« August 2012 | Main | December 2012 »

September 26, 2012

The malware propagators are at it again, this time with emails that try to make you believe the IRS is contacting you about an issue with your company's Employer Identification Number (EIN). The false story varies from message to message. Here are two that I've seen:

Dear business owners,

Due to the system error the Employer Identification Number of your company has been accidently erased from the online database, please validate your EIN to confirm your current status of taxpayer. Certain indulgences will be applied to the next audit report for your company. IRS is sorry to cause inconvenience.

For detail information, please refer to:
https://www.irs.gov/Login.aspx?u=9B47DF56AE

Email address: [removed]@dannyg.com

Sincerely yours,
Clay Hunt
IRS Customer Service representative

and

Dear business owners,

Due to the alterations in the taxation policies that have been recently ratified, IRS informs that Limited Liability Companies, C-Corporations and S-Corporations have to validate their Employer Identification Number in order to confirm their actual status. You have 14-day period in order to examine all the changes and make necessary amendments. We are sorry to cause inconvenience.

For the details please refer to:
https://www.irs.gov/ClientArea.aspx?u=8473D8AF2B

Email address: [removed]@dannyg.com

Sincerely yours,
Lynnette Skinner
IRS Customer Service representative

The actual URLs behind the links are to hijacked web sites, where the malware loading starts. A simple mouse rollover of the link in most email clients reveals the actual link URL. That's the easy way to test the authenticity of an email message that engenders just enough doubt in the minds of many recipients. The awkward grammar of the messages might also be a clue that something stinks.