IT assessment, planning, execution, monitoring and preventative maintenance LEARN MORE

5 Ways to Protect Yourself and Your Business Against Tax Scams

Watch Out for Tax Scams!

It’s that time of year again: tax filing season.  It can be really stressful!  Unfortunately, there is usually a large jump in the number of tax scams at this time of the year.  Cyber security experts have warned about the specific ways that cyber criminals steal sensitive, private information.

A month or so ago, the IRS released its “Dirty Dozen” list of tax scams for 2017.1  In this list, the IRS mentioned phone and phishing scams as serious threats.

Phishing is defined as “the attempt to obtainTax Scam  sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.”2 

Basically, criminals pretend to be someone you trust in order to steal important financial and personal info.  They use this information to log into peoples’ accounts, like bank accounts, to transfer funds.  Also, they sell it to other criminals.  Phishing can be done through phone calls, emails, texts and other communication forms.

Consumer Tax Scam Examples

Recently, criminals are using a number of different tax scams to attack consumers.  They make calls or send emails, which appear to be from the IRS.  Their emails ask the consumer to update missing information, pay an outstanding tax liability or receive a refund by clicking on a link.  Their emails may also contain links to malicious websites, which appear to be IRS related and ask them to enter confidential info.

 

Tax Scam

Criminals make calls and demand that consumers pay an outstanding tax balance.  They threaten severe penalties if they don’t.   Their scams have gotten very complex.  In some cases when they have already stolen consumers’ personal and financial information, the criminals submit falsified tax returns.  Then, they request that refunds be sent to consumers’ bank accounts.  When the refunds are deposited, they call consumers and pretend to be IRS reps.  They indicate that a refund was made mistakenly and demand that the consumer transfer this money to another account.  Basically, they are involved in money laundering.

Tax Pro and Business Related Tax Scams

Often, criminals use some of the same techniques with tax pros (like accountants) as they do with consumers.  Posing as IRS reps, especially from the e-Services department, they send phishing emails to tax pros asking them to click on a link to sign into their accounts.  However, the link brings them to a fake e-Services site that steals usernames and passwords.  Sometimes, the criminals will send emails tax with attachments containing malware.  Once they click on the attachments, the software will load which tracks their keystrokes.

On the business side, cyber criminals pose as company executives and send emails to HR reps demanding employee W-2’s.  Once the HR reps reply with the requested info, the criminals have everything they need to file false tax returns.

 

Tax Scam

Realizing these serious threats, we outlined five ways consumers, tax pros and businesses can protect themselves from tax scams.

 

5 Ways to Protect Your Info from Tax Scams

Use a Secure Internet Connection

When you login into any account containing sensitive info or submit a tax return online, make sure that you are on a private, password protected network.  Don’t ever file taxes or access important information while on a public Wi-fi at Starbucks or the airport.  Instead of clicking on email links, manually type in any website address.  Also, make sure the website you connect with has a “https” in the URL and you see a lock symbol in the address bar.

Encrypt Email and Documents

If you are a tax professional, you should be using encrypted email and documents.  When you send an email, cyber criminals can access its contents at several points during its transmission.  Encryption helps to prevent people hacking into your email account and hides the email’s content from unwanted parties.  Many email services, like Microsoft Office 365, offer the option of encrypted email.

In addition to encrypting emails, you can also encrypt documents to make sure the criminals do not access them.  In order to access a file or folders, you will need to enter a password.  Microsoft Windows comes with software (Bitlocker) to do this.  Also, there is commercial software (Symantec Endpoint Protection) which will protect docs.  Instead of individual files or folders, you can protect entire drives.

Data Protection

Implement Proactive Monitoring and Maintenance Through a Trusted IT Partner

These services will make sure that your computer Operating Systems and software are automatically updated.  This will help keep your systems are secure and protected.  A trusted IT partner should be aware of the most recent threats and take steps to prevent them.

Use a Professional Firewall and Commercial Anti-virus

By installing a physical and software firewall, you create a barrier to your network from the outside world.   Professional firewalls, like Sonicwalls, look for any unusual inbound or outbound network traffic.  They also have anti-virus and anti-malware software which will scan your network for unwanted things.  In addition to a network firewall which would be an outer barrier, each computer should have its own software firewall to scan and potentially block anything which gets into your network.

While a free anti-virus may protect your systems against certain attacks, like virus infections, it may not properly protect you against certain malware.   We recommend commercial software, like Webroot, to protect your systems.

Establish Clear Business Security Policies and Procedures

A business should have specific security policies and procedures in place and communicate them clearly to employees.  For instance, every business should have a specific policy for managing users’ passwords.  It should make sure that everyone uses strong, unique passwords with two-factor authentication.  A business should require that passwords be changed every 30 – 60 days.

