(WAY Off Topic) WARNING: From the I.R.S.--NOT!!!

On Sunday, I received the following piece of email purporting to be from the I.R.S.:



Over 130 million Americans will receive refunds as part of President Bush program to jumpstart the economy.

Our records indicate that you are qualified to receive the 2008 Economic Stimulus Refund.

The fastest and easiest way to receive your refund is by direct deposit to your checking/savings account.

Please click on the link and fill out the form and submit before May 19th, 2008 to ensure that your refund will be processed as soon as possible.

Submitting your form on May 19th, 2008 or later means that your refund will be delayed due to the volume of requests we anticipate for the Economic Stimulus Refund.

To access Economic Stimulus Refund, please click here.

[Link removed--should you click on this link, you would be directed to this site: www.smfarms.com/catalog/images/hewlett_packard/.refund.php--definitely not the I.R.S.


Gmail also removed the URL from "click here."]

© Copyright 2008, Internal Revenue Service U.S.A. All rights reserved.
__________________________________________

Despite some of the grammatical errors, this email is very convincing because the sent info specified "service@irs.gov" as the actual sender. To give gmail its just due, the message contained the following warning (Highlighted in bold red):

Warning: This message may not be from whom it claims to be. Beware of following any links in it or of providing the sender with any personal information. Learn more. [This link shows how you can check your gmails for validity.]

Here is the code I found when I clicked on to "Show original":

Delivered-To: [Deleted]
Received: by [Deleted] with SMTP id u1cs271976wfu;
Sun, 18 May 2008 10:23:31 -0700 (PDT)
Received: by [Deleted] with SMTP id [deleted];
Sun, 18 May 2008 10:23:30 -0700 (PDT)
Return-Path:
Received: from dollman-enterprises.com (mail.dollman-enterprises.com [68.105.207.240])
by mx.google.com with ESMTP id h8si9853846wxd.26.2008.05.18.10.23.29
;
Sun, 18 May 2008 10:23:30 -0700 (PDT)
Received-SPF: fail (google.com: domain of service@irs.gov does not designate 68.105.207.240 as permitted sender) client-ip=68.105.207.240;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of service@irs.gov does not designate 68.105.207.240 as permitted sender) smtp.mail=service@irs.gov
Received: from User ([76.202.29.82]) by dollman-enterprises.com with Microsoft SMTPSVC(6.0.3790.211);
Sun, 18 May 2008 13:23:28 -0400
From: "service@irs.gov"
Subject: 2008 Economic Stimulus Refund ( $1800 )
Date: Sun, 18 May 2008 12:24:23 -0500
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Return-Path: service@irs.gov
Message-ID:
X-OriginalArrivalTime: 18 May 2008 17:23:28.0887 (UTC) FILETIME=[E3464070:01C8B90B]
_______________________________

But I must admit, this particular scam message caught my eye, although I did NOT fall for it; the I.R.S. has offered plenty of warnings about not using emails with links for official business.

Just remember: you need only to file your U.S. Federal tax return to receive your economic stimulus check.


[Disclaimer: I have posted this message on at least two other of my sites. You are welcome to copy it on your site.]

2 comments:

  1. By the way, you can combat this sort of thing by forwarding any message purporting to be from the IRS to phishing@irs.gov

    ReplyDelete
  2. Thanks for the tip, anonymous.

    I have done this.

    I wonder if the I.R.S. will look into it?

    By posting the email (in several places), I hope to reach at least a few people.

    ReplyDelete

The following are subject to deletion:

--Comments with outside links
--Off topic comments
--Advertising and general spam
--Hate speech
--Name calling
--Bad language
--Accusations
--Pornography

We are Indies




If you are an Indie writer,

please consider joining



on Facebook.