rob@BNZFraud » Tue Sep 06, 2011 5:33 am

Sorry folks, I'm still alive I assure you, and still very interested in any info you come across in your digital travels. :-)

User avatar
digidog
Site Admin
Posts: 15014
Joined: Wed May 05, 2004 2:25 am
First Name: Alfie
Location: Otago
Contact:

Post by digidog » Thu Sep 15, 2011 10:39 pm

Hey - the IRD have apparently started issuing refunds in UK pounds!
Dear Applicant:

You have received a tax refund payment of 632.25GBP
from IRD (Inland Revenue) into your Internet
Banking Account.

Please accept the tax refund request. The money will
appear in your Internet Banking Account after 3-6 days.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying
after the deadline.

Please click on sign in to Online Banking to accept
your incoming funds

Best Regards
Inland Revenue
Click on the link and you are offered a choice of eight banks. You merely select the one you'd like the
scammers to extract money from. Nice and easy!

Care: live phishing site
http://www.plugin2.ch/fileadmin/InlandR ... portal.htm" onclick="window.open(this.href);return false;

The original phishing email came from a TelstraClear address - 121.75.27.180 - again! Probably a compromised
PC under the scammers control.

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: IRD warns of fake tax email

Post by Foggyone » Thu Feb 09, 2012 6:35 pm

Another version of this is around at present.
Due to our latest update you are eligible for a refund
From:
Inland Revenue <ir3refundfiles@ird.govt.nz>
To:
Date: Wed Feb  8 11:45:41 2012
Attachments: 
 Inland Revenue - IR3_e-file refund form.html
 

Dear Sir/Madam,

You are receiving this e-mail with reference to our latest database update on February 5, 2012.

Due to our most up-to-date calculations, Inland Revenue updated his database system to a more accurate structure. As a result, you are eligible to get a refund of 184,56 $NZD.

Please download IR3-e-file_FORM-759784123157 attached to this e-mail, complete the form with your personal information in less than 48 hours and allow up to 24 hours to update the data into our database.

Your records are securely encrypted through a secure 128 bit socket to our servers and will NOT be shared.

Reference number: 76178256192/2012nzr.
E-mail officially sent by Ross Hughson.
Attachment
Inland Revenue - IR3_e-file refund form.html

The attachment opens in browser and then sends off the information. The code is obsfucated so that the form destination is not apparent. There is other code in the attachment which may be some kind of malware. I recommend that computers using MS Windows not be used to open this.
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Re: IRD warns of fake tax email

Post by Foggyone » Wed Feb 22, 2012 2:50 am

The latest of these phishing attempts is doing the rounds.
Dear [Deleted],


You are receiving this e-mail with reference to our latest database update on
February 20, 2012.

Due to our most up-to-date calculations, Inland Revenue updated his database
system to a more accurate structure. As a result, you are eligible to get a
refund of 217,94 $NZD.

Please download IR3_FORM-238967293613 attached to this e-mail, complete the form
with your personal information in less than 48 hours and allow up to 24 hours
to update the data into our database.

Your records are securely encrypted through a secure 128 bit socket to our
servers and will NOT be shared.

Reference number: 1287609086s/2012rkmt.
E-mail officially to: [Deleted]
Attached is an html file that opens in the victims browser. The file is heavily obsfucated.
File name Inland Revenue - IR3 Refund Form - 238967293613.html

Because this file is heavily obsfucated I am unable to say whether it contains any nasties, but one code block in particular looks suspicious. Therefore, if you receive this and run Microsoft Windows:

Do not open the file.
Google, the answer to so many questions!
-----------------------------------------------------

User avatar
Foggyone
Site Admin
Posts: 9880
Joined: Sat May 22, 2004 8:16 pm
First Name: Peter
Location: Lower Hutt
Contact:

Same Old Same Old

Post by Foggyone » Fri Sep 07, 2012 12:02 am

Hoax callers target IRD tax refunds
The tax department says the hoax callers are claiming to offer a refund on the condition people make an upfront payment to a bank account via Western Union.
"If anyone has replied to those behind these scams, and given money or their personal details, they should contact their bank or credit card provider immediately."

To report suspicious phone calls or emails that target Inland Revenue customers, please send an email to phishingird.govt.nz
Google, the answer to so many questions!
-----------------------------------------------------

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests