TMCnet News
Consumer Alert: Tax Software Providers Not Protecting Emails from Phishing and Spoofing, Reports Global Cyber AllianceWASHINGTON, March 14, 2018 /PRNewswire-USNewswire/ -- Only half of the top tax software providers are using the most basic of email protections to secure communications with customers, according to new research from the Global Cyber Alliance. Tens of millions of Americans will use tax software to prepare their federal and state taxes, yet some of the industry's biggest names — H&R Block, TaxAct, Turbo Tax and Free Tax USA — are not preventing their email domains from being hijacked to trick consumers into sharing sensitive data that could include social security numbers, bank account numbers and dates of birth. In an examination of the top 8 tax software providers, only Liberty Tax Online is using the highest level of email-authentication security — the Domain-based Message Authentication, Reporting & Conformance (DMARC) protocol — to prevent delivery of spoofed email. Three others — Credit Karma, Jackson Hewitt and Tax Slayer — are using the second-highest level of DMARC protection that marks spoofed email as spam. TurboTax and Free Tax USA have begun to deploy DMARC, but it is not yet set up to protect consumers from email that pretends to be from the tax providers. H&R Block and TaxAct USA have not initiated any DMARC deployment. DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of any person with an email address. According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years. The IRS warned tax providers in 2017 that they were "increasingly the targets of national and international cybercriminal rings." With the incidents of phishing continuing to rise, individual consumers are also at risk of being attacked through email which appears to come from their tax software providers. "Consumers are accustomed to inputting the most sensitive and personal information, from social security numbers to financial information and health care expenses, into tax preparation software," said Philip Reitinger, President and CEO of the Global Cyber Alliance. "The very nature of a consumer's relationship with a tax provider makes it seem legitimate to receive emails that may ask for additional personal information, putting consumers at great risk from phishing scams that appear to involve tax providers. Companies need to provide the maximum protections. There appears to be a hole in the protections provided by some of the leading tax software providers – a hole that could be fixed by deployment of DMARC at its strongest level." Without DMARC protection, hackers can create emails that appear to be from a trusted source but contain malicious links or ask for additional information that could be provided by unsuspecting consumers. The Data Using GCA's DMARC tools, the researchers could determine how far organizations were in the process of implementing DMARC.
Steps Consumers Can Take to Protect Themselves Consumers need to remain vigilant to prevent being scammed through email:
GCA has published four reviews of DMARC implementation – two looking at organizations in cybersecurity, one looking at banks, and another examining public and private hospitals. For more details about DMARC or to check if an organization is using DMARC, visit dmarcguide.globalcyberalliance.org. About the Global Cyber Alliance GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney's Office, the City of London Police and the Center for Internet Security. Learn more at www.globalcyberalliance.org. CONTACT: View original content:http://www.prnewswire.com/news-releases/consumer-alert-tax-software-providers-not-protecting-emails-from-phishing-and-spoofing-reports-global-cyber-alliance-300613550.html SOURCE Global Cyber Alliance |