Darknet Fraudsters Advertise Tax Refund Schemes and Stolen IRS Checks
Summary
DarkOwl reports darknet and Telegram offers for tax-refund fraud using stolen identities and falsified documents, alongside sales of checks stolen from mail, including checks payable to the IRS and state revenue departments.
Key points
- DarkOwl observed offers for tax-refund fraud methods in darknet communities and on Telegram.
- Some schemes use stolen personal information and falsified tax documents to pursue fraudulent refunds.
- The article describes methods that misuse tax-preparation software and the identities of other people.
- DarkOwl reports that fraudsters advertised access to data associated with a U.S. online tax-filing company, including Social Security numbers, passwords, and bank account details; the article does not independently verify the advertised access.
- A separate scheme, called “glass” fraud, involves the reported theft and resale of mailed checks, including tax payments sent to the IRS or state revenue departments.
- The article says stolen checks may be altered and deposited through mule-controlled accounts, with victims potentially unaware until a payment fails to arrive.
Article Details
- Attack Vectors
- Fraudsters advertise tax-refund methods and stolen identity data, including “fullz,” in darknet communities and Telegram.
- Fraudsters use victims’ personal information and falsified W-2, 1099, and business-license documents to file fraudulent tax returns.
- Fraudsters encourage using TurboTax or TaxAct to submit fabricated income and dependent information for fraudulent refunds.
- Stolen paper tax-payment checks are resold, digitally altered, and deposited into mule-controlled bank accounts; the reported method may involve cooperating postal workers or stolen mailbox access keys.
- A fraudster advertised access to stolen devices associated with a U.S. online tax-filing company and claimed it could expose personal and financial data.
Products
TaxActThis method is directly tied to the buyer’s identity and SSN and involves utilizing automated tax software like TurboTax and TaxAct to obtain a refund of upwards of $20,000 USD in combined federal and state funds.TurboTaxThis method is directly tied to the buyer’s identity and SSN and involves utilizing automated tax software like TurboTax and TaxAct to obtain a refund of upwards of $20,000 USD in combined federal and state funds.