Technology Advisor Blog

As we embrace the Spring season and the promise of April showers bringing May flowers, we also enter the busy and often stressful time of tax season. This period sees a high volume of sensitive financial information being exchanged as individuals file their taxes in hopes of securing refunds. Unfortunately, it’s also a time when scammers are at their most active, tirelessly seeking ways to deceive taxpayers and exploit their financial situations.

While scams can occur year-round, tax season presents a prime opportunity for fraudsters to target individuals with tactics like identity theft or maliciously misleading them into falsely claiming tax credits. To help protect taxpayers from these malicious schemes, the IRS annually releases its “Dirty Dozen.” First introduced in 2002, the Dirty Dozen highlights twelve prevalent scams that pose a serious threat to taxpayers. This educational initiative aims to raise awareness and arm taxpayers, professionals with the knowledge needed to avoid falling victim to these fraud tactics.

Within the last year, a new combined effort has emerged, designed to better protect taxpayers from falling prey to malicious fraudsters. This new task force is referred to as the Coalition Against Scam and Scheme Threats. Or also known as the CASST. This new combined effort follows the increased volume of scams and schemes that have intensified in sophistication with the assistance of AI during the past filing season. The new use of AI for phishing aims to benefit fraudsters and exploit vulnerable taxpayers in any way possible.
According to the IRS.gov, “Across the spectrum of the tax system, we’ve seen a rising tide of scams and schemes that try to exploit taxpayers and find gaps in government and industry defenses…This new collaborative approach will allow the private and public sectors to throw our combined weight against this threat…”
Source: https://www.irs.gov/newsroom/dirty-dozen-tax-scams-for-2025-irs-warns-taxpayers-to-watch-out-for-dangerous-threats

While tax theft remains a concern for majority, these fine-tuned protections have already protected millions of taxpayers and prevented millions of fraudulent payments with quicker scam identification methods.

The primary purpose of CASST is to enhance taxpayer protection. Building strong relationships within the tax ecosystem, reducing the frequency of fraudulent tax returns. This collaborative effort helps strengthen defenses across the public and private sectors. This makes it more challenging for scammers to submit improper or false tax returns. Additionally, the group aims to implement long-term structural changes that will significantly improve the identification and prevention of scams amongst many.

Let’s Go Over The Types of Scams That Are Identified in These Documents:

Email phishing scams: Arriving in the form of unrecognizable phone numbers, sending out text messages and emails to bait unsuspecting victims into urgently providing them with sensitive personal and financial information.

Phishing: Phishing emails lure victims into making rushed and irrational decisions by threatening victims with fake criminal charges or an abundant tax refund. They will always have you make a quick decision to catch you off guard to their attempts.

Smishing: Smishing is seen in text messages where scammers use language to create a sense of urgency such as a compromised account and providing ‘solutions’ to resolve these fake issues. Particularly for tax season, scammers promise a high tax refund to get anyone to fall for their tactics.

As a reminder, please never click on any links where you do not recognize the sender as those links may automatically load malware and block users from accessing their systems files.

Bad social media Advice is Everywhere:

Another growing concern in 2025 is the active misinformation on social media. Misinformation is used to mislead honest taxpayers with bad advice, potentially leading to identity theft and tax problems. Social media platforms, for example like TikTok share wildly inaccurate tax advice. Some involve urging people to misuse common tax documents like Form W-2.

Fake charities: Fake charities arise during significant events such as a crisis or natural disaster. Taking advantage of the public’s generosity, scammers set up fake organizations to seek money and personal information.
It’s also important to note that those who contribute charitable donations only count if they go to a qualified tax-exempt organization recognized by the IRS.

False Fuel Tax Credit claims: The Fuel Tax credit is unavailable for most taxpayers as it is meant for off-highway business and farming. However, misinformation on social media continues to influence taxpayers into looking for alternatives to increase their tax refunds. Due to this increase, the IRS urges folks to do more research to see if they are eligible or properly claiming this credit.

