Phishers return for the UK tax season

With the tax season in full swing, cyber criminals are returning with a fresh crop of taxation-related phishing attacks.

Researchers with McAfee Labs are reporting a new round of phishing emails seeking to defraud UK taxpayers. The emails claim to be from HM Revenue and Customs (HMRC) reporting unclaimed tax funds. Users are asked to follow a link within the message to an external site.

Upon visiting the site, users are presented with a site that includes both valid links to external pages from HMRC as well as several links to supposed banking sites which are in fact phishing pages designed to harvest account credentials.

Phishing operations around tax time are nothing new. Over the last several years, scammers have constructed phony notification scams which target taxpayers in both the UK and the US.

Neither the HMRC nor the US Internal Revenue Service ever contact users about tax refunds or rebates via email, but the scams continue to work.

McAfee Labs director of research and communications Dave Marcus told V3.co.uk that while this year's scams show little difference from those in previous years, the tactic continues to be effective for cyber criminals looking to make money.

"You cannot get around the fact that there are always people who are doing their taxes online for the first time. These things prey on that," said Marcus.

"They are going to see the brand, think it looks like the site, and [the attack] is most likely going to work."

Marcus recommended that users exercise caution when receiving any unsolicited emails claiming to originate from HMRC or any other financial institution. He also advised users to run browsers which support anti-phishing security tools.