Every business should also educate employees on the different email and phone scams they could face, especially tax related ones.  It should have specific procedures what employees should do when they receive a suspicious email or call.  For instance, employees should never open an attachment to an email that discusses tax information.2

Additional Safety Tips

To make sure you and your business are as safe as possible, we included some additional safety tips:

  • When you receive a suspicious email or call, go directly to the source.  If your manager asks for W2’s by email, call him or her to verify.
  • If you file by regular mail, send the documents directly from the post office or a UPS/FedEx site.  Do not leave your tax documents in your mailbox.   Criminals could steal them.
  • Run regular virus/malware scans on your PCs.
  • Schedule quarterly security meetings at your business.  Regularly check that everything is in place to make your business as secure as possible

 

 

 

 

 

 

References:

 

  1.   IRS.gov “IRS Summarizes “Dirty Dozen” List of Tax Scams for 2017.” Link to Site
  2.  Wikipedia “Phishing.” Link to Article
  3.  Applied Synergy Group “5 Ways to Securely File Your Income Tax Return.” Link to Article

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Ten Ways to Protect Your Important Business Data

 

 

cyber-crime

Cyber Crime’s Rapid Growth

Did you know that cyber crime costs are projected to grow to $2 Trillion in 2019?1  That is almost four times the estimated costs of breaches in 2015. According to a new report by Hewlett Packard and the U.S-based Ponemon, hackers cost the average U.S. business $15.4 million per year2.

While large corporations have sizable IT departments, budgets and resources available, recent attacks on Target and other corporations show that they are still very vulnerable.  Because they have limited resources, including less IT support, small to mid-size businesses are especially exposed to attacks and cyber criminals know this.  These businesses often do not put formal security procedures and policies in place and do not properly train their employees on security issues. They are ripe for attack.

For more information about the business of cyber crime, please view the following video:

 

Cyber Crime Types

 

Cyber crime can include viruses, malware, hacking of websites or networks, phishing & social engineering, Botnets, Denial of services attacks (DoS), stolen devices and malicious insiders.  As the most common type of attack, viruses, spyware and malware may be unknowingly downloaded when an employee opens an attachment from a malicious email or visits websites with embedded viruses or malware while at work. They can cause computers to slow down and become unstable, track user keystrokes or can sometimes spread through the company’s network scrambling any data they run into.

Phishing is becoming an increasingly common way to gain access to important business and personal information.  Typically, it happens in a business when an employee receives an email which appears to be from a higher up and asks for employee or customer information.  Thinking it is a legitimate email, the employee replies with the requested information.

Phishing Example:

 

paypal_phish_example

Cyber Attacks Could Never Hit My Business

 

Some business owners don’t think that they could ever become victims of a cyber attack.  They say the chances are very slim.  Are they really?

Of the 252 businesses surveyed by the HP and Ponemon report, 99% reported being hit by virus and malware attacks, 62% were affected by phishing schemes, 45% had stolen devices and 35% experienced attacks by malicious insiders3.

You don’t have to look far in the Philadelphia area to find recent attacks.  In March 2016, an HR representative sent the personal information of about 11,000 Main Line Health System employees to a cyber criminal4.  This representative replied to a phishing email which appeared to be from a manager.

The point is that any individual and small to mid-sized business is vulnerable to intrusion by cyber criminals.  Therefore, it is extremely important to take steps to reduce this exposure and limit the damage, which could result from an attack.  Below, we will outline some of the basic steps business and personal users can take to protect themselves and their critical data.

Ten Ways to Protect Your Critical Business Data

 

Conduct a Security Audit

 

network_security1

Before your company can put certain security policies and procedures in place, it needs to assess the current state of its IT infrastructure.  An IT services company or professional will conduct a security audit where they will look at your network setup and configuration.  They will also closely examine all of the devices and software your company uses.  Finally, they will examine your website.

The main focus will be on the vulnerabilities which exist and eliminating those.  Could someone easily hack the wireless network?  Is there any firewall to prevent malicious traffic from entering or leaving the business’s network?  What email service is the business using?  Is it secure?

One of the most important parts of the audit is identify the company’s critical data and where it resides.  Knowing this information, you can design policies and procedures meant to protect and backup up this vital information.

Set and Communicate Company Security Procedures and Policies

 

While this may seem obvious to do, a lot of small to mid-sized companies do not have formal IT policies and procedures in place.  Even if they do, they may not have communicated these clearly to their employees.

These should be clearly defined and as detailed as possible.  Should every company computer lock up and require a password to log in after 30, 60 or 90 seconds?  Who should have access to which data?  What happens if an employee leaves or is fired?

Mobile devices, like smart phones and tablets, have added to the complexity of designing a plan.  There need to be specific rules related to what information employees can access using theses devices.  There also need to be plans as to what will be done if an employee’s laptop, phone or tablet is stolen or hacked away from the office.  Some companies require that their employees’ smart phones are set up so that they can be remotely wiped, in case they are stolen.

Install a Hardware Firewall

 

firewall-networkA hardware firewall is the first line of defense for a company’s network.  It will protect a company from suspicious traffic entering and leaving the company’s internal network.  It can also limit content and websites employees can access, which will prevent malware and viruses loading onto computers.  A firewall should have an active anti-virus subscription to screen any files or traffic entering.  For specific brands, Nucleus recommends Sonicwall or Cisco firewalls.

