TECHNOLOGY SECURITY ALERT: IRS Warns Postsecondary Institution Students and Staff of Impersonation Email Scam (EA ID: GENERAL-21-22)

The Internal Revenue Service (IRS) posted a warning of an ongoing IRS impersonation scam that appears to primarily target educational institutions, including students and staff of institutions that have “.edu” email addresses.

The Treasury Inspector General for Tax Administration and IRS Criminal Investigation has been notified about the suspicious emails that display the IRS logo and use various subject lines, such as “Tax Refund Payment” or “Recalculation of your tax refund payment.” The emails ask individuals to click a link and submit a form to claim their refunds.

The phishing website requests that taxpayers provide the following information:

The U.S. Department of Education encourages institutions to visit the IRS web page—irs.gov/newsroom/irs-warns-university-students-and-staff-of-impersonation-email-scam—which contains details about the phishing campaign. We also ask that you share the web page widely with students and staff to raise awareness about this scam.

Recipients of this scam email should not click on the link in the email, but they can report it to the IRS. For security purposes, recipients should save the email using the “save as” feature and send that file as an attachment or forward the email as an attachment to phishing@irs.gov.

Taxpayers who believe they may have provided identity thieves with their information should consider immediately obtaining an Identity Protection (IP) PIN. An IP PIN is a six-digit number that helps prevent identity thieves from filing fraudulent tax returns in a victim’s name. This is a voluntary IRS opt-in program.

Taxpayers who attempt to e-file their tax return and find it rejected because a return with their SSN already has been filed should file an IRS Form 14039, Identity Theft Affidavit, to report themselves as a possible identity theft victim. To learn about the signs of identity theft and actions to take, visit the Identity Theft Central web page on irs.gov.

If you believe your institution has been targeted or breached, report the incident immediately to CPSSAIG@ed.gov and FSASchoolCyberSafety@ed.gov. Include the following:

Thank you for your attention to this matter. Federal Student Aid is committed to working with institutions to combat cybersecurity attacks and protect student financial aid information. If you have questions about the information included in this announcement, please email FSASchoolCyberSafety@ed.gov or call 202–377–4697 between 7 a.m. and 5 p.m. Eastern time Monday through Friday. We look forward to working with you and thank you in advance for your efforts to safeguard student information and secure your institution.