Internal Revenue Service urges users to beware of a fake email in its name: it's a phishing attack to steal your data
A new phishing attempt puts users' sensitive data at risk and this time the attack comes through a fake email in the name of the Internal Revenue Service. The attackers use the name of the agency to ask to open attachments that could install malware and for those who receive the email the invitation is to trash it and report it.
The Revenue Agency has issued a note on September 22 in which it stresses its extraneousness to the phishing campaign. Usually the emails appear in the name of "the director of the Agency" or "the organs of the Agency" and ask users to view a file that, once opened, could steal users' sensitive data. The technique used by the malicious ones is similar to the one already used in the past months, when the emails carried the fake name of INPS, with the social security institution that was forced to warn users about the risks of phishing, or other well-known organizations and companies whose logo is periodically counterfeited.
How to recognize the scam email
Recognizing the scam email is the first step to safeguard your sensitive data from phishing attack. The emails that are arriving to users carry in the header the wording "the director of the Agency", or "the organs of the Agency", claiming to have examined some inconsistencies on the data related to the "Disclosure of periodic VAT eliminations". Users are then invited to open the attached files to view the documents, in order to get explanations on the alleged "inconsistencies", complete with a reference to the Revenue Agency and a password to enter to access the attachments. In reality, opening these attachments downloads malware that is capable of infecting the PC and stealing sensitive data.
There are a few things users can notice to see if the email they just received is a phishing attempt. The first tip is to always look at the sender's email address, which is usually not the official one of the entity they are posing as. Another advice is to notice the grammar of the email: phishing attempts in fact often contain spelling mistakes and typos, hardly present in a standard email. If the text invites the user to download suspicious files, or to access a website by entering their credentials to the link in the email, the risk that it is phishing is even greater.
What to do if you receive the email scam
After several reports from users who have received the email scam, the Inland Revenue has published on its website a press release explaining how to protect themselves from phishing attack. The first step is to always carefully check the messages received, so as to immediately identify suspicious elements, not to open the links in the email, nor download any attachments of any kind.
The email will then be immediately trashed, but if the doubt that it was an official communication remains, the user has other ways to verify the information contained in the text. For example, reminds the Inland Revenue, by accessing the reserved area of the official website to your own Cassetto Fiscale, where you can consult all the information related to your position.