IRS Telephone Via VoIP Scam

IRS Telephone Via VoIP Scam: How It Works

VoIP phone services make it easy to sign up for multiple telephone numbers with little more than a credit card number. Because they’re so easy to get, they make an easy medium for telephone scams. By using multiple VoIP numbers and computer bots to make legions of robo-calls, scammers are using fake IRS voicemails to steal taxpayer money.

How does the IRS Scam Work? A group of attackers signs up for multiple telephone numbers through a VoIP provider. Then, attackers record a message, such as this one, which was reported by Lisa Weintraub Schifferle, a Federal Trade Commission attorney:

“Hello, we have been trying to reach you. This call is officially a final notice from the IRS, Internal Revenue Service. The reason of this call is to inform you that IRS is filing a lawsuit against you.”

The message provides a callback number, usually different from the number on the recipient’s caller ID. Then, the attacker threatens the recipient with arrest, confiscation of a driver’s license, or deportation if the recipient doesn’t call the number. To make the voicemail sound more realistic, scammers sometimes give fake badge numbers and say the last four digits of the taxpayer’s Social Security number.

Once they’ve created their recording, scammers use automated computer bots to call large numbers of taxpayers. When taxpayers answer their phones, they hear the recorded message. If taxpayers call the number back, scammers pressure them to pay a supposed outstanding tax bill, often by wire transfer or prepaid debit card. Furthermore, if scammers steal the innocent taxpayer’s credit or debit card information, they can use it to commit identity theft. If they get a Social Security number, they can use it to file for a fraudulent IRS refund.

How Attackers Manipulate VoIP

When people think of cyberattacks, they usually think of attackers who send viruses as email attachments or who steal lots of data from big companies. Attackers commonly use phones as attack vectors, too, thanks to VoIP, which routes voice data over the Internet instead of through the traditional landline system.

The IRS scam starts with what network security and antivirus providers call “spamming over Internet telephony,” or SPIT. SPIT attacks usually involve bot dialers that call almost everyone in a geographic area.

Instead of pure spamming, however, the IRS scam uses another element called “vishing.” Vishing involves stealing customer financial information or other sensitive data by tricking customers into sharing it over the phone. Some scammers use live callers to pressure customers to turn over their credit card numbers. Others use IVR (automated telephone menu systems) to contact customers and then get customers to say or dial their credit card number, which the scammer records.

SPIT and vishing aren’t the only types of attacks related to VoIP technology. Other attacks include:

• Telephony denial-of-service (TDoS). A TDoS attack uses bot callers to flood SIP trunking and IP-PBX technology. For example, after an ICU nurse refused to pay scammers who insisted she owed money on a payday loan, the scammers flooded the ICU with robo-calls, shutting down the ICU phone system.

• Toll fraud. Scammers invade a company’s phone system by tricking SIP trunking systems or hacking poorly protected IP phones. Then, they make expensive international calls, running up thousands of dollars in phone bills for the company.

IRS Telephone Via VoIP Scam: How To Avoid

To seem more credible, IRS scammers often use a caller ID spoofing service to make the IRS name and number appear on a victim’s caller ID.

Don’t be fooled, even if your caller ID says it’s the IRS, and even if the caller threatens you with arrest, license suspension, or deportation. If the caller does any of these five things, it’s not an IRS agent:

1. Contacts you by telephone to demand payment before mailing a notice or bill

2. Demands payment without giving you a chance to dispute your bill

3. Asks for your credit or debit card number over the phone

4. Requires a specific payment method, such as wire transfer or prepaid debit card

5. Threatens to have local law enforcement arrest you for non-payment If you’re worried that you owe money, never call the callback number left on the voicemail.

Always call the IRS directly at 1-800-829-1040 to ask about your bill. Also, report scam phone calls to the FTC or online at the IRS Impersonation Scam reporting page.