How I almost fell for an IRS phishing scam

“Remember, don’t tell anyone what you’re doing, you have committed a federal crime and it’s illegal to speak or call anyone about your case” those were the words I heard through my earpiece as I walked into a Target this morning to purchase $4,500 worth of gift cards to pay the IRS so I could avoid being arrested and going to jail.

Earlier that morning I received a robocall from the IRS stating they sent me several written notices, but this call would serve as my final notice to pay back taxes or face criminal charges and arrest and instructed me to call back immediately.

Over the course of my tax paying years, I’ve certainly had a letter or two from the IRS, owing $500 here-and-there from an odd 1099 consulting job that I neglected to file, so the idea that I owed some back taxes wasn't out of line for me mentally — and even though I’d heard the IRS “doesn’t make phone calls” I felt like the robocall was an exception. I could imagine a world where the IRS would automate collection with robocalls. I started to feel a little fear. Did I truly miss paying some taxes sometime between 2008 and 2014? Possibly. So I called back.

The Call Back

“Hello, this is Officer Charles Robinson and you are on a recorded line with the Criminal Investigation Division of the Internal Revenue Service my Badge ID is IRN7350726 thank you for calling us back. Your case number is IRC4265 and you are under investigation for tax fraud for intentionally underreporting taxes between the years 2008 to 2014. With penalties and interest you owe $4,447. Mr Hemeon did you intentionally or mistakenly underreport your taxes in the years 2008 to 2014?”

His statement fed my fear, my adrenaline kicked in.

“Really? Are you kidding? I don’t do my taxes, my accountant does. So there has to be some mistake.” I ended that sentence with a nervous laugh.

“Please Mr. Hemeon, this is very serious, you are being charged with a federal crime and we have a warrant out for your arrest. So please, let me ask again, what was your intention? Did you intentionally or mistakenly underreport your taxes?” He was stern and direct, not emotional (just how I would imagine an IRS agent).

I answered “Mistakenly —I think I should get my accountant on the phone or at least maybe a lawyer.”

Officer Robinson jumped in “Let me remind you this is a recorded line, what you say can be used as evidence in a federal court case. Because of the nature of this crime I need you to stay on the phone and not mention this to anyone else, do you understand?”

“Yes — sorry for laughing — I understand.”

“Mr. Hemeon, let me be more clear, we have an officer standing by who will come to your place of work and arrest you. We believe you intentionally avoided paying taxes — ”

I interrupt, “Wait, you’ve already convicted me?

“Mr. Hemeon let me finish my complete statement before you interrupt”

I raise my voice “What do you mean you have a cop ready to arrest me?Please explain”

“Mr. Hemeon I know you are upset, but please understand, we have tried many times to collect this payment from you without success. You have broken the following internal revenue code 6331H and 30F and intetionally defrauded the federal government, this is very serious.”

I humble myself “Ok — can I please speak to your superior, this feels irregular and I have more questions.”

“Of course” — I wait for a few minutes and then Im greeted by a new voice.

The Superior Officer

“Hi, my name is Agent Conner Wolf my badge number is IRN00435 I want to remind you, you are still on a recorded line. You have a choice to make. You can either make a payment today which will resolve this matter or we can proceed with the legal alternative”

“Whats the legal alternative?” I ask.

“We carry out our warrant for your arrest. An officer will show up at your work and arrest you. We will garnish your wages and put a lien on your home (cites my address) and you will face up to 5 years in prison.”

His statement was unemotional and transactional as if he was just doing his job. My stomach turned over and I thought about not being able to see my children for 5 years. I was at top fear. I needed to somehow verify what was happening but couldn't leave the line for fear of an officer showing up at my work and taking me away.

“I’d like to make a payment. I can pay today” I said this shaking my head. I was in total disbelief.

“That’s good to hear Mr. Hemeon, and the IRS thanks you for your cooperation. I believe you did not intentionally try to underreport your taxes. Lets work together to get this resolved”

He then read some statements that sounded like legalese and then proceed to tell me he would be collecting payments through the EFTPS — the Electronic Federal Tax Payment System, looking up the system online with my phone real quick I found the official site and got out my Visa ready to make a payment — then things went sideways.

“Mr. Hemeon in order for us to resolve this matter. We must receive your payment today. In order to avoid being arrested you must follow our protocol so we can guarantee reception of payment today. Can you agree to this?”

“Yes — tell me what I should do?”

The Drop

“We have a partnership with local retail stores who are able to transfer EFTPS payments to us in real time, the closest partner to you is Target 2 miles from your location (I previously mentioned I was in Costa Mesa). Please proceed to your vehicle and honk the horn when you get inside”

I snagged headphones, and hopped in my truck, gave the horn a few taps.

“Good, thank you Mr. Hemeon, now please proceed, and remember to drive carefully and safely. Please let me know when you have arrived at the Target on Harbor Blvd.”

I arrive at Target. It’s been almost 1.5 hours of me talking with “The IRS” and I just want this to be over. I fear hanging up or losing connection because I believe it will result in a police officer showing up at my work.

“Ok. Mr. Hemeon please listen carefully, as you know you are under investigation for a federal crime and we appreciate your cooperation to resolve this matter. You are not allowed to discuss this case with anyone. I want you to keep me on the phone and enter the Target and purchase 3 gift cards — two for $2,000 and one for $500 — this will cover your outstanding tax bill of $4,447.”

I walk in to purchase the gift cards, the cashier looks at me funny when I ask to purchase $4,500 worth of gift cards. She asks for my I.D. and gives me a look as if to say “is everything ok?” — I desperately wish she would call over her manager and somehow block the transaction so I have a way out. Alas, the transaction goes through, I walk out of Target keeping my callers identity and purpose a secret.

