The IRS has issued a warning to tax professionals that the agency is aware of a phishing scam that is aimed at obtaining various personal information.[1]

The e-mail indicates that it is from “IRS Tax E-filing” with a subject line of “Verifying your EFIN before e-filing.”  The news release provides the following text found in the email:

In order to help protect both you and your clients from unauthorized/fraudulent activities, the IRS requires that you verify all authorized e-file originators prior to transmitting returns through our system. That means we need your EFIN (e-file identification number) verification and Driver's license before you e-file.

Please have a current PDF copy or image of your EFIN acceptance letter (5880C Letter dated within the last 12 months) or a copy of your IRS EFIN Application Summary, found at your e-Services account at IRS.gov, and Front and Back of Driver's License emailed in order to complete the verification process. Email: (fake email address)

If your EFIN is not verified by our system, your ability to e-file will be disabled until you provide documentation showing your credentials are in good standing to e-file with the IRS.

© 2021 EFILE. All rights reserved. Trademarks

2800 E. Commerce Center Place, Tucson, AZ 85706[2]

The news release indicates that a professional receiving such an email should take the following steps:

Tax professionals who received the scam should save the email as a file and then send it as an attachment to phishing@irs.gov. They also should notify the Treasury Inspector General for Tax Administration at www.tigta.gov to report the IRS impersonation scam. Both TIGTA and the IRS Criminal Investigation division are aware of the scam.[3]

The IRS describes the particular motivations behind this email:

Like all phishing email scams, it attempts to bait the receiver to take action (opening a link or attachment) with a consequence for failing to do so (disabling the account). The links or attachment may be set up to steal information or to download malware onto the tax professional's computer.

In this case, the tax preparers are being asked to email documents that would disclose their identities and EFINs to the thieves. The thieves can use this information to file fraudulent returns by impersonating the tax professional.[4]

The IRS closes the release by giving more general information about scams aimed at tax professionals:

Tax professionals also should be aware of other common phishing scams that seek EFINs, Preparer Tax Identification Numbers (PTINs) or e-Services usernames and passwords.

Some thieves also pose as potential clients, an especially effective scam currently because there are so many remote transactions during the pandemic. The thief may interact repeatedly with a tax professional and then send an email with an attachment that claims to be their tax information.

The attachment may contain malware that allows the thief to track keystrokes and eventually steal all passwords or take over control of the computer systems.

Some phishing scams are ransomware schemes in which the thief gains control of the tax professionals' computer systems and holds the data hostage until a ransom is paid. The Federal Bureau of Investigation (FBI) has warned against paying a ransom because thieves often leave the data encrypted.[5]

[1] IR-2021-34, “IRS, Summit partners issue urgent EFIN scam alert to tax professionals,” February 10, 2021, https://www.irs.gov/newsroom/irs-summit-partners-issue-urgent-efin-scam-alert-to-tax-professionals

[2] IR-2021-34, “IRS, Summit partners issue urgent EFIN scam alert to tax professionals,” February 10, 2021

[3] IR-2021-34, “IRS, Summit partners issue urgent EFIN scam alert to tax professionals,” February 10, 2021

[4] IR-2021-34, “IRS, Summit partners issue urgent EFIN scam alert to tax professionals,” February 10, 2021

[5] IR-2021-34, “IRS, Summit partners issue urgent EFIN scam alert to tax professionals,” February 10, 2021