A fake EFIN or IRS e-Services email often creates an urgent account problem, then asks the preparer to download a tool or sign in through a message link. Verify the request independently before opening an attachment, entering credentials, or approving an authentication prompt.
The sender’s display name and a familiar logo are not enough. Attackers can copy both while sending the message from an unrelated account or directing the user to an imitation website.
Key takeaways
- Verify an EFIN or e-Services request through an independently trusted IRS route.
- Unexpected downloads and message-supplied sign-in links are warning signs.
- Report the message and preserve evidence through the firm’s defined process.
- After a click, tell IT whether a file ran, credentials were entered or a prompt was approved.
Table of Contents
What has been documented in an EFIN-themed campaign?
Microsoft’s tax-themed threat analysis describes a 2026 campaign claiming that irregular returns had been filed under the recipient’s EFIN.
The message directed recipients to a supposed IRS transcript viewer. The downloaded file instead installed an abused remote-access tool that could give the attacker control of the device.
This is a documented campaign pattern, not evidence that every similar message belongs to the same attacker. Subject lines, domains, and payloads can change.
Two illustrative lures staff should recognize
These fictional, abbreviated examples illustrate warning signs. They are not genuine IRS notices and contain no working links.
Example 1: A download framed as a compliance task
“Returns associated with your EFIN require immediate review. Install the viewer to see the affected records.”
The warning signs are the unsolicited executable, pressure to act immediately, and an instruction to obtain a government-related tool through an email link. Do not download it to investigate whether it is real.
Example 2: A login framed as account revalidation
“Your e-Services access will be suspended. Revalidate your account using the sign-in button.”
The warning signs are a threat of lost access and a sign-in route supplied by the message. A polished page and a valid HTTPS certificate do not establish that the site belongs to the IRS.
Train staff to recognize the requested action, not memorize one subject line. A new variation may use different wording while asking for the same dangerous step.
How should you verify an IRS account message?
Close the message and navigate through a trusted bookmark or a manually entered official website. Use a known IRS contact route when clarification is needed.
Check the actual sender address and destination, but do not make those checks the only defense. An attacker may use a compromised legitimate mailbox or a look-alike domain.
If the firm cannot confirm the request independently, route it to the security contact. Staff should have permission to pause an urgent-looking task rather than feel compelled to prove responsiveness.
Avoid replying to the suspicious message. Do not use a phone number from it to verify the sender.
For ongoing checks of the firm’s filing activity, use Verito’s EFIN protection and monitoring guide. Monitoring complements incident response; it does not replace investigating a suspicious message or unauthorized access.
What should staff do when nothing has been clicked?
Report the message through the firm’s defined process. Where safe and supported, preserve the original as an attachment so the security team can examine headers and links.
Follow the IRS reporting instructions for suspicious IRS-related email, including reporting to [email protected]. Preserve any evidence needed for a firm investigation before removing the message from ordinary use.
One staff report can help IT find related messages elsewhere in the firm. Ask whether other recipients received it and whether any interacted with it.
What changes after a click or credential disclosure?
A link was opened
Tell IT what page appeared and whether a file downloaded, credentials were entered, or a prompt was approved. Do not assume a click alone proves compromise, or that nothing happened because the page looked blank.
Credentials or an authentication code were entered
Treat the account as potentially compromised. IT should assess session revocation, credential resets from a clean device, recovery settings, mailbox rules, connected applications, and related sign-in activity.
A password change may not terminate every existing session. An attacker can also relay code-based MFA through an imitation sign-in flow.
A downloaded file was run
Stop ordinary work and contact IT through a trusted channel. Follow the firm’s containment procedure, including isolation where directed, and preserve evidence. Do not reinstall or wipe the device before the response team determines what needs to be retained.
For suspected taxpayer-data theft, follow the applicable IRS and other reporting processes with the firm’s response lead.
What information should the employee give IT first?
Use a short factual handoff: when the message arrived, which account or device was involved, the action taken and what appeared afterward. Say explicitly whether a download ran, a password or code was entered, or an authentication request was approved.
Preserve the original message and available evidence using the firm’s approved method. Send sensitive details through the trusted reporting route, not a reply to the suspicious email. Do not delay reporting while trying to prove whether the attack succeeded.
Which controls reduce the risk?
Anti-phishing software can filter suspicious messages and links, but no filter identifies every attack. Endpoint protection can help detect misuse of remote-access tools, and trained staff can report suspicious requests early.
Use the phishing-resistant MFA guide to review high-risk accounts. A stronger authentication method reduces particular credential-phishing paths; it does not remove the need for device protection and session monitoring.
Keep a tested escalation route and rehearse decisions through a breach tabletop exercise. The exercise should establish who acts when a partner, administrator, or preparer is unavailable.
How Verito helps reduce phishing risk
Verito phishing protection for accounting firms is the relevant service to discuss email filtering, staff security training, and monitoring responsibilities.
Bring a recent redacted message and an account inventory to the discussion. Confirm what the selected service covers, how staff report a message, and which response tasks remain with the firm.
Sources
- Microsoft Security: Tax-themed phishing and malware campaigns
- IRS: Report fake IRS, Treasury or tax-related messages
- CISA: Phishing-resistant MFA
