Fake Tax Return Notifications | Kas Against Spam!!

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Fake Tax Return Notifications Sept 2, 2018 10:28:50 GMT -5

Quote

Post by kas on Sept 2, 2018 10:28:50 GMT -5

Got this on my cell:

From +19024482383
Message:

Hi you received Your taxes return visithxxp://unitedtaxr.com

THIS is a SCAM! DO NOT RESPOND TO THE PHONE NUMBER AND DO NOT VISIT THE WEBSITE.

canadianareacodes.net/number/19024482383/

Reported to www.fightspam.gc.ca/eic/site/030.nsf/eng/home

Last Edit: Sept 2, 2018 10:45:15 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Fake Tax Return Notifications Sept 2, 2018 21:24:42 GMT -5

Quote

Post by kas on Sept 2, 2018 21:24:42 GMT -5

Got one in email as well:

Return-Path: <lonwilms@ziltenco.nl>
X-Originating-IP: [141.138.141.100]
Received: from localhost.localdomain (static.181.42.201.195.clients.your-server.de [195.201.42.181])
(Authenticated sender: lonwilms@ziltenco.nl)
by mail3.westlandhosting.nl (Postfix) with ESMTPA id 2A88360902CE6
Date: Mon, 27 Aug 2018 20:57:07 +0200
From: =?UTF-8?B?Q2FuYWRhIFJldmVudWUgQWdlbmN5?= <lonwilms@ziltenco.nl>
Subject: =?UTF-8?B?VGF4IFJlZnVuZA==?=

I had to take it out of spam to see the link. I did not click it but looked at code to get it. The scam link was hxxp://allcarparts.ru/ca/

The Canada Revenue Agency (CRA) will never send or request e-transfers of any kind. The CRA will only send you payments by direct deposit or by cheque in the mail. If you receive a e-Transfer claiming to be from the CRA like the example below, it’s a scam! www.canada.ca/en/revenue-agency/corporate/security/protect-yourself-against-fraud/samples-fraudulent-emails.html

scam email

Last Edit: Sept 2, 2018 21:36:55 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Fake Tax Return Notifications Jul 10, 2019 0:19:27 GMT -5

Quote

Post by kas on Jul 10, 2019 0:19:27 GMT -5

Scam email pretending to look like official tax return email:

Subject: Tax Return - 739707397
From: CRA Tax <test@webality.de>
To: (Dictionary attack .. lists many email addresses through this method which either will bounce back or be successful)
Authentication-Results: mta4229.mail.ne1.yahoo.com header.i=@webality.de dkim=neutral (no sig);
spfDomain=webality.de spfResult=none;
dmarc=NULL(p=NULL sp=NULL dis=NULL) header.from=webality.de
Received-SPF: none (domain of webality.de does not designate permitted sender hosts)
X-Originating-IP: [192.162.87.239]
X-SecureMailgate-Identity: test@webality.de;server17.configcenter.info
Received: from jvgc.com (unknown [88.198.92.43])
(Authenticated sender: test@webality.de)
by server17.configcenter.info (Postfix) with ESMTPA;
Sun, 7 Jul 2019 19:00:22 +0200 (CEST)
Date: Sun, 07 Jul 2019 21:00:22 +0400
Message-ID: <164641735.142217805@f9opr6fka09lnjif07rwe9r7nhf3foiu.CO.UK>
X-Virus-Scanned: ClamAV
X-Originating-IP: 87.253.162.22
X-SecureMailgate-Domain: server17.configcenter.info
X-SecureMailgate-Username: 87.253.162.22
X-Report-Abuse-To: spam@node01.secure-mailgate.com

Scam email contains link: hxxp://encarnacion.gvam.es/.crs/

INCOME TAX RETURN FROM CRA-ARC

Dear Tax Payer,

You have received this email to be notified that the Revenue Agency of Canada has issued a refund and you'll receive $549.31 CAD directly on your credit card.

The link expires on 08 July 2019.
Have your credit/debit card ready
A refund can be delayed for a variety of reasons, for example submitting invalid records or applying after deadline.

Product updates

Loyalty offers and discounts

[[Claim your payment]]

Tax: Self Assessment
Tax reference: 6096828115
Payment reference: CA104392381
Amount paid: $549.31
Please note: (Government Gateway) Office will never request your password or financial information via email.

From Portal Online Payments

Support | Legal | Privacy | Unsubscribe

CRA-ARC will process your personal information in compliance with our CRA-ARC Privacy Statement

by CRA-ARC is now LifeLock. LifeLock™ identity theft protection is not available in all countries.

Copyright © 2019 CRA-ARC Corporation. All rights reserved. CRA-ARC, the CRA-ARC Logo, the Checkmark Logo, , by CRA-ARC, LifeLock, and the LockMan Logo are trademarks or registered trademarks of CRA-ARC Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

CRA-ARC Corporation, 350 Ellis St., Mountain View, CA 94043

EEmailID: CA_TRIG_ACT_AR_OO_REOPTIN_T180

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.