Separate Guest and Company Wireless Networks

 

Some businesses let visitors connect to their wireless network by giving them the network key.  This is an invitation for disaster.  Once someone gets this information, they can easily access important company information.

Businesses should set up a guest wireless network which is completely separate from their own wireless network.  Also, they should avoid using a Comcast or Verizon provided router.  These routers lack the security and configuration features of enterprise grade routers.  Also, they tend to transmit a weaker wireless signal which travels less distance.

Use Strong Passwords on Every Device

 

This may seem very obvious, but unfortunately when given complete freedom to set up their own passwords, employees often choose ones which are very easy to hack.  All you have to do is look at the 2015 top login passwords to see this.  “123456,” “password,” and “12345678” were the top three5.  It doesn’t take much imagination to guess these.

In general, passwords should be at least eight characters in length and require a capital letter, number and symbol to be secure.  Employees should not use the same password across all accounts.  If a hacker figures out an employee’s email password, then he or she will be able to get into all of the employee’s banking, file sharing and social media accounts.  Think of the damage that can be done!

Regularly Update Your Operating Systems and Software

 

Windows7Update_UpToDate

This seems like a simple practice, but many businesses fail to pay attention to updates.  Recently, we saw a server which had not installed any Windows or software updates for over a year and a half.  When you are in the middle of work, it is annoying to see a pop up asking you to do an update and restart the computer.  They always seem to come up at the worst time.   It is understandable that you might ignore or close out these popups to continue working.

It is very important to do Windows and software updates, because they will help your system to be protected from malware and virus exploits.  Operating Systems and software, that have not been updated leave a door open for these exploits.  At the very minimum, you should install Windows, Adobe and Java updates on a regular basis.

Install a Reputable Anti-virus on Every Device

 

While a hardware firewall provides an outer barrier for your company’s network, an anti-virus on a PC will provide a second layer of protection in case something was able to penetrate.  An anti-virus can prevent employees from downloading or running malicious files.  While many people think that their Macs and smart phones will not get viruses, the truth is that they can be infected.

Recently, Nucleus has seen more Macs getting infected.  As the number of smart phones in the world increases rapidly, cyber criminals are looking to infect and hack them.  Therefore, it would be smart for businesses to have antivirus installed on all smart phones and Apple devices.

Limit Remote Access to a Virtual Private Network (VPN)

 

Employees are increasingly working from home or remote locations and need access to important company information.  Smart businesses limit the amount of company data employees’ have on their devices, including smart phones and they centralize their data. If employees need to access company information, they should do it through a Virtual Private Network (VPN).  This is the most secure way to create a remote connection.

Encrypt Data and Emails

 

security-and-computer

Encryption adds another layer of protection to a company’s data.  It makes it nearly impossible for cyber criminals to access information.  If an encrypted laptop were to be stolen, it would be worthless to a criminal, except as a large paper weight.  Encrypted emails are transmitted in a way that the cyber criminal has no way to decipher the message.  There are many solid encryption software products, like VeraCrypt, DiskCryptor, Folderlock and Kryptos 2.

Backup and Disaster Recovery

 

While it is important to take steps to prevent any cyber attack from happening, it is impossible to protect your business 100%.  New and more complex malware and viruses are created each day.  For this reason, it is important to have a disaster recovery plan and data backup in place in case a cyber attack happens.

Your disaster recovery plan is the overarching plan which outlines how your business will respond when hit by a number of disastrous events.  These include fires, floods, hurricanes, power outages, terror attacks, virus and malware infections, hackings and harmful employee acts.   In the case your business location(s) is(are) completely destroyed or unusable, you want to have an alternative offsite location to conduct business.  You want to designate who will communicate with everyone in the business about the next steps and which employees will be expected to show up at the alternative location.

Your data backup is a critical part of the disaster recovery plan.  We have been able to save several clients by restoring backups when their systems have been encrypted by the Cryptolocker virus and other “ransomware.”   Typically, we recommend both onsite and offsite backups.  Your backup should be frequent and automatic, so it is not dependent on anyone remembering to do it.

Final Thoughts

 

Today, cyber crime attacks are happening more frequently and causing more damage to individuals and businesses every day.  Because of a lack of resources, small to mid-sized companies are especially susceptible.  Owners and employees have only a limited amount of time to dedicate to IT security issues before their daily focus is pulled away from operations.

Cyber crime’s growing threat makes it increasingly important that businesses better protect themselves.  In order to give businesses a starting point, this blog post has covered some of the basic protective steps every owner, manager and employee should take.  After these steps, there is much more that can be done.  Our future posts will touch on these next steps.

Stay tuned!

References:

 

1 Juniper Research “Cybercrime will Cost Businesses over $2 Trillion by 2019:  Link to Article
2 Ponemon Institute “2015 Cost of Cyber Crime Study”: Link to Download the Study
3 Ponemon Institute “2015 Cost of Cyber Crime Study”: Link to Download the Study
4 ABC 6 News “Main Line Health Employees’ Information Compromised in Email Scam”: Link to Article
5 Gizmodo.com “The 25 Most Popular Passwords of 2015”: Link to Article