Go to the profile of Terry Nelms
Terry Nelms

A Call with an IRS Fraudster: Playing the Victim of a Scam

Have you ever received a phone call from someone claiming to be from the IRS saying that you owe the government money? Recent figures from the IRS state that they have seen a 400 percent surge in incidents so far in the 2016 tax season. These scams are wide-reaching and can seem convincing.

My name is Terry Nelms. I’m Director of Research at Pindrop. At my job, we have access to one of the largest phone honeypots in the world. We analyze more than 500,000 calls a month from over 90,000 unique source phone numbers. I’m here to share some of our research.

With the April 18 tax deadline right around the corner, we wanted to examine a type of fraud that has received a lot of attention in the past few years: Phone scams related to income taxes. As part of this research we spoke with fraudsters and pretended to fall for their scams, so that we could observe the tactics used to steal people’s money.

While in Washington DC last week we presented our findings to the FCC and FTC. Our goals were to:

  1. Understand where these calls originate from
  2. Determine how widespread the scams are today across the U.S.
  3. Help consumers understand the different type of scams these fraudsters are running and how consumers can better protect themselves

Methodology and Key Learnings

Since the beginning of the year, my team and I have been tracking more than 4,000 calls for IRS-related scams/spam in our honeypot. These calls originated from 205 different source phone numbers that were spread across 152 area codes. From these calls we looked for unique audio properties including noise levels, intermittent sound impressions and other characteristics. Through these unique qualities and machine learning techniques, a model of the caller (which we call a phoneprint) was generated. By matching calls to phoneprints, we are able to group related calls even if they originate from various phone numbers or have different voices.

We then grouped the 4,235 calls into three main fraudster approaches:

  1. Threats stating consumers owe money to the IRS.
  2. Deals to help consumers with back taxes.
  3. Offers to assist consumers with federal tax relief based on new legislation.

Because of the threatening nature and urgency communicated in the calls from the “you owe the IRS” campaign, we decided to call them back.

Turning the tables: Calling a Fraudster

We called back one fraudster from the “you owe the IRS” campaign using the callback number from the audio recording. Since fraudsters often target the elderly or people who speak English as a second language, we selected a caller with a foreign accent to play the role of the victim. We also spoofed one of the targeted phone numbers from the honeypot and listened in on the conversation to guide the responses.

While impersonating an IRS officer, the fraudster threatened our victim with immediate asset seizure and jail time due to a miscalculation in her filed taxes. Our victim is told that she must pay $1,986 in order to cancel her arrest warrant and since this is a federal case they do not accept checks, credit or debit cards.

The fraudster instructs the victim to remain on the phone while she withdraws the money from the bank and to tell no one what she is doing.

Once the funds are withdrawn, the victim is transferred to an experienced fraudster in the “accountant department” to close the payment. The fraudster instructs the victim to send the money via Western Union or MoneyGram. In this case, the victim heads to a Walmart 20 minutes away to send the MoneyGram. Wanting to keep the victim on the phone, the fraudster remains on the line, pretending to prepare the related paperwork and tells her to let him know when she arrives. Once she has the “send money” form, the fraudster walks her through filling it out. He instructs her to fill out all the sender information, but provides only the first name, last name, city and state of the recipient (minimum required fields). He also tells her to check the options for cash pickup and 10-minute transfer (they want to get the money quickly before the victim realizes it’s fraud). He then has her read back the entire form to double-check it is filled out correctly. Lastly, he warns her not to tell anyone at the MoneyGram counter what she is doing because this is a “federal transaction” and they charge an extra $1,126 for that type of transfer and he wants to save her money.

After our victim pretends to make the payment, the fraudster asks for the reference number from the MoneyGram receipt so he can check for the transfer online. When the victim asks the fraudster for a receipt she is told that a federal IRS officer and defense attorney will be at her doorstep to provide the miscalculation documents and receipt of payment. The victim is then asked for her first/last name, street address, date of birth, Social Security number and driver’s license number (so in addition to taking our victim’s money they want to steal her identity). The victim is told that they already have this information: They just need her to say it because this is a recorded line and they have to submit it as evidence on her behalf to the courthouse. The call ends with the fraudster realizing that the money was not sent.

Don’t become a victim: Indicators of Fraud

During the call we observed several indicators that the call was fraudulent:

  • Threats of immediate arrest and asset seizure: This is not how the IRS handles a tax “miscalculation.” The fraudsters are using fear and urgency to motivate the victim to promptly comply with their request.
  • Insisting the victim tell no one about the call: This happens near the beginning of the call and continues until payment. For example, telling the victim she will be charged an extra $1,126 for the MoneyGram if she tells the MoneyGram representative that this is a “federal transaction.” The fraudsters want to keep the call secret to avoid being discovered.
  • Requiring the victim stay on the phone until the payment has been made: The fraudsters were on the phone with our victim for over two hours as she went to the bank and Walmart. The fraudsters do not want the victim calling their spouse or friend and discovering that the call is likely fraudulent.
  • Demand a specific form of payment such as MoneyGram: Fraudsters want to get a victim’s money quickly and leave minimal trace information from the transaction. Whereas, the IRS is happy to accept payment using a variety of methods.

If you believe you have received a fraudulent IRS call you can report it to TIGTA and the FTC. For information from the IRS on fraud see 1 and 2.

To hear more about the latest research and findings in voice fraud follow me on Medium.