I got two spams this week claiming to come from the IRS. They look like different schemes — one is trying to get me to call a 900 number at $4.79/minute, the other includes a link. But they look similar so I’m posting them together.
Message 1:
Sender: Tiera Tanner (AditaOki@megpgh.com)
Subject: Rejection of your tax appeal.
Text:
Dear Business taxpayer,
Hereby you are notified that your Income Tax Refund Appeal id#7138565 has been DECLINED. If you believe the IRS did not properly estimate your case due to a misunderstanding of the facts, be prepared to provide additional information. You can obtain the rejection details and re-submit your appeal by using the instructions in the attachment.
Internal Revenue Service
Telephone Assistance for Businesses:
1-900-511-4750 $4.79/min
Hours of Operation: thursday sunday, 10:15 p.m. 8:45 p.m. your local time (Alaska & Hawaii follow Pacific Time)
Attachment: IRS_JP23823966.htm
Here’s what the message looked like:
Message 2:
Sender: Internal Revenue Service (noreply@irs.gov)
Subject: Internal Revenue Service Tax Refund ($312.50)
Text:
Dear Taxpayer,
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $312.50. Please submit the tax refund request and allow 2-3 working days for processing.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline. To access the form for your tax refund, please
Click here : http://www.irs.gov/tx/rfnds/redunds.html
(link leads to http://suministrosyserviciosquimicos.com/administrator/templates/USTaxRefundation/www.irs.com/)
Note: For security reasons, we will record your ip-address, the date and time. Deliberate wrong inputs are criminally pursued and indicated.
Thank You
Internal Revenue Services (IRS)
Here’s what it looked like:
Robert says
I got a ton of these last week. The format is almost identical to the eBay/Paypal spams I wrote about in July, except that these include an IRS logo. The subjects were:
They include links to tax reports, all of which point to hacked WordPress sites.