HMRC tax website cloned by scammers
By Davey Winder in Editorial
Posted in Business, Data Protection, Security, Internet on
It is that time of year when tax returns have to be filed and payments made. To remind folk of their financial and legal obligations, HM Revenue & Customs (AKA the tax office) have been running a high profile advertising campaign. This uses simple scare tactics to get the message across: file and pay by January 31st or we will fine you £100.
No wonder that the self-employed and small businesses across the UK are getting into a last minute flap to comply. No wonder the phishing conmen have seized upon the annual chaos and confusion to try and scam them out of their valuable financial data.
Yes, it is yet another security warning to kickstart the year. At least this one does not involve Stephen Fry. The Websense Security Labs ThreatSeeker Network has uncovered a sophisticated scam which uses a cloned copy of the official HMRC tax office website, hosted in Denmark and using an identical stylesheet to the real thing, along with convincing email messages to operate the sting.
First comes the email, cleverly advising that the rarest and most treasured of all things, a tax refund, is due to the recipient. “After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of £99.23. Please submit the tax refund request and allow us 3-6 days in order to process it.” It appears to come from the tax office, and contains a link back to the cloned HMRC website. Just as clever, once the mark visits the site and inputs the requested data such as name, address and credit card information they get redirected to the real HMRC tax office site.
Of course, there are a number of warning signs to flag up here that even the terminally idiotic should spot:
1. The tax office never takes between 3-6 days to process a refund, 3-6 weeks is more like it.
2. The tax office is unlikely to be refunding your overpayment into a credit card account, so why ask for this information?
3. The tax office sends good old fashioned printed letters with details of refunds, and payments due. I cannot recall ever having received a single email from HMRC in some 20 years of being self-employed.
Rated: 100% (1 votes)
Loading ...Comment by - January 7, 2009 on 10:33 am
I saw this very email in my inbox yesterday - it is useful to always hover over links to see where they are actually going rather than where the text says it is going.
Comment by - January 7, 2009 on 10:46 am
I suspect you would not have fallen for it even if the link had not been taking you to some server in Denmark though.
Comment by - November 3, 2009 on 7:35 am
these scammers are getting clever and more desperate by the day. you would think the hmrc would be full secured against any type of hacking with all the records and information the have on people.good heads up thou as a fair few people will fall for it
Make a comment
Tag cloud
Archives
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
Most commented posts
- 80 percent of viruses love Windows 7
147 comments
- Has Microsoft gone mental?
- Has the US Army declared war on Windows 7?
- Cuil frozen out: market share drops to next to nothing
- Xbox 360 FAIL
- The 24GB RAM Desktop is born
- Use old version of Windows instead of Linux, says teacher
- Microsoft reveals time-based licensing model
- Nexus Two - The Next Generation
- Windows XP: the invincible OS
Highest Rated Blog Posts
- Why ecommerce fails (100%)
- Google Chrome stands alone at PWN2OWN (100%)
- Betting on Hubdub technology (100%)
- Has Google gone insane as GMail goes back to beta? (100%)
- Chinese whispers as government implicated in UK hack attacks (100%)
- Crimeware toolkit targets 10,000 trusted sites (100%)
- Black Hat risk to migrating VMs (100%)
- Tough on cyber crime, tough on the causes of cyber crime (100%)
- Firefox 3, Beta 4, Enhancements 900, Tested 5 (100%)
- Has the US Army declared war on Windows 7? (100%)
