Smart Tax Planning

Scammers are using fake coronavirus stimulus payment sites to steal your money

Key Points
  • Last week, the IRS began issuing stimulus payments to Americans. Individuals are eligible for $1,200, while married joint filers could collect $2,400. Households are entitled to $500 per qualifying child.
  • Individuals who earn too little to be required to file an income tax return can also get their payment. They must enter their data on the IRS’ website.
  • Scammers have set up more than 180,000 coronavirus-themed sites in an attempt to steal data or misinform consumers, according to data from Checkphish by Bolster.
Conti — which uses malware to block access to computer data until a "ransom" is paid — operates much like a regular tech company, say cybersecurity specialists who analyzed the group's leaked documents.

If you're awaiting a federal stimulus payment and you haven't filed tax returns, beware: Hackers have set their sights — and sites — on your $1,200 check.

Scammers have set up more than 180,000 coronavirus-themed websites in an attempt to steal data or misinform consumers, according to data from Checkphish by Bolster.

The security firm has spotted more than 149,000 suspicious domain registrations with the term "stimulus check" in them.

Last week, the IRS began distributing its economic impact payments to households all over the country. Individuals are eligible for up to $1,200, while those who are married and file jointly can get up to $2,400.

Households are also eligible for $500 per child under age 17.

How scammers are targeting your stimulus checks

The IRS determines what you get based on the adjusted gross income reported on your 2018 or 2019 tax return. Single filers with an AGI between $75,000 and $99,000 ($150,000 and $198,000 if you're married and filing jointly) get smaller payments.

Non-filers – people who don't submit tax returns because they don't earn enough money to be required to do so – are also eligible for stimulus checks. They must enter their personal data into a website hosted by the IRS to have the money direct deposited into a bank account.

Therein lies a massive security problem, data security experts said.

"The IRS is asking consumers for their mailing addresses, email addresses – it's all appropriate information," said Rivka Little, senior vice president of marketing and strategy at Socure.

"But all of those points of data are out there; they're already breached and attainable," she said.

Data breaches

Getty Images: Marco Piunti

In 2019, there were 7,098 data breaches, exposing more than 15.1 billion records, according to data from Risk Based Security.  

In some cases, individuals themselves offer their own data on a silver platter via social media. This is why you shouldn't share your birthday, full name, email address and other details.

Armed with this data, scammers could try grabbing non-filers' stimulus payments and routing the cash elsewhere.

"Now, it's fraudsters entering consumers' information in order to divert the money," Little said. "It's important for financial institutions to watch for a rise in new bank accounts.

"Are you looking at the activity that happens after this new account is established?"

Impersonating the IRS

So who's getting the stimulus checks?

Rip-off artists are also impersonating the IRS and sending phishing emails to extract taxpayers' bank account data, said Avi Shua, co-founder of Orca Security.

"One easy way for scammers to take advantage of the 'Get My Payment' app is to create copies of the login page," said Abhishek Dubey, CEO of Bolster.

Taxpayers wind up inputting their own data into the fake page, which scammers then use to try beating the victim to the check, he said.

"Even if it looks legit, if you want to search for the 'Get My Payment' site, go there directly – don't just click on a link within an email," Shua said.

As a reminder, the IRS will not call, email, text or leave threatening voicemails about the stimulus payments – but scammers impersonating the tax agency will.

"The IRS reminds taxpayers that the new tools on – Get My Payment and the Non-Filer – are safe and secure to use," said IRS spokesman Dean Patterson in an email.

"Taxpayers are urged to go directly and solely to to use these tools and official information to avoid scams directing people to other websites," he wrote.

More from Smart Tax Planning:
Need a PPP loan? These applicants need to file their 2019 taxes first
Skipping a mandatory distribution from your IRA? What you should know
The PPP loan has run out, and these people were shut out