Debunking email hoaxes and exposing Internet scams since 2003!

Hoax-Slayer Logo Hoax-Slayer Logo

Home    About    New Articles    RSS Feed    eBook    Contact
Bookmark and Share

IRS 'Unable To Process Your Tax Return' Malware Email

Email purporting to be from the IRS claims that the recipient's tax return was not able to be processed and that he or she should fill out and return forms contained in an attached file in order to rectify the problem.

Brief Analysis
The email is not from the IRS. The attachment does not contain a tax form as claimed. Instead, the message contains malware. The IRS will never contact taxpayers about any aspect of their tax accounts via unsolicited emails.

Bookmark and Share
Detailed analysis and references below example.

Last updated: 5th July 2011
First published: 5th July 2011
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer

From: IRS Support
Subject: IRS notification letter

Department of Treasury Internal Revenue Source
Important information about your tax return

We are unable to process your tax return

We recived your tax return. However, we are unable to process the return as field. Our records indicate that the person identified as the primary taxpayer or spouse on the tax return did not provided all the required documents shown on the tax form. Our records are based on information received from the Social Security Administration.
Based on this information, the tax account for the individual has been locked
What you need to do
Print out the attached notification and list of missing documents, fill it in, add the documents and send the following information to the adress shown in the attached notification.

List of required documents:
1. A copy of this letter
2. Notification letter
3. A photocopy of valid U.S. Federal or State Government issued identification.

Keep this notice for your records. If you need assistance, please don't hesitate to contact us

Detailed Analysis
This email, which purports to be from US tax agency, the Internal Revenue Service (IRS), claims that the IRS was unable to process the recipient's tax return because all of the required documents were not provided. The message instructs the recipient to print out and fill in a tax notification attached to the message and mail it to the IRS so that the tax account can be correctly processed.

However, the email is not from the IRS and the attached file does not contain an IRS tax notification as claimed. In fact, opening the .zip attachment will reveal a malicious .exe file that, if launched, will install malware on the user's computer. Once installed, this malware can contact a remote server and download further malware components.

The IRS will never send you an unsolicited email about your tax account. Be very cautious of any email that claims to be from the IRS and asks you to either click a link or open an attached file. While this particular attack is designed to distribute malware, similar attacks have been phishing scams designed to trick you in to handing over your personal and financial information to Internet criminals.

Taxpayers in other nations are also advised to watch out for phishing and malware emails purporting to be from their tax department. Criminals have repeatedly used bogus tax notification messages as a means of tricking taxpayers all around the world into divulging personal information or installing malware.

Bookmark and Share References
Virus Total - IRS document report
The IRS Warns of Scam E-Mails
IRS Tax Refund Phishing Scam

Last updated: 5th July 2011
First published: 5th July 2011
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer