Tax-Return Fraudsters Share Scamming Secrets

This tax season, cybercrooks are using prepaid debit cards and Amazon virtual gift cards to collect fraudulent tax refunds, according to discussions on online cybercrime forums reported by Krebs on Security on Wednesday (March 25).

The fraudsters also identified Wells Fargo as the bank most likely to catch fraudsters using its checking accounts to accept multiple tax refund direct deposits.

But the tax-fraud secret sauce includes filing lots of phony tax returns, focusing on state returns (where security isn’t as good) and getting refunds through prepaid debit cards — one per filing.

“The season is over, and my stats improved a lot once I used one [Green Dot debit card] for one refund, instead of one checking account for 10 refunds,” one scammer wrote.

The problem, Utah State Tax Commission Chairman John Valentine told the U.S. Senate Finance Committee at a hearing this month, is that a prepaid debit card “appears to be linked to a bank account even though the debit card had no actual checking or savings account associated with it.” He added that all of the suspicious returns his state has seen this year had the previous year’s direct deposit account information changed to prepaid debit card accounts.

“A simple fix would be to require a different series, letter or additional numbers to distinguish these cards from cards connected to bank or credit union checking and savings accounts,” Valentine said.

Back in the online forums, fraudsters said another successful technique was to file phony refund requests through TurboTax (which temporarily suspended state tax return e-filing in February due to a spike in fraud coming through its system) and then request that the refund be credited to an Amazon gift card account. “Basically, you need just an email to receive the Amazon code. Sure, it’s hard to sell it on eBay or Craigslist, but it works and they never get blocked, so it’s safe money,” a scammer reported.

Aside from prepaid cards and Amazon gift codes, there’s still the option of opening a bank account to receive the fraudulent refunds — if it’s the right bank. “Wells Fargo is old news and sucks big time,” a tax fraudster calling himself Peleus wrote in a January 2015 post quoted by Krebs on Security. “It is one of the strictest banks and I do not recommend it.”