Your Tax Refund Is Selling Cheap On the Dark Web

Tax season is hog heaven for cybercriminals. The thought of all that personal data just sitting around, unmolested in tax documents, inspires a torrent of creepy scammer creativity. Then the warnings tumble in: We’re warned about attempts to steal our data in emails from the IRS; our companies assign us courses on how to identify phishing emails; we read about the latest victims in the news.

What we don’t see is how our tax data is bought and sold, and what scammers charge other scammers for our data. The Krebs on Security blog provided a glimpse earlier this year, when founder Brian Krebs came across something he hadn’t seen before on the Dark Web: Bulk sales of W-2 forms. A scammer had phished a tax preparation firm, Krebs discovered, and was offering for sale 3,600 Florida W-2s in this cyber netherworld which, while connected to the everyday web, requires special software or authorization to access.

Another window into that world comes in a new report from IBM’s commercial security research team, Cybercrime Riding Tax Season Tides. The company has skin in the game—it sells services to protect companies from cybercrime—which means it’s also in a good position to see what’s going on in scamland.