Email fraudsters are taking advantage of lax government security around a US government website to run a scam designed to trick US taxpayers into handing over sensitive personal information.

A phishing email which pose as notification of a refund from the US's Internal Revenue Service (IRS) takes advantage of security configuration weaknesses on a secondary website run by the Department of Labor, according to security firm Sophos. It warns that these emails redirect surfers to a bogus website with users fooled into thinking they remain on a legitimate US government site.

"This phish tells the user that the IRS owes them several hundred dollars and offers a web link from which they can allegedly claim the tax refund," said Graham Cluley, senior technology consultant at Sophos. "But the link in the email simply bounces the user off a US Government website onto a site owned by the criminals, who are ready and waiting to steal their credit card details, Social Security Number and other personal information."

More information, including graphics of the email and bogus website, can be found here. The phishing website used in the attack has now been taken down but the security shortcomings of the US government site targeted in the attack remain, leaving the door open for similar attacks in future.

"The phishers didn't need to hack into or compromise the government website to do this, the website has simply had this vulnerability on it all along," Cluley added. "This is a warning to every business and agency that runs a website to be very careful that it cannot be abused to bounce web surfers elsewhere." ®

Related stories

• US govt password security still dismal (6 August 2007)
• Phishers add call forwarding to their arsenal (25 April 2007)
• Demo neuters antiphishing measure (12 April 2007)
• Phishers rip into two-factor authentication (13 July 2006)
• IRS buys computer to handle Bill G's tax load (1 February 2006)
• Phishing fraudsters target Apple (17 January 2006)
• Shadowcrew six plead guilty to credit card fraud (18 November 2005)
• Email 'get rich quick' scams double in October (10 November 2005)
• UK launches major net security awareness campaign (27 October 2005)
• US regulators mandate extra eBanking security (20 October 2005)
• Phishing attack targets one-time passwords (12 October 2005)
• eBay provides backdoor for phishers (28 February 2005)