Tax phishing is target of new IRS registration rule

Fed up with scammers using Web sites that look and sound official, the IRS has established a new e-filing rule.

By next Thursday, Aug. 9, all authorized IRS e-file providers that obtain taxpayer information via the Internet, either directly or through third parties, must submit to the IRS the following information via an encrypted Excel spreadsheet:

1. The provider's Electronic Filer Identification Number (EFIN);
2. The name of a Principal or Responsible Official shown on the e-file application for the EFIN; and
3. The Uniform Resource Locators (URLs) of all web sites that are used to e-file federal returns; that are portals or allow access to the provider's online e-file software: or are used to obtain taxpayer information for the purpose of preparing and e-filing federal returns.

So what does this mean for all of us who send Uncle Sam our 1040s electronically? As fas as what you and I typically do, nothing.

But when it comes to making sure that our e-filing is legit, the IRS believes the new requirements will help.

Creative criminals: Criminals are, by nature, brazen. They think they are smarter than anyone and can get away with anything. But most crooks, online and otherwise, don't go as far as to blatantly advertise their criminal enterprises a la the fake URL below.

Go ahead and check it. You'll get a "page and/or server not found" message, at least until someone decides to claim the URL.

When it comes to fake tax sites, the names usually sound very real. Some, as blogged about here, rely on slight spelling alterations or URL extension changes to dupe taxpayers into using their "services." Others, blogged about here, pose as free file sites in order to hijack filers' personal data.

New federal phishing filter: To combat these and other tax Web scams, the IRS is taking the newly required registration info and developing a universal catalog of URLs of authorized IRS e-file providers.

That should help investigators more quickly identify and validate a URL that might be suspected of fraudulent tax preparation and/or phishing for taxpayers' personal tax and financial data.

E-filing companies that don't provide the required data to the IRS by next week could see their business shut down.

In addition, says the IRS, an authorized e-file provider that fails to comply with the new rules could be suspended or expelled from participation in federal e-filing activities.

And non-validated Websites could see their data seized, especially if the IRS or the Treasury Inspector General for Tax Administration (TIGTA) believe that the site is "engaging in fraudulent schemes."

As for future online e-filing operations, providers must submit the same information to the IRS prior to the Web site being publicly accessible.

You can read the IRS official announcement and get additional information at the agency's FAQs page. If you have other questions about the new registration rule, you can e-mail [email protected].