When I get to my truck I’m instructed to read off the gift card numbers over the phone. He says to please hold while he enters them into the EFTPS. While we wait, I start my truck and drive the 2 miles back to my office. I ask him which IRS office he works in. He says “Downtown, on Constitution Avenue — 1111 Constitution Avenue” I tap the address into my phone and sure enough the first result is“Criminal Investigation Division IRS”. I continue with chit-chat, I ask him about where he likes to eat in DC, I tell him I’m from Vienna Virginia. He cites a restaurant or two local to DC, says he commutes in from Maryland everyday but hates the beltway. The tone of our conversation is almost friendly.

“Our servers are taking a bit longer than normal Mr. Hemeon, I apologize, please continue to hold. We will have a confirmation number for you shortly. Also, we will be sending an agent to your home in the next week to review the errors in your taxes with you and your accountant so you understand the inconsistencies in your filings as a courtesy.”

Uncovering the lies

When I arrive back at the office everything about this feels wrong. Since I’m not supposed to be talking to anyone I sneak a text off to Joel Buekleman, my coworker, and I tell him to please come into the conference room asap. I scribble on the white board “Call IRS, I think I’m being scammed, and need to verify if they take payments via Target Gift Cards” Joel quickly looks up an IRS office number and can’t get anyone on the line, tries a few other numbers and fails to connect with anyone at the IRS.

“Mr. Hemeon, hello, sir, are you there?” I had them on mute. “Mr. Hemeon can you please repeat the numbers on your gift cards, we need to verify them again, sorry this is taking so long”

At this point I just need to buy some time “Yes, no problem — actually, I really need to go to the bathroom, Im not hanging up, but can I put you on mute so I can have some privacy” they agree.

I quickly grab Joels phone and call the only person I know who actually works at the IRS, of course he is my ONLY friend who does not own a cell phone and is impossible to get a hold of, I text my wife who texts his wife, who then gives me his office line — I call it frantically. The call goes straight to voicemail. I panic. I call him again and again — hoping he picks up. Finally I hear his voice —

“Micah! I don’t have time to explain, but I’m on the phone with the IRS and they just had me pay them in Target Gift Cards to resolve a tax issue (as the words come out of my mouth, I realize how ridiculous I sound) — this feels wrong, but they told me I would be arrested if I didn’t cooperate and follow their protocol — can you help?”

He quickly told me I was the victim of a scam and to hang up. Ironically, it took him good 5 minutes to convince me, I was that bought into the scam. I don’t know why I felt so convinced, but I did. Having Micah’s reassurance gave me confidence. I heard them crack through on the other phone.

“Mr. Hemeon are you still there?”

“Yes — yes, I am sorry, I have someone here in my office now, I need to talk with them about work, please give me another 5 minutes” I was trying to buy more time. I called Target customer service to cancel the gift cards. I quickly learned they had only partially used one of the gift cards and hadn’t had the chance to extort the remaining two cards. Target swiftly canceled the cards. I felt like I had won a small victory.

Armed with the truth, I unmuted my phone to confront my attacker.

“Hello Agent Wolf (the irony of his name hitting me squarely), you sir, are a liar and a thief. The cards have been cancelled and funds returned. I’m sure someday, somehow you will feel the weight and guilt of what you’ve done. I’m confident the universe will have it’s way with you.”

He paused a moment, then replied with a slight smirky laugh “You were fun.” and hung up.

Aftermath and Lessons Learned

I know what you’re thinking. Cause I would think the same thing. You would have been wiser, more aware, caught on sooner and perhaps you’re right. But, just in case you get snagged in one of these webs, here are some tips that may help:

  1. Ask them to tell you what you paid in taxes last year or the year before
  2. Ask them to recite your social security number to you — granted I have read in some cases, they will have your social, but certainly they will not know your tax return amounts.
  3. The IRS DOES make phone calls occasionally, despite the wide spread belief that the IRS never calls you. However, they will only call for very serious issues and only after many written attempts. The call will be in a less urgent tone more casual and will allow you time to call back and schedule time. Typically calls are only from an investigator at the IRS and involve highly illegal activity like money laundering or drug deals — so as long as you’re not doing anything nefarious, you probably wont get a call.
  4. Getting reimbursed from Gift Cards is almost impossible, even when they are cancelled, I had to spend many hours on the phone with Target to get my refunds.
  5. Wells Fargo fraud division could not help me. Because I used my PIN and debit card and purchased Target Gift Cards I was not able to file a chargeback or dispute on the funds, use pure credit cards for better protections.
  6. Target was not able to tell me what was actually purchased on the gift card. They said this data is private and they cant disclose items purchased on a gift card without a subpoena.
  7. I filed a police report with the City of Costa Mesa and they told me they would not investigate since they believed the attackers where out of the country (despite using a number from Norwalk, CA). I insisted on filing a report. I’m not holding my breath, but who knows, maybe some piece of info I provided can tip someone off someday.
  8. No amount of tech can save you from social engineering. I was surprised how easily I was put into a fear cycle and how much I was open to working with the authority figure. A healthy does of skepticism would have helped me here.
  9. No government agency will ask you to make payments with any kind of gift cards
  10. You may think, like I did, you are not vulnerable to an attack like this. Now that you know the gift card attack, I doubt you will fall for it, but there will be other more sophisticated attacks in the future — be aware. Ultimately, you have to rely on yourself to keep yourself safe.

Thank you for reading and If you have had a similar experience please share in the comments below — the more folks who share these stories the further we can get the word out.

You can follow me on Twitter here @hemeon