MayFlower Software :: IRS Refund Scam

Tags: Phishing

Here is a pretty good email scam. It looks like a real IRS email, and they are giving back money. Who wouldn't want that nowadays?

They attach an HTML file which asks for all kinds of information, then posts it to a website called www.zimole.com. I opened up the HTML file and found the amount hard coded into the file. I decided to enter the information and then post it. For fun, I used the WHOIS name of the registrant of zimole.com, Jacqueline Long from Sunnyvale CA.

This goes to show you that spam is heading more in the direction of Phishers (= crooks) vs. selling something. Stealing has higher profit margins.

Here is the email:

Tax return 2008 - 2009
2008 - 2009 Recalculation of you tax refund
Local Office no. 182 20/July/2009
TAX REFUND NUMBER: USA52/288194IRS29/158

ATTN: Dear Applicant

After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of $314.79
Your TRN (TAX REFUND NUMBER): USA52/288194IRS29/158, complete the tax return form attached to this message.
After completing the form, submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.

Our head office address can be found on our web site at http://www.irs.gov/

Note: For security reasons, we recommend that you close your browser after you have finished accessing your refund status.
- For security reasons, we will record your ip-address and date.
- Deliberate wrong inputs are criminally pursued and indicted.

Sincerely,
Jennifer Brough
Tax Credit Officer
Internal Revenue Service
A picture named M2