Credits for Sick Leave and Family Leave: During the height of the pandemic from 2020-2021, self-employed folks were eligible for these credits. Past 2021, these forms are no longer available or eligible. The IRS has seen instances where taxpayers use Form 7202. Incorrectly claiming credit based on income earned as an employee and not as a self-employed individual. Social media has referred to this incorrectly as the “Self-Employment Tax Credit,” and many folks do not qualify for these credits.

Improper household employment taxes: Taxpayers claim they have employees within their household to file Schedule H (Form 1040), Household Employment Taxes. The intent is to claim a refund based on sick/family leave wages that did not occur.

The overstated withholding scam: People on social media who discuss inaccurate tax information have been encouraging those to fill out a Form W-2, Wage and Tax Statement, or other forms like Form 1099-NEC and other 1099s with false income and withholding information.

IRS Individual Online Account help from scammers: Scammers have also gone and posed as “helpful" third party member offering to help create a taxpayer's IRS Individual Online Account at IRS.gov when there’s information on how to set up your account online accessible to everyone. These fake third parties are made with the intent to take your sensitive financial and personal information for fraud.

The IRS and CASST warn people not to fall for these scams and to seek out other reputable sources. Those that file fraudulent tax returns will be faced with criminal charges and other serious consequences.

In instances where the IRS cannot verify the wages, the tax refund will be placed pending until further review. Taxpayers should file a complete and accurate tax return to the best of their abilities and knowledge to avoid any inaccurate information.

Helping yourself and your employees to identify threats

It’s important for business to invest into implementing both technical tools and human training to flag unknown messages from senders. Some training methods businesses can use to help their employees identify better scams include videos, bulletins, and real time simulated phishing emails to help employees recognize and respond to threats. According to Steinhauer, he advises companies to also hold regular meetings to assess data security threats and reflect on past challenges and success in planning improvements. AI can come in and detect common scam methods. Along with implementing technical and human knowledge on scams, businesses also should investigate working with IT/cybersecurity teams such as Ekaru for an additional set of monitoring of unauthorized activity. Working with an MSP such as Ekaru, companies can do what is called pre-season huddles where the business goes over present threats and best communication practices to help employees and themselves stay alert for anything unusual.
Source: https://tax.thomsonreuters.com/blog/expert-insights-on-payroll-data-security-and-tax-scams-in-2025/

Along With Great Communication Between Businesses and Working With IT Cybersecurity, Ekaru Can Help Local Businesses Like Yourself With:

1. Implementing Robust Security Protocols:

• Multi-Factor Authentication (MFA): Ekaru can set up MFA across systems to ensure only authorized users can access sensitive tax and financial data.
• Encryption: Ekaru ensures that sensitive tax documents and communications are encrypted both at rest and in transit.

2. Backup and Disaster Recovery Plans:

• Regular Backups: If a business falls victim to ransomware or other data-destroying attacks, having backups ensures data recovery.
• Disaster Recovery Plans: In case of a cyberattack, Ekaru can implement and test disaster recovery plans to minimize downtime and protect data integrity.

3. Monitoring and Threat Detection:

• Continuous Monitoring: Ekaru provides monitoring for unusual activity on networks, spotting potential breaches early.

4. Securing Tax-Related Software and Platforms:

• Patch Management: MSPs ensure that all tax-related software and systems are up to date with the latest security patches, preventing exploitation of known vulnerabilities.

5. Identifying and Blocking Malicious Websites:

• DNS Filtering: Ekaru can implement filtering to block access to known malicious websites.
• Web Security Tools: Advanced web security tools to prevent employees from accidentally visiting fraudulent sites that may steal personal or financial data.

• Secure Communication: For businesses working with accountants, auditors, or tax preparers, MSPs can ensure secure communication channels, such as encrypted emails or secure document-sharing platforms.

6. Regulatory Compliance:

• Adhering to Standards: Many industries have compliance requirements related to tax data security (e.g., GDPR, HIPAA, PCI-DSS). MSPs can help businesses comply with these regulations by implementing the necessary controls and policies.

You don’t have to wait for a breach to take cybersecurity seriously. Let’s discuss smart, cost-effective solutions that make sense for your business before it's too late.

Schedule a free consultation today to discover how we can enhance your security and safeguard what you’ve worked hard to build.

One phone call could be the difference between protecting your business and becoming another cyber attack statistic.