Be Aware of Tax-Related Scams

How long do you think it would take a hacker to crack your current passwords?

On average, it takes a hacker about 2 seconds to crack an 11-character password that only uses numbers. See the attached chart that illustrates the time it takes for a hacker to brute force attack your password. A brute force attack is when cybercriminals use trial and error to guess your details. Cybercriminals currently use sophisticated software that can run thousands of password combinations in a minute, but their technology and resources are only getting stronger.

A general rule is that your password should be at least 11 characters, utilizing both numbers as well as upper and lowercase letters. That combination will take hackers 41 years to crack. Regardless of the possible variations, the shorter your password, the easier it is to crack. Check out how long it will take a hacker to crack your password at https://www.security.org/how-secure-is-my-password/.

Lastly, simplify and secure your accounts by using a password manager that creates and stores all your passwords for you.

Strengthen your password security with the following tips:

• Prioritize the length and complexity of your passwords.
• Don't use personal information. This can be publicly available and easily accessible by hackers.
• Avoid using dictionary words as passwords. Cracking tools can easily process every word in the dictionary.
• Don't reuse passwords. If one account is breached, your other accounts would be vulnerable as well. Rather, use password managers, which are a convenient and secure way to manage complex passwords on multiple platforms.
• Use multifactor authentication (MFA or 2FA) for especially sensitive accounts.
• Avoid typing passwords while using public Wi-Fi. Instead, use a VPN or avoid websites that require your login information.

Protect yourself from these tax-related scams.

Tax-related scams have become increasingly common, and they happen year-round.  Fraudsters will contact you pretending to be from the Internal Revenue Service (IRS), a tax accounting service, or another tax-related agency.  You could receive fake emails, phone calls, letters, or other communications.

Be on high alert for phishing emails. Scammers are attempting to steal information such as tax IDs, account information, passwords, and other valuable data.  Be immediately suspicious of any unsolicited communication (email, text message, letter, or call) that asks you for your Social Security number, login credentials, or other personal information.

Review these helpful FAQs:

• Will the IRS contact me via email?

The IRS will never initiate contact with you via email, text messages, or social media with a request for personal or financial data. Be extremely careful with any unsolicited email that claims to be from the IRS.

• What should I do if I receive an email or text message claiming to be from the IRS or another tax service that asked for sensitive information?

Do not reply! Do not click on any links or download any attachments. Forward any IRS-related emails to phishing@irs.gov.

• What should I do if I discover a website claiming to be the IRS that I suspect is not legitimate?

Do not click on any links, download any files, or submit any information. Send the URL to phishing@irs.gov

• Are there any trusted resources I can use to identify email scams or websites claiming to be
  the IRS?

The IRS highlights examples of email scams and bogus websites. Find the information online at www.irs.gov/uac/Report-Phishing and https://www.irs.gov/newsroom/tax-scams-consumeralerts.

• What should I do if I receive an unsolicited phone call or letter claiming to be from the IRS that
  I suspect may not be legitimate?

Contact the IRS yourself to confirm any requests made via phone or letter, particularly those that are threatening or demand immediate payment. Visit www.irs.gov/uac/Report-Phishing for phone numbers and other tips.

• If I receive a suspicious tax-related email while at work, should I notify my company?

Yes! Report suspicious emails to IT. The IT team can help you determine if a message is legitimate. In addition to confirming requests for your personal data, you should verify any email that asked you to provide copies of W2 forms or your coworkers’ tax-related information.