Forest Global Training Partners

Cyber Risks · Krebs on Security

Thieves Phish Moneytree Employee Tax Data

Summary: Moneytree, a Seattle-based payday lender, emailed employees on March 4 stating that a team member fell victim to a phishing scam in which the scammer impersonated co-founder Dennis Bassford and requested payroll data, exposing names, home addresses, Social Security numbers, birthdates and W2 information for current and former US staff who worked there in 2015 or were hired in early 2016. The company said its servers and security systems were not breached and its customer records were unaffected, and it will add $50 to employees' next paycheck to cover the initial cost of a credit freeze.

Bottom line: W2 data feeds tax refund fraud, which the source describes as a multi-billion dollar problem in which thieves file a return in the victim's name and direct the refund to an account they control - and victims typically learn of it only when their own return is rejected. The author estimates, from reader emails alone, that hundreds if not thousands of companies fell for these scams this year.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related